The Dentist Network Privacy Policy

The Dentist Network is the collective name used in this policy for the services below. It is not a separate legal entity. “We”, “us” and “our” mean the company responsible for the particular activity.

This Privacy policy relates to Gold Card Network Ltd and the Dentist Gold Card and the Gold Card Exchange.

For privacy enquiries, rights requests or complaints email to privacy@goldcardexchange.com. Please identify the service concerned. You can contact either company if you are unsure; we will help direct your request.

A controller decides why and how information is used. CTD Global Ltd is controller for its comparison service, enquiries, business administration and marketing. Gold Card Network Ltd is controller for its membership, introductions, benefits, referrals, fees and other activities it determines. When an enquiry passes between these services, each company is responsible for the uses it determines; the shared name does not give either company unrestricted access to the other’s records.

Dental practices are controllers for clinical assessment, treatment, patient records and their own communications. Where Gold Card Network Ltd carries out a specific booking, record-maintenance or follow-up task solely on a practice’s documented instructions, it acts as that practice’s processor for that task. Its separate use for its own membership or commercial administration is controller activity. If an activity is jointly determined, the relevant notice will identify the joint controllers and explain the substance of their responsibilities and how to exercise your rights.

We provide administrative, introduction and membership services. Your treating practice remains responsible for clinical advice, treatment decisions and clinical consent. Merchants, finance providers and other independent providers explain their own data use in their privacy notices.

Depending on your interaction, we handle:

• Identity and contact information: name, title, email, telephone number, postcode, date of birth where needed for matching or registration, and demographic details supplied for an authorised booking.
• Membership and referral information: account and card identifiers, QR codes or links, originating channel, referrer attribution, corporate eligibility, benefits, preferences and acceptance records.
• Enquiry and care-related information: treatment interests, symptoms or history you provide, photographs or documents, correspondence, consultations, bookings, attendance, treatment plans or progress where relevant. Information showing that you receive dental care may itself be health information. This included the receipt of and use of dental treatment plans and circulation as required to dental practices.
• Financial and transaction information: agreed prices and discounts, payment references, amounts, dates, method and status, refunds, invoices, fees, reward calculations and payout details. Payment providers handle the payment credentials entered into their facilities.
• Business information: practice and merchant contacts, staff roles, professional details, locations, services, offers, practitioner identifiers and integration settings.
• Technical and activity information: IP address, device and browser details, session identifiers, usage events, referral links, security and access logs, and consent or objection records. Optional tracking is governed by the Cookie Policy.

We receive information directly from you; from a person authorised to act for you; from participating practices and their connected practice management systems; from the other network operator; and from corporate partners, referrers, merchants and payment or finance providers where relevant to the service requested. We also receive information from the suppliers operating our services. Public practice and professional information may come from business websites or professional registers.

Where information comes from someone else, we explain its source, categories and use when we first contact you or disclose it, or within one month of receiving it if earlier, unless a lawful exception applies. A referrer should normally give you their link so that you choose whether to submit your information. Providing someone else’s details does not give consent on their behalf.

We identify information needed for a requested service when collecting it. Without necessary contact, eligibility or booking details, we may be unable to provide that service. Marketing and optional tracking choices do not determine whether you can make an enquiry or join the ordinary membership service. Where health-data consent is necessary, section 4 explains the consequences of withholding or withdrawing it.

We use information only where an applicable legal basis permits it. “Contract” below means processing necessary for a contract with you or steps you request before entering it. A contract with a practice does not by itself provide a contractual basis for processing that practice’s patients’ information.

“Legitimate interests” means a defined interest balanced against your rights and reasonable expectations. Our relevant interests are administering requested services, maintaining reliable records, verifying benefits and fees, managing business relationships, preventing misuse and resolving problems. Health information requires the additional condition explained in section 4.

Membership and business participation

Gold Card Network Ltd uses identity, contact, account, eligibility and acceptance information to issue cards, operate GCX access, administer corporate benefits and maintain membership. CTD Global Ltd uses practice account and contact information to maintain listings and practice participation. The basis is contract for an individual member or sole trader contracting with us, and legitimate interests for corporate representatives and routine relationship administration. Suppliers receive information necessary to operate these functions.

Enquiries bookings and introductions

CTD Global Ltd receives CTD enquiries and contacts the relevant dentist or practice. Gold Card Network Ltd manages enquiries, membership routes and bookings within its services. We use contact details, treatment interests, preferences, location, communications and booking information to respond, identify suitable practices, arrange appointments and record progress. The ordinary-data basis is requested pre-contract steps or contract where applicable, and legitimate interests for administrative coordination and follow-up. Relevant information is shared with the receiving practice and, where the journey uses both operators, the other operator for its identified service.

We may offer another suitable practice if the first cannot assist or the enquiry does not progress. We tell you which practice will receive the relevant information and respect your choice and any limits on your consent. An introduction does not transfer ownership of you or your information.

Sweep and continued follow-up

Gold Card Network Ltd uses source, membership, enquiry, appointment, treatment-progress and relevant payment information to review unconverted enquiries, contact people about their options, discuss authorised offers and arrange further bookings. Necessary follow-up on an open request uses contract or legitimate interests as described above; promotional re-engagement follows section 7. Health information follows section 4.

Follow-up of a lead independently generated by Gold Card is separate from access to a practice’s historic patient records. A practice declining historic Sweep does not itself end an existing Gold Card relationship, but it does restrict use of that practice’s historic records for Sweep. Becoming a member through another route does not retrospectively authorise unrelated historic-data use. Historic follow-up performed solely for a practice remains subject to its instructions, lawful authority and patient preferences. We obtain any additional permissions needed before using those records for our own introductions or marketing.

Fees payments refunds and referral rewards

The company providing or collecting for the relevant service uses transaction, appointment, attribution and limited treatment-status information to reconcile receipts, calculate fees, administer refunds and determine rewards. The ordinary-data basis is contract with the payer or reward participant where necessary, legitimate interests in accurate administration and dispute prevention, and legal obligations for tax and accounting records. Practices, payment providers and properly authorised collection providers receive the information needed for their part of the transaction. Stripe is the payment provider identified for the present arrangements; another provider will be identified at the relevant payment point if used.

Attribution records distinguish a referral or enquiry from actual treatment payment. A consultation deposit alone does not establish the final treatment-payment attribution. Reward records may show a pending stage; release depends on the applicable scheme rules, including receipt of the full practice fee. CTD itself is not part of the referrer reward scheme. These records do not create additional fee or reward rights beyond the applicable terms.

Corporate benefits offers and reviews

Gold Card Network Ltd uses merchant, owner or staff eligibility and account information to administer the dedicated GCX corporate enquiry route and associated Gold Card membership. It uses offer references and necessary redemption information to operate benefits. The basis is contract where you participate personally and legitimate interests for verification and business administration. Merchant reporting normally uses usage counts rather than identifiable member histories.

The operator of the relevant review service uses the content you choose to submit, the displayed name and necessary verification records to publish and moderate reviews, on legitimate interests in providing trustworthy information. A review must reflect your actual experience. We seek separate explicit permission before publishing health information and allow you to avoid including it.

Support security legal duties and improvement

Each operator uses relevant communications, transaction records and technical logs to answer queries, investigate complaints, prevent fraud, secure access, correct errors and establish or defend legal claims. The bases are legitimate interests and, where applicable, legal obligations. Necessary information may go to advisers, insurers, regulators or authorities.

We use aggregated or anonymised information for performance analysis and service development where practical. Identifiable operational analysis requires a defined legitimate interest and the health-data conditions where relevant. Optional device-based analytics and advertising use consent unless a specific lawful exception applies as explained in the Cookie Policy. We do not treat commercial improvement as automatic permission to reuse clinical records.

For our own enquiry handling, introductions and membership administration involving health information, we obtain explicit consent identifying the operator, information, purpose and relevant sharing. This includes any necessary treatment or attendance status used to administer a requested benefit or fee arrangement. Consent to clinical treatment is separate.

Where we process health information solely for a practice as its processor, we follow its documented instructions and the lawful basis and health-data condition applying to that activity. A practice’s ability to process information for care does not automatically extend to our own marketing or referral purposes. Professional confidentiality obligations must also be respected.

We may use necessary health information to establish, exercise or defend legal claims under the applicable legal-claims condition. Any other exceptional health-data use requires its own applicable legal condition; general legitimate interests alone are insufficient.

You can withdraw explicit consent by contacting us. Withdrawal applies to future consent-based processing and does not invalidate earlier lawful processing. If the withdrawn permission is essential to a particular enquiry or benefit, we explain which part cannot continue. You may still contact a practice directly. We retain only records for which a separate lawful basis and, where necessary, health-data condition continue to apply.

An authorised connection to Dentally or another agreed practice system can support patient matching, practitioner and diary mapping, new patient registration, bookings, cancellations, attendance tracking and payment reconciliation. Practice authorisation of a connection is separate from the lawful authority to process each person’s information.

The Gold Card patient register can include patients beyond Gold Card referrals. It holds selected identifiers, site, names, contact details, active or inactive status and timestamps; matching can use date of birth. A separate diary cache can include patient names and appointment reasons or treatment descriptions. These may reveal health information. They are used for justified matching, availability and booking administration under the relevant practice arrangement, not automatically to enrol those patients or market to them.

Routine appointment synchronisation uses selected identifiers, times and statuses. Financial reconciliation uses selected patient, payment and site identifiers, amounts, dates, payment methods and refund status; payment comments are excluded. A separate cache may hold more information than a synchronisation record. We do not describe either system as universally free of clinical content.

Authorised functions may create a patient record, book a consultation or cancel a linked appointment. Additional proposed functions are patient-detail updates, archiving duplicate or incorrect patients, deleting duplicate or incorrect bookings and synchronising treatment plans or items. They apply only when enabled following confirmation of the necessary fields, permissions and safeguards. Archiving a patient is not permanent erasure, and cancelling an appointment is different from deleting it.

Access is limited to authorised users and relevant practice or organisation records. Credentials and changes require appropriate security and audit controls. Broad technical permissions do not permit unrestricted searching, extraction or reuse. Revocation of a connection stops further authorised access; existing records remain subject to their proper retention and deletion rules.

We share information proportionately for the purposes described above:

• Between CTD Global Ltd and Gold Card Network Ltd: relevant contact, enquiry, membership, source, booking and transaction information when a requested journey uses both services, with the applicable health-data permission.
• With practices and clinicians: the information needed to assess and respond to an enquiry, arrange care, report relevant progress, reconcile payments or resolve a problem. Receiving practices provide their own privacy information.
• With referrers: a referral reference, necessary reward status and amount. A status or amount can indirectly reveal that treatment proceeded or its approximate value. Where this identifies your care to a referrer, we obtain your explicit permission for that disclosure. Referrers do not receive clinical records through the reward scheme.
• With corporate partners and merchants: eligibility confirmation, redemption information or transaction details needed for the benefit you request. Employment or business affiliation does not entitle an employer or merchant to your dental history, clinical records or treatment outcomes. Additional disclosure requires an identified purpose and appropriate authority.
• With payment and finance providers: identity, transaction and other information necessary for the payment or finance assistance you request. A provider’s separate application notice explains its credit checks and decisions. System access alone does not authorise us to submit or accept a finance agreement on your behalf.
• With service suppliers: hosting, software, PMS integration, communications, support, analytics and approved AI providers, under arrangements appropriate to their role. Processors may act only on documented instructions; suppliers with their own purposes must be identified as such.
• With advisers, insurers, auditors, authorities and courts: relevant information for professional advice, compliance, security investigations and legal claims.
• In a genuine restructuring or business transfer: necessary information to assess or complete the transaction, subject to confidentiality, minimisation and an appropriate legal basis. We explain any resulting change in the controller of your information.

Companies associated with the operators, new partners and future offer providers receive personal information only for an identified lawful purpose. A shared brand, corporate relationship or this policy is not permission for unrelated reuse. Direct marketing by another organisation follows section 7. We may share genuinely anonymised statistics more widely, provided people cannot reasonably be identified.

Operational messages include enquiry replies, booking and attendance information, payment or reward administration, security notices and material service changes. We may send these where necessary for a requested service or legal obligation. Promotional content is treated as marketing, even if included in an otherwise operational message.

For marketing by email, text or similar electronic messages to individual subscribers, we obtain consent unless the sending company meets the legal conditions for its own similar-services soft opt-in. That exception requires direct collection during a sale or negotiations, with an opt-out at collection and in every message. Free membership or an address supplied by another network company does not automatically qualify.

Choices identify the sending company and channels. Optional marketing may cover its network services and relevant partner offers it sends itself. Giving a partner your contact details so that the partner markets directly is a separate choice naming that partner. Generic permission for unspecified associated brands or future partners is insufficient. Relevant business-to-business marketing may rely on legitimate interests where electronic marketing rules permit; sole traders and some partnerships receive the protections applying to individual subscribers. Marketing calls must comply with applicable preference-service and objection rules.

You can unsubscribe in a message or contact us at any time. We stop direct marketing, including related profiling, when you object. We keep the minimum suppression record needed to respect that choice. Cookie choices, marketing choices and health-data consent are separate.

We do not use clinical records or information about specific health conditions to build advertising audiences. Advertising platforms must not receive identifiable information revealing dental care, including through URLs, page titles, event names or other indirect signals.

We may use approved AI tools to organise or summarise communications, assist enquiry routing, prepare draft replies, moderate content and support service administration. The underlying purpose still needs its own lawful basis and any necessary health-data condition. We limit the information supplied and remove direct identifiers where the task permits.

Our policy prohibits AI providers from using submitted patient, member or practice information, or outputs containing it, to train or improve their general-purpose models. We approve providers only where their contracts, service settings and safeguards support that restriction. Providers may retain information for limited service or security purposes under separately assessed arrangements, disclosed where relevant.

Routine matching, attribution and fee calculations can use rules and recorded events. We provide a route to challenge errors and obtain human review. AI does not replace a dentist’s clinical judgement. Any proposed decision made solely by automated processing with a legal or similarly significant effect requires assessment, the applicable safeguards and specific information to you before introduction; additional restrictions apply to health information.

We apply security measures appropriate to the information and risk, including authorised access, confidentiality requirements, secure transmission and controls over system credentials. We investigate suspected breaches and notify affected people or the regulator where required. Please keep account details and secure links private.

Supplier hosting, support and remote access may involve processing outside the UK; this policy does not promise UK-only processing. Where a restricted transfer occurs, it must be supported by applicable UK adequacy arrangements or appropriate safeguards, such as the UK International Data Transfer Agreement or UK Addendum, with the required data protection assessment and supplementary measures. We do not rely on ordinary policy acceptance as transfer consent.

You can ask us for details of destinations and a copy or explanation of the applicable safeguards, with confidential information redacted where necessary. The relevant supplier or service notice also identifies independent providers and their processing arrangements.

We keep information only for as long as the relevant purpose justifies it, using category-specific retention rules. The following criteria determine the period, with more specific durations supplied where applicable to a service or technology:

• Membership, enquiry and booking records: the active relationship and follow-up reasonably required for the request, followed by only the records needed for outstanding transactions, complaints or identifiable legal claims.
• Fees, payments, refunds and rewards: completion and reconciliation, then applicable tax, accounting and claim requirements. Unnecessary clinical detail is removed from financial records.
• Practice registers and diary caches: the authorised matching or diary purpose and necessary synchronisation cycle. Cached information is refreshed or removed when no longer needed; practice instructions govern processor copies, subject to legal duties.
• Communications, access logs and security records: the time needed to resolve the issue, audit relevant actions or investigate incidents, assessed against the sensitivity and continuing need.
• Consent and suppression records: sufficient evidence of the permission relied on and the minimum record needed to honour withdrawal or objection.
• Analytics, session recordings and AI inputs or outputs: the verified purpose and configured supplier period. Recordings and identifiable usage records are not retained simply because storage remains available.

A genuine dispute, investigation or legal duty can require a restricted hold on relevant records. Closing an account does not erase an outstanding transaction or a practice’s separate clinical record. When retention is no longer justified, we delete or irreversibly anonymise the information. Backups are protected from ordinary use and expire through the applicable backup cycle; archiving alone is not deletion. Pseudonyms, tokens and hashed contact details remain personal information where identification remains possible.

Depending on the circumstances, you can request access, correction, erasure, restriction or a portable copy of your information. You can object to processing based on legitimate interests and withdraw consent where it is used. The right to object to direct marketing is absolute. Other rights may be subject to lawful limits, which we explain when relevant.

Contact us using section 1. We may request proportionate information to verify identity or clarify a request. We normally respond without undue delay and within one month, subject to lawful extensions or pauses; we explain any applicable extension or reason we cannot comply. There is normally no charge. If we act only for a practice, we assist that practice with the request and explain who is responsible.

You can raise a data protection complaint through the same contact routes without using special wording. We acknowledge it within 30 days, investigate and keep you informed, and communicate the outcome without undue delay. You may also complain to the Information Commissioner’s Office at https://ico.org.uk/make-a-complaint/. Our complaints process does not remove that right.

Where a permitted service involves a child or an authorised representative, we consider the person’s capacity, the representative’s authority and the additional protection required. A parent’s or employer’s involvement does not automatically entitle them to unrestricted information.

We may update this common policy as services, suppliers or legal requirements change. We identify the effective date and draw material changes to your attention. Before introducing a materially different use, we assess its lawfulness, provide the necessary information and obtain fresh permission where required. Continued use of a site does not itself supply a new consent.