Privacy policy

Updated October 2026. UK GDPR compliant.

Effective date: 23 October 2026.

What we collect

We try to collect as little as possible.

  • When you visit any page: we record the page URL, time, and a SHA-256 hash of your IP address so we can count unique daily visitors and prevent abuse. The plain IP is never stored.
  • When you submit a report: we store the report content, an IP hash, and a timestamp.
  • When you ask to be notified by email: we store your email address and the surgery or area you asked about. We send one email when that surgery starts accepting patients and a weekly round up of nearby practices that are taking patients, until you unsubscribe using the link in any email.
  • When a dental practice uses the practice panel: we store the name, role, work email and (if given) phone number of the person who claims the listing, the details and corrections they send, and a record of what we approved. Signing in sets one cookie, fd_practice, only on the /practice pages: it keeps you signed in for up to 30 days, is strictly necessary for the panel and is not used for anything else. We use these details only to manage that listing and to reply to the practice. If a practice adds its team, the names, roles and GDC numbers it sends are shown on its listing; GDC numbers are public on the GDC register.
  • When you message us on WhatsApp: our website stores your WhatsApp number (or the ID WhatsApp gives us instead), when you last wrote, and the surgeries you asked to be alerted about. For two days it also keeps the area, who it was for (adult or child) and the practices of your last search, so Sorty can answer follow up questions such as "do they take adults?"; replying STOP clears them. The day after Sorty shows you practices, it may send you one message asking whether you got an appointment, and never again after that or after STOP. If you tell Sorty that a practice is not taking NHS patients, or answer that check about a single practice, it is saved as an anonymous patient report for that practice, the same as the report form. It does not store the text of your messages; your question is answered automatically. The conversation itself stays in our WhatsApp Business account, like any WhatsApp chat, and we delete it on request. Reply STOP at any time to end alerts. Messages travel through WhatsApp, which Meta runs under its own terms and privacy policy.

The finddentist app

  • No account, no tracking: the iPhone app has no sign in and no advertising or analytics trackers. The Google services named below apply to this website only.
  • Location: the app uses your location to centre the map. To list the practices near that map point, and to plan a route when you ask for one, it sends the point to this website. For routes our server asks OSRM (run by FOSSGIS) or Transitous, which see the start and end points but not who you are. No name, account or device ID goes with these requests.
  • On your phone: saved practices, waiting lists you track, recent searches and the last map view stay on your phone. To recheck saved practices the app sends only their public practice numbers. Practice opening alerts and personal reminders are notifications made on your phone. In app versions with My dental, your notes, chosen photos and documents, appointments, wearing history and visit preparations stay in the app. Dental records are excluded from device backups, so keep your own copies of important files. Deleting the app removes these dental records. Selected records leave the app only when you explicitly share them.
  • Family profiles and private call notes: supported app versions keep separate records for each family member and private practice call notes on the device. These are not uploaded or used to change public listings.
  • Encrypted dental backups: you can choose a password and export an encrypted file of family dental records, appointments, wearing history and attachments. The password is not sent to us and cannot be recovered by us. You choose where to store or share the file. Restore adds separate profiles while keeping current records. Saved practice favourites and area alert settings are not included.
  • Optional area alerts: in app versions with Menu, Area alerts, enabling this separate feature sends your selected postcode centre coordinates, radius, adult or child preference, an encrypted Apple notification token and a random installation code with your consent. The postcode text, names, dental records and private call notes are not sent. We check for newly listed NHS availability in that area. This does not reserve an appointment or guarantee a place. Turning this feature off deletes the area subscription when connected; offline removal retries when the app can connect. Registrations not refreshed for 180 days are deleted. Area alerts do not opt you into app news.
  • Optional app news: in app versions with Menu, Notifications, app news is off until you choose it. Opting in sends an Apple notification token, a random installation code, the app build and your consent to our server. We store notification tokens encrypted and use Apple Push Notification service to send general app news. We do not use these identifiers for tracking across apps or connect them to your dental records. You can turn app news off in the app at any time; app news stops on the phone and server removal retries when online if necessary. Area alerts keep their separate setting. The worker removes tokens from inactive registrations after 180 days and deletes old registration and send records after a year. A message marked accepted by Apple is not proof that it was read.
  • Reports and Sorty: reports sent from the app are handled like reports on the website (above). Questions you type to Sorty, on the website, in the app or on WhatsApp, are read by a language model we run on our own computer so Sorty understands them, then answered from our own data. They are not stored and never sent to an AI company. We only count how many questions Sorty answers each day and what kind of answer it gave.

What we share

We do not sell or share personal data. Notification emails and WhatsApp messages come from us directly; we do not pass your email address or number to third parties.

Anonymous usage data may be shared with Google (via Google Analytics) and Google AdSense for ad delivery and analytics. You can opt out using a browser extension or via Google Ad Settings.

Cookies

We use a small number of cookies:

  • Strictly necessary: none beyond what your browser sets itself.
  • Analytics: Google Analytics may set _ga and _gid cookies. Lifetime: up to 2 years.
  • Advertising: Google AdSense may set NID and IDE cookies for personalised ads.

Your rights (UK GDPR)

You can ask us to:

  • Show you what data we hold about you
  • Correct anything that's wrong
  • Delete your data
  • Stop processing it

Email hello@finddentist.co.uk with your request. We respond within 30 days.

NHS data attribution

Practice information is sourced from the NHS Directory of Healthcare Services. finddentist.co.uk is not affiliated with the NHS or NHS England.

Complaints

If you're not happy with how we handle your data, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk.