Privacy Notice
This notice explains how Arch OS uses personal data when you visit arch-os.ai, contact us, use the Case Portal, or create a Target Smile visualisation through your clinic.
1. Who we are
Arch•OS is a trading name of 21D Clinical Limited ("Arch OS", "we"), registered in England and Wales under company number 09476584, registered office Unit 602 Birchwood One Business Park, Dewhurst Road, Birchwood, Warrington, England, WA3 7GB. Arch•OS is our AI-assisted full-arch implant restoration design and lab service. Our ICO registration and privacy contact details are at 21d.co.uk.
2. Our role
| Who you are | Our role | Who decides how your data is used |
|---|---|---|
| Patient whose records your dentist sends us | Processor for your dental practice; controller for Device and safety records the law requires us to keep | Your dental practice |
| Member of the public using Target Smile through a clinic link | Processor for the clinic; controller for security and our own records | The clinic that invited you |
| Dentist or practice staff using the Case Portal | Controller | Arch OS |
| Website visitor or person making an enquiry | Controller | Arch OS |
If you are a patient, contact your dental practice first about your data. We will help them answer you.
3. What we collect
- Practice and user data: names, roles, professional registration, contact details, account and approval records.
- Patient and case data: name, date of birth, case reference, contact details where needed, medical and dental history, photographs, facial scans, CBCT and radiographs, intraoral scans, prescriptions, designs, approvals and case messages. This is health data.
- Target Smile data: your photo, name, email or phone, your consent choices, and the AI visualisation we create.
- Enquiry data: name, practice, contact details, country, notes, and whether you want updates.
- Technical data: IP address, device and browser, login and audit logs, security signals (including Google reCAPTCHA).
4. How we use it and our legal bases
| Purpose | Legal basis (UK/EU GDPR) |
|---|---|
| Design and manufacture custom-made devices for your dentist | Processor for the practice; the practice relies on its own basis. Health data: provision of health care (Art. 9(2)(h)) |
| Keep device, traceability and safety records; report incidents to regulators | Legal obligation; Art. 9(2)(i) public health |
| Create a Target Smile visualisation | Processor for the clinic, based on your explicit consent (Art. 9(2)(a)) |
| Run the Case Portal, accounts and approvals | Contract; legitimate interests |
| Answer enquiries and partner applications | Legitimate interests; steps before a contract |
| Send updates about Arch•OS | Consent (you can opt out at any time) |
| Protect our services, prevent fraud, handle legal claims | Legitimate interests; legal obligation; Art. 9(2)(f) |
5. AI and automated processing
Our in-house designers use AI-assisted tools to prepare designs and to create Target Smile visualisations. A person reviews every design and your dentist approves it. We do not make decisions about you by automated means alone. Target Smile images are AI-generated simulations, not a diagnosis or a promise of results. We do not use identifiable patient data to train AI models without a lawful basis and appropriate safeguards; where we can, we use anonymised data.
6. Who we share it with
- Your dental practice or clinic, and its authorised staff.
- Our service providers, under contracts that protect your data:
| Provider | What they do | Location |
|---|---|---|
| Microsoft (Azure) | Hosting, database, security | [UK / EU / US] |
| Egnyte | Secure file storage | [location] |
| Amazon Web Services | Hosting and storage | [location] |
| OpenAI | AI processing of images | US |
| reCAPTCHA spam protection; YouTube video playback | US | |
| Mailgun | Transactional email | US |
| Slack | Internal staff notifications (no clinical records) | US |
| Manufacturing suppliers | Making devices from our design files | [locations] |
- Regulators, professional bodies and authorities where the law requires, and our professional advisers and insurers.
We do not sell personal data.
7. International transfers
Some providers process data outside the UK or EEA, including in the US. We use adequacy decisions, the UK International Data Transfer Addendum or EU Standard Contractual Clauses, and transfer risk assessments.
8. How long we keep it
| Data | How long |
|---|---|
| Case records and design files | [X] years after the case closes, or as the practice instructs |
| Custom-made device records | At least [X] years, as medical device law requires |
| Target Smile photos and images | [90 days] unless the clinic keeps them in your record |
| Enquiries | [24 months] after last contact |
| Security and audit logs | [12 months] |
9. Cookies and similar technology
We use only what the site needs to work and stay secure. Google reCAPTCHA loads when you start using a form. YouTube videos load only when you press play, and YouTube may then set cookies. We do not use advertising cookies.
10. Your rights
UK and EU: you can ask to access, correct or delete your data, restrict or object to its use, receive it in a portable format, and withdraw consent at any time. You can complain to the ICO (ico.org.uk) or your local EU regulator.
US: if your dentist is a HIPAA covered entity, we act as its business associate and your HIPAA rights are exercised through your dentist. Residents of states such as California and Washington may have additional rights, including over consumer health data. We do not sell or share health data for advertising.
UAE and Saudi Arabia: you have rights under the UAE and Saudi Personal Data Protection Laws, including access, correction and deletion.
To use your rights, use the privacy contact details at www.21d.co.uk. We will reply within one month (or the period local law sets).
11. Children
Target Smile is for people aged 18 or over. Patient data about minors is processed only on the instructions of their dental practice.
12. Security
We use access controls, encryption in transit and at rest, logging, view-only display of clinical files, staff confidentiality and supplier checks.
13. Changes
We will post updates here and tell users of the Case Portal about material changes. Last updated: [DATE].