GDPR Compliance

SuiteGrowth processes patient information on behalf of dental practices. This page explains the division of responsibility, the kinds of messages we support, and how patients can exercise their rights. The practice is the controller of its patient data; SuiteGrowth is its processor for the messaging service.

Do you need UK servers to be GDPR compliant?

No. This is a common misconception. UK GDPR does not require data to be stored on UK or EU servers. What the law requires is that any international transfer of personal data is made under appropriate safeguards, typically Standard Contractual Clauses (SCCs) or an adequacy decision.

Our providers may process or support data in more than one location. The Data Processing Agreement lists the providers and explains how restricted transfers are handled.

What type of data does SuiteGrowth process?

The data SuiteGrowth processes falls into two categories:

• Contact and appointment data, identifiers, contact details, contact preferences, appointment details, message and delivery records, and feedback classifications needed for enabled features.
• Health information, appointment details, medical alerts or allergies supplied by a practice, and information a patient volunteers in a reply may reveal health status. Such data can be special category data even if it is not a full clinical record. The practice must identify an Article 9 condition where required.

How is AI processing governed?

AI services may process patient replies and relevant context to classify feedback and draft responses under the practice's instructions. Automated replies are not clinical advice; clinical concerns must be routed to the practice.

The safeguards and contractual controls include:

• Limited purpose, patient information is used to deliver the practice's enabled messaging and support functions, not sold for advertising.
• Provider terms, AI and other service providers process data under contractual terms and relevant transfer safeguards.
• Practice oversight, the practice can set messaging scope, receive escalations and instruct us about patient rights requests.

Sub-processors and international transfers

The providers supporting the service are listed in our Data Processing Agreement. Actual locations and transfer mechanisms can depend on the feature and provider. We provide details relevant to a practice on request.

Provider locations in a public list do not establish where every account or support interaction is processed. We confirm the current provider and transfer arrangements for a practice on request. We do not claim a specific AI retention setting or transfer mechanism without confirming the applicable account and contract.

Lawful basis for processing

The practice, as controller, decides and documents the lawful basis for each purpose. A UK GDPR lawful basis and the rules for electronic marketing under PECR are separate questions.

• Post-appointment service follow-up, a genuine, non-promotional check-in may be a service message. It does not automatically require marketing consent, but the practice must identify an Article 6 basis, provide privacy information and respect objections and contact preferences.
• Review invitations and other campaigns, classification depends on purpose and content. Adding promotional material to a service message can make it direct marketing. The practice must assess UK GDPR and PECR requirements before enabling these messages.
• Health information, where the processing reveals health status, the practice must also identify an applicable Article 9 condition. No single condition applies automatically to every practice or message.

How a patient message is handled

1. Practice instruction: the practice selects the functions it wants and tells us which patients, appointments and contact restrictions apply.
2. Eligibility: relevant appointment and contact records are checked against the configured message type, exclusions, opt-outs and do-not-contact information before a send.
3. Delivery and reply: WhatsApp providers deliver the message. Replies and delivery events are recorded so the conversation can continue and the practice can see what happened.
4. Feedback and escalation: responses may be classified with AI. A concern can be routed to the practice for human handling; the AI is not a clinician.
5. Later invitation: any review request is a separate step, subject to the practice's instructions, applicable messaging law and the review platform's rules.

A practice can request a narrower audience, such as excluding emergency appointments. Such a request must be implemented and checked before we describe it as active.

Service messages, marketing and consent

A genuine check-in about a recent appointment is generally a service communication rather than direct marketing, provided its purpose and content stay within patient care and service follow-up. It still needs a UK GDPR lawful basis, clear privacy information and respect for contact preferences. A platform label such as "utility" does not decide its legal status.

A review invitation, recall campaign or promotional addition needs its own assessment. Purpose, wording, recipient and channel matter. The practice must assess PECR as well as UK GDPR before enabling a message; a marketing opt-in field alone cannot settle every case. If a practice instructs us to use a stricter opt-in rule, we can configure and verify that rule where supported.

Transparency for patients

The practice should explain in its privacy notice that it uses a third-party processor for automated patient communications, what information is shared, the purposes, recipients and how to object or exercise rights. Messages should make the practice on whose behalf we act clear and provide a route for a patient to reach that practice. Whether a separate third-party introduction is needed in the message depends on the surrounding information and the practice's chosen wording; we can include one when instructed.

Retention, deletion and accountability

Patient conversations and related records are retained to deliver the service and support the practice's audit and rights obligations. The applicable period depends on the record type, practice instructions, provider systems and legal requirements. At the end of the service, the practice can choose return or deletion under the DPA. We will confirm the steps actually completed; a backup deletion cycle may differ from active-system deletion.

Practices can request the current retention details, sub-processor information and security measures relevant to their account. They can also request help with a data protection impact assessment or a patient rights request through hello@suitegrowth.co.uk.

Who sends the message, and who can be excluded?

SuiteGrowth sends automated messages on the dental practice's behalf. Patients should be told that a third-party service is involved and given a clear route to the practice for treatment or appointment questions. The practice decides which services, appointment types and patient groups are in scope. These preferences need to be configured and verified; a request to change them is not proof that the change is already active.

Opt-outs and do-not-contact records must be honoured. Consent fields are handled differently across message types: a genuine post-appointment check-in is not automatically gated by the practice system's marketing field, while other campaigns may require additional checks. The practice can instruct us to apply a stricter contact threshold where the product supports it and that rule has been verified.

Patient rights

Patients have UK GDPR rights including access, rectification, erasure, restriction and objection, subject to the conditions and exceptions that apply to each right. The dental practice, as controller, is responsible for handling requests. SuiteGrowth assists the practice under its documented instructions and the DPA.

Patients can ask to stop automated contact, including by replying STOP. We record opt-outs and use suppression controls for future messages. A patient may also contact their practice directly about preferences or data rights.

Security measures

• All data encrypted in transit (TLS) and at rest
• Row-level security in the database, each practice can only access its own patient data
• No shared access tokens or API keys across practices
• Access to production systems limited to authorised personnel only
• Error monitoring and alerting via Sentry
• Notification to the practice without undue delay after we become aware of a personal data breach affecting its data

Practice obligations

The dental practice is the data controller for patient data. Before using SuiteGrowth, practices are responsible for:

• Ensuring they have a lawful basis to share patient contact details with SuiteGrowth
• Informing patients that they may receive automated WhatsApp follow-up messages after appointments
• Listing SuiteGrowth as a data processor in their own privacy documentation and data processing register
• Handling any patient data subject access requests or erasure requests within the statutory timeframe

Our Data Processing Agreement sets out these obligations in full and forms part of the agreement between SuiteGrowth and every practice using the platform.

ICO registration

SuiteGrowth is a trading name of SUITE GROWTH LTD, a company registered in England and Wales under company number 17200973 (registered office: Flat C3304, 9 Owen Street, Manchester, M15 4TW). Contact us for the current ICO registration details.

Questions and data requests

For any GDPR-related questions, data subject requests, or to request a copy of our sub-processor list or security documentation, contact us at hello@suitegrowth.co.uk.