Privacy Policy

Who we are

Lux Dental Clinic (“we”, “us”) operates the Lux Dental Clinic Portal (the “Portal”) for clinic staff and patients. Contact details for privacy requests are available on our public site and through clinic administration.

Information we process

Depending on your role and how you use the Portal, we may process:

• Account data — name, email address, role, authentication credentials (stored as irreversible password hashes), and session metadata
• Contact and demographic details — as recorded in patient or staff profiles
• Health and clinical records — appointments, case history, prescriptions, lab results, and related care documentation
• Billing and payment records — invoices, payments, and related financial entries
• Technical data — IP address, browser user agent, and security audit events related to sign-in and account activity

Health-related information is sensitive. Access is limited by role-based permissions and clinic policy.

Purposes of processing

We process personal data to:

• Authenticate users and keep the Portal secure
• Coordinate appointments and clinical care
• Support billing, pharmacy, lab, and administrative workflows
• Send account emails (for example password reset links)
• Meet legal, regulatory, and professional obligations

Cookies and similar technologies

Essential cookies

Signing in sets a necessary session cookie (portal_session) so we can recognize your authenticated session. This cookie is required for the Portal to function and is not used for advertising.

Consent preference cookie

If you use our cookie banner, we store your choices in a first-party cookie (portal_cookie_consent) so we can respect them on later visits.

Optional cookies

We may offer optional preference or analytics cookies in the future. Those are off by default and only used if you enable them in Cookie settings. Today the Portal does not load third-party advertising or analytics trackers.

You can change non-essential choices at any time via Cookie settings links on the Portal and public site.

Lawful bases and notice

Where data-protection laws such as the GDPR or UK GDPR apply, we rely on bases that fit each purpose (for example contract/performance of care services, legitimate interests in securing the Portal, consent for optional cookies, and legal obligation where required). Where U.S. state privacy laws apply, this notice serves as notice at collection of the categories and purposes above. We do not sell personal information.

Retention

We retain account, clinical, and billing records for as long as needed for care, operations, and applicable retention laws, then delete or archive them according to clinic policy. Session cookies expire according to the session length you choose at sign-in (standard session or “Remember me”).

Your rights

Depending on your location, you may have rights to access, correct, delete, restrict, or object to certain processing, and to lodge a complaint with a supervisory authority. Patients and staff should contact the clinic to exercise rights related to Portal records.

International users

The Portal may be hosted or supported using cloud infrastructure that processes data in regions outside your country. We take appropriate contractual and technical measures consistent with clinic policy and applicable law.

Security

We use industry-standard safeguards such as encrypted transport (HTTPS in production), hashed passwords, revocable server-side sessions, and role-based access controls. No method of transmission or storage is perfectly secure.

Changes

We may update this policy from time to time. The “last updated” date at the top of this document will change when we do. Material changes affecting how we use personal data will be communicated through the Portal or clinic channels where appropriate.

Contact

For privacy questions, contact the clinic using the details on the public site or ask clinic administration for the current privacy contact.