Artificial Intelligence (AI) Privacy Notice

How mydentist uses AI and your data

This Privacy Notice describes how your personal data may be used in conjunction with Artificial Intelligence (AI), which includes software and applications that incorporate AI technology.

It will explain how your data is protected wherever AI is used by mydentist and it should be read together with our other published Privacy Notices.

If you believe we have got something wrong, please let us know and we will do whatever we can to try to fix it.

What is AI and how do we use AI tools

AI is a broad term for computer systems that can perform tasks that typically require human intelligence, such as learning, problem solving and decision making as well as being able to generate content like text and images.  At mydentist we use AI to improve the services we offer and to provide administrative support to our staff, patients and associate clinicians.

The AI tools we use can be categorised as follows:

• Generative AI: This type of AI creates new content such as images or text based on the data used to train the AI system.  We may use this type of AI tool to assist and support staff with administrative tasks such as drafting social media posts, or generating stock images to use in presentations etc. We have policies in place that prevent staff or patient personal or sensitive data being used in any publicly available AI tool.
• Predictive AI: This type of AI analyses data and may support with predicting future outcomes.  Some of our trusted partners and suppliers (for example, our Smile Zones and Clear Aligner treatment planning services which help predict the potential for tooth movement or demonstrate the potential of whitening products), may incorporate this type of tool within their own products and services.
• Automated Administrative Tools: We may use AI to automate some routine tasks such as scheduling, note taking including providing transcripts of meetings.  These types of tools support staff to free up time and allowing them to focus on other tasks and responsibilities.

The use of AI is one of the fastest growing trends in recent years, but it has been present in our lives in one form or another for several years.  Its growing applications in healthcare settings, requires careful governance to ensure its use is safe and does not expose personal data about our patients, staff and contractors to unnecessary risk.

Personal data may be entered directly or contained within the documents uploaded into an AI tool.  In all cases, mydentist will be the Data Controller of your personal data when it is used, and any supplier of an AI tool will be the Data Processor.

We ensure your data is protected by having clear policies in place, signed contracts, and where necessary, data processing agreements with each supplier.

Users of any AI tools employed by mydentist know that all personal data must be processed in accordance with current UK Data Protection legislation and the mydentist data protection policies.

Our legal basis for processing your data using AI

Under the UK GDPR we must have a documented legal basis to process personal data.  When we use AI at mydentist our legal basis falls into one of the following categories:

• Contract: Under Article 6(1)(b) of the UK GDPR we may process your data to provide you with your ongoing dental care and treatment, so that we fulfil our NHS Contracts or our contract with you as a private patient where this applies In some cases, AI will be used to support our clinicians to make informed decisions about your treatment, such as analysing x-rays, or by predicting outcomes in potential treatment planning services such as clear aligners.
• Legitimate Interests: Under Article 6(1)(f) of the UK GDPR we may process data using AI for the legitimate interests of mydentist, such as improving efficiency or developing and improving our business.  These legitimate interests will always be balanced against the rights and freedoms of individuals whose personal data may be involved in the processing.

Where we are processing your sensitive personal data (such as your health data or the data of staff we employ), we are required to have an additional legal basis to collect and use it, for this reason we rely on the following legal basis:

• Employment obligations: Under Article 9(2)(b) of the UK GDPR we may process your sensitive personal data using an AI tool so that we meet our obligations as an employer. For example, we may utilise the built in AI functionality of widely used and respected recruitment software as part of our recruitment process so that we can make automated decisions regarding your potential suitability for a role.
• Health and Social Care provision: Under Article 9(2)(h) of the UK GDPR we may process your sensitive personal information during the provision of services and to support our clinicians in making informed decisions about your care and treatment.  For example, we may use an AI tool to review an x-ray of your teeth to support your clinician in demonstrating where further treatment may be required or we may use the software of a trusted clinical device provider to demonstrate the potential benefits of their product.

Your data and AI

When we use AI at mydentist, we ensure we are mindful of the principles of the UK GDPR, specifically:

• Data minimisation: This means that we will only use the minimum amount of personal data necessary for the AI tool to perform its function.
• Lawfulness, fairness and transparency: This means that we will always be transparent about how and why we are using AI as well as our legal basis for processing your data in this way.  Where any decisions are made with the help of an AI tool, we will explain the logic involved and its significance.
• Integrity and confidentiality: This means that we will apply robust security measures to the protection of your personal data from any unauthorised access or use, including preventing any loss or damage.

Governance of AI

We have introduced an AI Acceptable Use Policy that states when, where and how AI should be used within mydentist.  All staff, contractors and associates are held accountable to this policy.

The UK GDPR and the Data Use and Access Act 2025 requires us to conduct a Data Protection Impact Assessment (DPIA) for any processing that is likely to result in a high risk to individuals’ rights and freedoms.  Additionally, where mydentist identifies a potential use case for an AI tool we will always endeavor to carry out a DPIA.  This will allow us to assess any potential risks in using that specific AI tool and to identify the required measures to mitigate those risks.  In these instances, we will always seek the advice of mydentist’s’ DPO.

We have also implemented technical and organisational security measures to govern the use of AI across mydentist.  These measures allow us to monitor, identify and restrict the use of AI tools within mydentist to ensure the safety and confidentiality of your data.

Automated Decision-Making using AI

Under the UK GDPR you have the right not to be subject to a decision based solely on automated processing, meaning that there is no human intervention in the decision-making process.

We ensure that there is always meaningful human involvement in any significant decision-making process. AI tools are used to assist staff only and are not intended to replace their professional judgement and decision making.

You have the right to challenge where an AI tool is used to help make a decision that affects you and you have the right to request human intervention, express your views and challenge any decision made.

Your rights and the use of AI tools

The use of AI tools does not change your fundamental rights regarding your personal data, these rights are listed below:

• Right of Access: This right is also referred to as a Subject Access Request (SAR) in which you have the right to receive a copy of any personal data mydentist processes about you. Should you wish to make a SAR please contact the Data protection officer here
• Right to Rectification: Where the data about you held by mydentist is inaccurate, you have the right to apply for it to be corrected and/or amended. Where we feel that the information originally captured is relevant and necessary we may choose to retain that information and add a supplementary note recording your views and wishes.
• Right to erasure: in certain circumstances you can request that your personal data is permanently deleted. This is not an absolute right as there may be overriding legal reasons for your information to be retained.
• Right to Restrict Processing: If you believe that your data is inaccurate and have asked for it to be erased or amended, you can ask for all processing to stop until any investigation into the erasure or amendment has taken place.
• Right to Object: You can object to your personal data being processed for marketing purposes. We may still send you certain communications regarding your appointments or any practical information about the practice that you need to know about, these are service messages and are not considered marketing.
• Right to Data Portability: This right has little bearing in a dental setting, however, you have the right to request a copy of your data be transferred on your behalf to another dental provider.

Further information on your rights under the UK GDPR can be found on the Information Commissioners Office website here: A guide to individual rights | ICO

If you wish to exercise any of your rights, you can contact us as follows:

• Contact your local mydentist practice where you received treatment, worked as a member of the team or provided services as an associate clinician
• Speak directly with a member of the practice team in person
• Email the Data protection officer here

In almost all circumstances, you do not have to pay a fee to access your personal information or to exercise any of the other rights. However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal information (or to exercise any of your other rights). This is a security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

We may also contact you to ask you for further information in relation to your request to speed up our response.

We try to respond to all legitimate requests within one calendar month. Occasionally it may take us longer than this if your request is particularly complex or you have made several requests. In this case, we will notify you and keep you updated.