Nosht Privacy Policy | GDPR & Your Data Explained

Introduction

This Privacy Policy explains how Nosht ("we", "us", "our") collects, uses, stores, and protects personal data in connection with the Nosht service (including the Nosht Solo, Nosht Pro, and Nosht Practice plans) available at nosht.io. We are committed to handling your data lawfully, fairly, and transparently in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Please read this policy carefully. By creating an account with Nosht, you confirm that you have read and understood how we use your personal data.

1. Who we are (data controller)

Nosht Limited is the data controller responsible for your personal data.

Legal entity: Nosht Limited
Company number: 17061341 (registered in England & Wales)
Registered office: Danvers Road, Oxford, OX4
ICO registration: ZC186303
Service: Nosht — dental clinical note documentation software (Solo, Pro, and Practice plans)
Website: nosht.io
General contact: hello@nosht.io
Data protection contact: hello@nosht.io

We are not required to appoint a Data Protection Officer under UK GDPR Article 37. Our data protection contact point is hello@nosht.io. If you have any questions about this policy or wish to exercise your data rights, please contact us at the same address.

If you received a patient leaflet

For patients sent a Nosht leaflet by email or text by their dental professional.

Who is responsible. The dental professional or practice that sent the leaflet is the controller of your contact details; Nosht processes them for them, as a processor.
What is used, and why. Your email address or mobile number and which leaflet was sent, only to deliver it and to limit repeat messages, never for marketing. Sending a leaflet does not pass your name or dental records to Nosht.
Delivery. Resend (email) or Twilio (text) deliver the message, may process data in the United States, and keep delivery logs for a limited period.
What Nosht keeps. Not your address or number itself: a one-way keyed code (hash) of it for 30 days, then deleted. Nosht cannot turn it back into your details. The delivery record (which leaflet, when, how) is kept for the sender until they ask us to delete it or close their account.
Your rights. Ask the sender to access, correct or erase your details, or to stop sending leaflets; Nosht (hello@nosht.io) will help them respond. You can complain to the ICO (Section 14).

2. What personal data we collect and why

We collect only the personal data necessary to provide and improve the Nosht service. The table below sets out the categories of data we collect, why we collect them, and the legal basis under UK GDPR that permits us to do so.

Category	Data collected	Purpose	Lawful basis (UK GDPR)
Account data	Full name, email address, password (hashed — never stored in plain text). If you register or sign in using Google, we receive your name, email address, and Google account identifier. If you use Sign in with Apple, we receive your name and email address (or an Apple private-relay address if you choose to hide your email) and an Apple account token. We do not receive or store your Google or Apple password.	Creating and managing your user account; authenticating you when you log in	Article 6(1)(b) — performance of a contract
Subscription data	Stripe customer ID, subscription plan (monthly/annual), subscription status, billing cycle dates, trial status	Managing your paid subscription and plan entitlements	Article 6(1)(b) — performance of a contract
Usage data	Note drafts (template selections, dropdown choices, plus any patient details you enter into the optional Referral Letter template; unsaved drafts are also backed up in your browser for up to 30 days), saved completed note references, user preferences such as display name, nurse/assistant names, theme settings, and, if you use the CPD Logger, your CPD activity log	Providing the core service (auto-saving drafts, personalising your workspace, tracking note completion history)	Article 6(1)(b) — performance of a contract
Technical data	IP address, browser type and version, operating system, pages visited, session timestamps (collected via standard web server and CDN logs); and, if a note fails to save or complete or the app hits an error while you are signed in, a reliability record in our own database linked to your account (the operation, the error type, an incident reference and the page address with record IDs removed, never note content). This reliability record stores nothing on your device and is kept whether or not you accept analytics in our cookie banner	Security monitoring, fraud prevention, diagnosing technical issues, maintaining service availability	Article 6(1)(f) — legitimate interests (maintaining a secure, reliable service)
Product usage data	When you are signed in: which Nosht features you use (for example, the template opened, a note completed, an AI fill applied), with counts and timings, linked to your account. It never includes note text, is kept in our own database and is not shared with third parties	Understanding how the service is used so we can fix problems and improve it	Article 6(1)(f) — legitimate interests (improving the service). You can object at any time in Settings → Account → Product usage analytics
Payment data	Payment card details are collected and processed directly by Stripe, Inc. We receive only a Stripe payment token, subscription identifiers and the card brand and last four digits — we never see or store full card numbers, CVV codes, or bank account details	Processing subscription payments; issuing refunds where applicable	Article 6(1)(b) — performance of a contract
Communications data	Content of emails or messages you send to us when requesting support or raising queries	Responding to your enquiries and providing customer support	Article 6(1)(b) — performance of a contract; or Article 6(1)(f) — legitimate interests (where pre-contractual)
Service & onboarding emails	Your account email address, used to send onboarding and activation messages that help you set up and get value from Nosht (for example, prompts to write your first structured note, or a trial-status reminder)	Helping you complete setup and use the service you signed up for. These are service communications, not marketing — they are distinct from our opt-in marketing emails, which we send only with your separate consent and which you can unsubscribe from at any time	Article 6(1)(b) — performance of a contract (necessary to provide the service you signed up for)
Financial data	Income entries, expense entries, mileage records, tax calculation results, HMRC MTD submission records, and, in the mobile app, any receipt or day-list photos you choose to attach (a day list can show patient names, so cover or crop patient details before you add one). Your HMRC authorisation tokens and National Insurance number are held only in your device's secure keychain; we do not store them on our servers	Providing the income tracking, expense tracking, tax calculation, and HMRC MTD submission features	Article 6(1)(b) — performance of a contract
Professional details	Your GDC or other registration number, clinician type, practice name and region, and, if you use the mobile app and allow notifications, a push notification token for your device	Showing the right templates and wording for your role, and sending notifications you have allowed	Article 6(1)(b) — performance of a contract
Practice and team data (Practice plan)	Practice name, address, telephone and email, team member names, emails and roles, and the practice's referral tracker, significant-event and clinical-audit records. Nosht processes these for the practice as its processor; see our Data Processing Agreement	Providing the Practice plan to the practice that set it up	Article 6(1)(b) — performance of a contract (Nosht acts as processor for the practice's own records)
Security and audit logs	Change history of notes and practice records, and logs of administrative access to clinical data	Keeping an audit trail, investigating problems and protecting the service and your data	Article 6(1)(f) — legitimate interests (security and accountability)
Practice staff compliance data	Where a Practice plan admin uses the Staff Compliance feature for a team member: that person's GDC number and expiry, professional indemnity provider and expiry, CPD hours and training records, the date DBS evidence was last seen (we do not record the certificate number), and whether evidence of Hepatitis B immunity was seen — yes or no, not the clinical result. Records for a team member who has left the practice are deleted 12 months after they leave.	Helping the practice track its team's regulatory and training compliance	Article 6(1)(b) — performance of a contract. The Hepatitis B evidence-seen flag is special category health data of the staff member and is processed under Article 9(2)(b) UK GDPR and Schedule 1, paragraph 1 of the Data Protection Act 2018 (employment, social security and social protection).
Compliance analytics data	Where you use the Bulletproof Mode documentation-completeness check, Nosht generates and stores documentation completeness scores derived from your note activity (for example, scores indicating whether consent documentation is present). These scores relate to your note-writing behaviour as a clinician — not to individual patients. Nosht automatically scores the completeness of your notes (partly using AI). If you work under a Practice plan, your practice owner and admins can see your scores and grades by name. This is profiling of your documentation practice; it does not by itself produce decisions with legal effect, and a human (you or your practice) makes any decision based on it. You can object via hello@nosht.io.	Providing the Bulletproof Mode documentation-completeness check; generating practice-level compliance analytics (Practice plan subscribers); improving the accuracy of compliance guidance within the Service	Article 6(1)(b) — performance of a contract; Article 6(1)(f) — legitimate interests (improving compliance guidance for dental professionals)
Lead capture / free-template downloads	Name (optional) and email address, submitted via the free-template download form on the Nosht blog and resources pages. Where the marketing-opt-in checkbox is ticked, we also record that consent flag. The marketing-consent checkbox is unchecked by default; ticking it is voluntary and is not required to receive the template.	Delivering the requested resource by email (transactional); and — only where you tick the marketing checkbox — sending you Nosht product updates and new templates.	Delivering the resource: Article 6(1)(b) — performance of a contract / Article 6(1)(f) — legitimate interests (delivering content you requested). Marketing emails (where the box is ticked): Article 6(1)(a) — your consent, withdrawable at any time (see below).
Patient leaflet delivery data	Patient email addresses or UK mobile numbers that you enter when using the Send Leaflet feature; a log of which leaflet was sent, the delivery method, and the timestamp; a one-way keyed code (hash) of the email or mobile, kept 30 days. Patient names are not collected or stored.	Delivering patient information leaflets on your instruction; maintaining an audit log of leaflet communications for your practice records; limiting repeat messages	Article 6(1)(b) — performance of a contract; Article 6(1)(c) — compliance with a legal obligation (record-keeping under GDC Standards for the Dental Team). You, as the treating clinician, are the Data Controller of your patients' contact details. Nosht acts as Processor when handling this data on your instruction — see our Data Processing Agreement for details.
Practice plan waitlist	The email address you enter in the Practice plan “Join the waitlist” form on the pricing pages, a one-way keyed code (hash) of your IP address used to limit repeat sign-ups, and when we sent and you confirmed the confirmation email	Telling you once when the Practice plan launches. Unconfirmed sign-ups are deleted 7 days after the confirmation email; the whole list is deleted 30 days after the Practice plan launches	Article 6(1)(a) — your consent, given by confirming the link we email you; you can withdraw it at any time by writing to us
Emailed notes	When you use Email note, a copy of that note (its text, which may include patient details you entered, for example in a Referral Letter), the template name and the date, so the link we email you can open it	Sending you a link to your note instead of putting the note text in an email. Only you can open it, after signing in, and only for 24 hours	Article 6(1)(b) — performance of a contract
Terms acceptance record	Which version of our Terms of Service you accepted, when, and how (at sign-up, or when we asked you to accept an updated version)	Knowing which Terms apply to your account, and being able to show that you agreed to them	Article 6(1)(b) — performance of a contract
Cancellation feedback	If you start to cancel your subscription in the app: the reason you choose (optional), anything you write in the optional comment box, which offers we showed you and whether you took one, kept your plan or went on to cancel. If you cancel through our payment provider’s billing page, the reason and comment you give there	Understanding why people leave so we can improve the service. Your comment is not sent to our analytics tools	Article 6(1)(f) — legitimate interests (improving the service)

Free-template downloads — retention and withdrawing marketing consent

Email addresses collected via the template-download form are deleted 30 days after we deliver the requested resource, unless you opted in to marketing — in which case we keep your address until you withdraw that consent or unsubscribe, and delete it 30 days later. You can withdraw consent and unsubscribe at any time by clicking the unsubscribe link in any marketing email we send, or by writing to us at hello@nosht.io. Withdrawing consent does not affect the lawfulness of any marketing emails sent before withdrawal, and it does not affect delivery of the resource you requested.

Other than the Hepatitis B evidence-seen flag recorded for practice staff under Staff Compliance (see "Practice staff compliance data" above), we do not collect special category data (as defined in Article 9 of UK GDPR) about you. We profile documentation completeness as described above; we do not make solely automated decisions with legal or similarly significant effects.

3. How we use your personal data

We use the personal data we collect solely for the purposes described above. More specifically, we use your data to:

Create, manage, and authenticate your Nosht account.
Provide the note-building service and save your drafts and preferences.
Process payments and manage your subscription and plan entitlements.
Send you transactional emails — for example, account verification, password reset, and subscription confirmation or renewal notices.
Respond to your support requests and enquiries.
Monitor and maintain the security and availability of the service.
Comply with legal obligations, including accounting and tax record-keeping requirements.
Improve and develop the Nosht service. When you are signed in, we record which Nosht features you use in our own database (never note text, not shared with third parties) under our legitimate interest in improving the service; you can switch this off in Settings → Account. Separately, where you opt in via our cookie banner, we use product analytics (Microsoft Clarity and PostHog) and Sentry Session Replay to understand how the service is used; PostHog links usage to your account after you sign in. These are off by default and require your consent — see our Cookie Policy.

We will not use your personal data for marketing purposes without your explicit consent. We do not sell, rent, or trade your personal data to any third party.

4. Sharing your personal data

We share your personal data only with trusted third-party service providers who process data on our behalf ("data processors"), and only to the extent necessary to deliver the Nosht service. We require all processors to maintain appropriate technical and organisational security measures and to process data solely on our documented instructions.

Supabase, Inc.

Database and authentication provider

Your account data, usage data (drafts, preferences), and subscription status are stored in a Supabase-hosted PostgreSQL database. Supabase also handles email/password authentication. Supabase is SOC 2 Type II certified. This data is stored in the United Kingdom, in Supabase's London region (AWS eu-west-2).

Supabase Data Processing Agreement is in place, incorporating Standard Contractual Clauses (SCCs) for any transfers outside the UK/EEA.

Stripe, Inc.

Payment processing

Stripe processes all payment card transactions on our behalf. Stripe is PCI DSS Level 1 compliant. We do not handle, see, or store card data. Stripe may process data in the United States and other countries.

Stripe Data Processing Addendum is in place, incorporating SCCs for transfers outside the UK/EEA.

Apple Inc.

App Store distribution and in-app purchase processing (United States)

Where you subscribe to Nosht via the iOS app, Apple processes in-app purchases (IAP) on our behalf through the App Store. Apple receives your Apple ID, transaction identifiers, and subscription status information necessary to validate and fulfil your purchase. Apple may process data in the United States. We do not receive your full payment card details from Apple — only a transaction receipt for validation. Apple operates the App Store under its own terms; your purchase relationship with Apple is governed by Apple's Media Services Terms and Conditions.

Apple's standard developer programme terms and Apple's App Store privacy disclosures govern this processing. For transfers outside the UK/EEA, Apple's Standard Contractual Clauses apply.

Netlify, Inc.

Web hosting and content delivery

The Nosht web application is hosted and served via Netlify's infrastructure and global CDN. Netlify may process technical data (including IP addresses) as part of standard CDN and hosting operations. Our serverless functions also run on Netlify, so request payloads, including clinical note text (when a note is completed or emailed and when the optional AI features are used) and patient contact details for Send Leaflet, pass through Netlify transiently and are not stored there. Data may be processed in the United States.

Netlify Data Processing Agreement is in place, incorporating SCCs for transfers outside the UK/EEA.

Resend, Inc.

Email delivery (account, onboarding, opted-in marketing, patient leaflets and emailed notes)

Resend delivers all of Nosht's outbound email: (1) account and subscription emails (sign-in/verification, password reset, payment receipts, trial reminders, payment-failed and authentication prompts, plan changes, cancellations and refunds); (2) onboarding/activation emails that help you set up and get value from Nosht; (3) marketing emails you have opted in to (such as the lead-magnet nurture sequence), each with a one-click unsubscribe; (4) patient information leaflets sent by email on behalf of subscribing clinicians; and (5) notes. When you email a note to yourself, the email carries only the template name, the date and a link that opens the note in Nosht, not the note text. If an authorised Nosht administrator emails a stored note to your own address, that email contains the note text, which may include patient details you entered (for example, in a Referral Letter). Patient email addresses entered via the Send Leaflet feature are transmitted to Resend solely to deliver that specific email. Nosht keeps only a one-way keyed code (hash) of the address, for 30 days, to stop repeat messages. Resend does not use this data for its own marketing purposes. Data may be processed in the United States.

Resend Data Processing Agreement is in place, incorporating SCCs for transfers outside the UK/EEA.

Twilio, Inc.

SMS delivery (patient leaflets)

Twilio is used to deliver patient information leaflets by SMS on behalf of subscribing clinicians where the SMS delivery method is selected. Patient mobile numbers entered via the Send Leaflet feature are transmitted to Twilio solely for the purpose of delivering that specific message. Twilio does not retain this data for marketing purposes. Data may be processed in the United States.

Twilio Data Processing Agreement is in place, incorporating SCCs for transfers outside the UK/EEA.

Microsoft Clarity (Microsoft Corporation)

Product analytics & heatmaps (optional, opt-in only)

Where you opt in to analytics via our cookie banner, Microsoft Clarity records page interactions (heatmaps, scroll and click behaviour) on our public marketing pages to help us improve them. Clarity runs only on those marketing pages, matched against an explicit allowlist, and is never loaded once you have a signed-in session, on any route — so it cannot see your clinical notes or any patient data. The page that collects patient contact details, the Send Leaflet dialog, is both outside that allowlist and additionally set to mask its content, so the same protection does not depend on the allowlist alone. This is an optional, consent-based service — it is off by default, you can withdraw consent at any time, and we signal Clarity to stop collecting on withdrawal. Microsoft may process this data in the United States.

Microsoft's Data Protection Addendum is in place, incorporating Standard Contractual Clauses (SCCs) for transfers outside the UK/EEA.

PostHog

Product & funnel analytics (optional, opt-in only)

Where you opt in to analytics via our cookie banner, PostHog records which pages and features you use to help us improve the app, and links those usage events to your account after you sign in. PostHog runs on PostHog EU Cloud and your data is processed in the European Union. This is an optional, consent-based service — it is off by default and you can withdraw consent at any time. Patient clinical data is not sent to PostHog, and sensitive values such as invite and sign-in tokens are stripped from captured page addresses.

PostHog Data Processing Agreement is in place. Data is processed within the EU (PostHog EU Cloud), so no transfer outside the UK/EEA arises for this processor.

Functional Software, Inc. (Sentry)

Error monitoring & (consented) session replay

Sentry is used to capture application errors and diagnostic context (such as the error type, stack trace, the page you were on, and your signed-in user ID) so we can detect and fix faults — this error monitoring runs under our legitimate interest in keeping the service secure and reliable, and emails, names and IP addresses are scrubbed from reports. Sentry's optional Session Replay feature, which reconstructs a session to help diagnose an error, is treated as analytics: it is off by default, only enabled where you allow session replay (or choose Accept all) in our cookie banner, never runs on note-writing or other clinical pages, and masks all text and blocks all media. We also only attach your user ID to Sentry error reports once you have given that analytics consent. Our Sentry project uses Sentry's EU region (Germany); because Functional Software, Inc. is a US company, we also rely on Standard Contractual Clauses for any access from outside the UK/EEA.

Sentry (Functional Software, Inc.) Data Processing Addendum is in place, incorporating Standard Contractual Clauses (SCCs) for transfers outside the UK/EEA.

Anthropic, PBC

Optional AI documentation features (United States)

Where you use one of Nosht's three optional, clinician-reviewed AI features, the relevant text is transmitted to Anthropic's Claude API for in-flight processing and a result is returned. The AI shorthand pre-fill sends the shorthand you type, the template's field list, which fields are already filled and your usual selections for that template. The mobile quick note (typed) sends the shorthand you type and your clinician role. The Bulletproof Mode completeness check sends the clinical sections of the note you have written, for an advisory review of documentation completeness; it never sends the Appointment Details (date, your name and GDC number, nurse, chief complaint) or the fields that record staff names and registration numbers, and is not used on referral letters, child examinations or sedation pre-assessments. These features send text only — there is no audio. An automated check blocks text that appears to contain patient identifiers (such as NHS numbers, dates of birth, email addresses or phone numbers), but it cannot catch everything, so do not type patient names or other identifiers into these features. Under our data-processing arrangement with Anthropic, inputs and outputs are not used to train Anthropic's models. Under Anthropic's standard commercial API terms, inputs and outputs may be retained for a limited period (up to 30 days) for trust, safety and abuse-monitoring purposes and are then deleted, except where Anthropic is required to retain them for longer to meet legal or safety obligations; they are not used for any other purpose. Nosht's usage log stores request counts only, not your input text. We keep the data-protection implications of these optional AI features under review, including whether a Data Protection Impact Assessment (DPIA) is required.

Anthropic's commercial API terms (incorporating Standard Contractual Clauses / the UK IDTA, and a no-training data-processing position with inputs and outputs retained only for a limited period for trust-and-safety purposes) govern this processing for transfers outside the UK/EEA.

HM Revenue & Customs (HMRC)

Tax authority — Making Tax Digital

Where you use the Making Tax Digital feature, data is submitted to HMRC on your instruction. HMRC processes this data as an independent controller. Only the financial data you have entered and authorised for submission is shared.

HMRC is an independent data controller and processes data under its own legal authority. No Data Processing Agreement applies — the transfer is made on your instruction as the data subject.

We may also disclose your personal data where required to do so by law or by a regulatory or law enforcement authority, or where necessary to protect the vital interests of any person or the legal rights of Nosht.

We will not otherwise share your personal data with any third party without your prior informed consent.

5. International data transfers

Some of our third-party service providers (Supabase, Stripe, Apple Inc., Netlify, Resend, Twilio, Anthropic, PBC, Functional Software, Inc. (Sentry), and — where you opt in to analytics — Microsoft Corporation (Microsoft Clarity)) are based in the United States and may process your data there. Transfers to US recipients rely on the UK Extension to the EU-US Data Privacy Framework where the recipient is certified, and otherwise on the ICO's International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses.

Where we transfer personal data to countries outside the UK that do not provide an equivalent level of data protection, we ensure that appropriate safeguards are in place in accordance with Article 46 of UK GDPR. Where the UK Extension to the EU-US Data Privacy Framework does not apply, we rely on the IDTA or the UK Addendum to the EU Standard Contractual Clauses (SCCs) issued by the UK Information Commissioner's Office (ICO), as incorporated in our data processing agreements with each provider.

You may request a copy of the relevant transfer mechanisms by contacting us at hello@nosht.io.

6. Data retention

We retain your personal data only for as long as is necessary for the purposes for which it was collected, or as required by law. The retention periods we apply are set out below.

Data category	Retention period	Reason
Account data	For the life of your account. Deleted immediately and irreversibly when you delete your account; backup copies expire on the hosting provider's normal rolling schedule. See our Data Processing Agreement for full data return provisions.	Service provision. There is no recovery period: deleting your account cannot be undone
Subscription and billing records	Invoices and payment records are kept by Stripe, our payment processor, for 7 years to meet UK tax law. Nosht deletes its own copy of your subscription and payment records when you delete your account.	UK legal requirement for financial and tax records (Companies Act 2006; HMRC guidance)
Note drafts and incomplete notes	Deleted automatically after 90 days with no edit — whether or not your account stays open	Service provision only. A draft you never finish, including any patient details entered into the Referral Letter template, has no independent legal basis for long-term retention.
Completed clinical notes and audit evidence	Account identity detached on account closure: your user_id is removed from completed notes, and the structured patient-identifier fields captured by the optional Referral Letter template (patient name, date of birth, NHS number, address, contact details, and email address) are scrubbed. Other clinical content you entered into note fields is retained as part of the dento-legal record. The de-identified record is then retained for the GDC/NHS dental-records retention period — a minimum of 11 years for adults, or until the patient's 25th birthday for children, whichever is later.	UK GDPR Article 17(3)(b) and (e): retention is required for compliance with the GDC/NHS dental-records legal obligation and for the establishment, exercise, or defence of legal claims. On account closure, your account identity (user_id) is detached from completed notes, and the structured patient-identifier fields captured by the optional Referral Letter template are scrubbed. Clinicians are instructed not to enter patient-identifying details into clinical notes; however, any other clinical free text that was entered into note fields is retained as part of the dento-legal record and is not guaranteed to be redacted. The retained record no longer carries your user account identity.
User preferences	Duration of your account; deleted immediately when you delete your account	Service personalisation
Technical / server logs	Up to 90 days	Security monitoring and incident investigation
Support correspondence	2 years from last interaction	Service quality, audit trail for any disputes
Patient leaflet delivery logs	Delivery record (leaflet title, send date, send method): until the sending clinician asks us to delete it or closes their Nosht account. Patient email or mobile: not stored itself; a one-way keyed code (hash) of it is kept for 30 days, then deleted. Resend (email) and Twilio (SMS) keep their own delivery logs under their retention policies.	GDC Standards for the Dental Team require clinicians to maintain records of patient communications. The code is used only for the daily per-recipient sending limit.
Change history of account and billing settings (security audit trail)	12 months, then deleted. Redacted when your account is deleted.	Security monitoring and investigating unauthorised changes to account and billing records
Practice staff compliance data	Duration of the team member's time with the practice; deleted 12 months after they leave	No independent legal basis for retaining a former team member's compliance record once they have left
Free-trial check (one free trial per person)	When a free trial starts, we keep a one-way keyed code (hash) of the payment card's Stripe fingerprint and of your account email address, not the card details or the email address themselves. Kept for 3 years from the trial, then deleted. It is kept when you delete your account.	Fraud prevention: enforcing the one-free-trial-per-person rule in our Terms, under our legitimate interests (UK GDPR Article 6(1)(f)). The code is used only to recognise a card or email address that has already had a trial.
Emailed notes (Email note)	24 hours. After that the link no longer opens the note, and the copy is deleted automatically, usually within the hour. It is deleted straight away if you delete your account. The completed note itself is kept as set out above.	Service provision: the copy exists only so the link in the email can open your note
Terms acceptance record and cancellation feedback	For the life of your account; deleted when you delete your account	Showing which Terms you agreed to, and understanding why people cancel

When data is no longer required, it is securely deleted or, where a statutory retention obligation applies, de-identified as described in the retention table above.

7. Cookies and similar technologies

Nosht uses a minimal set of cookies and browser storage mechanisms. The cookies required to operate the service are strictly necessary and set without consent. We also offer optional analytics (Microsoft Clarity, PostHog, Sentry Session Replay, and our own usage events) which are off by default and load only if you opt in via our cookie banner. We do not use third-party advertising cookies, or any tracking technologies designed to build a profile of your browsing behaviour across other websites. See our Cookie Policy for full details of each cookie and the opt-in analytics.

Cookie / storage item	Type	Purpose	Duration
Supabase auth token	Strictly necessary (local storage)	Keeps you signed in to your Nosht account until you sign out	Until you sign out; idle tabs sign out after 8 hours
Local storage (preferences)	Strictly necessary (functional)	Stores your UI preferences (such as theme and tooth notation system) locally in your browser — no data is sent to a third party	Until cleared by you
Cookie consent preference	Strictly necessary (functional)	Records your choices (analytics and session replay, each on or off), when you made it and which version of this notice it applies to, so the banner is not shown again until we ask again after 12 months, or sooner if the cookies we use change. If you are signed in, the same record is also kept with your account until you delete it	12 months, then we ask again
One-time "already shown" markers	Strictly necessary (local storage)	Remember, for your account on this browser, that the Nosht AI unlock message, its celebration and the first-fill guidance have been shown, so they appear only once. Stored whether or not you accept analytics, and never sent to us or to any third party	Until cleared by you

The cookies in the table above are strictly necessary to operate the service, so we are not legally required to obtain your consent for them under the Privacy and Electronic Communications Regulations (PECR). Our optional analytics tools (Microsoft Clarity, PostHog, Sentry Session Replay, and our own usage events) are not strictly necessary: they are off by default and load only with your explicit opt-in via the cookie banner, and you may withdraw that consent at any time. You may clear cookies and local storage at any time through your browser settings; however, doing so will log you out of Nosht.

8. Your rights under UK GDPR

Under the UK GDPR, you have the following rights in relation to your personal data. All rights are subject to applicable legal exemptions.

Right of access (Article 15)

You have the right to request a copy of the personal data we hold about you and to be told how we process it. We will respond within one calendar month.

Right to rectification (Article 16)

You have the right to request that we correct inaccurate or incomplete personal data we hold about you.

Right to erasure / "right to be forgotten" (Article 17)

You have the right to request deletion of your personal data where there is no overriding legitimate reason for us to continue processing it. Note that some data may be retained where required by law (for example, financial records).

Right to restriction of processing (Article 18)

You have the right to ask us to restrict processing of your personal data in certain circumstances — for example, while you contest its accuracy.

Right to data portability (Article 20)

You have the right to receive personal data you have provided to us in a structured, commonly used, machine-readable format, and to transmit it to another controller where technically feasible.

Right to object (Article 21)

You have the right to object to processing based on legitimate interests (Article 6(1)(f)). We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.

Rights related to automated decision-making (Article 22)

We do not carry out automated decision-making or profiling that produces legal or similarly significant effects on you.

Right to withdraw consent

Where we rely on your consent — specifically for our optional analytics cookies (Microsoft Clarity, PostHog, Sentry Session Replay, and our own usage events), which are off by default, and for marketing emails sent following a free-template download where you ticked the opt-in checkbox — you have the right to withdraw that consent at any time. Analytics consent can be withdrawn via our cookie banner; marketing email consent can be withdrawn by clicking the unsubscribe link in any marketing email or by contacting hello@nosht.io. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

9. How to exercise your rights

To exercise any of your rights, please submit a written request to us at hello@nosht.io. To protect your privacy, we may ask you to verify your identity before we can action your request. We will respond to valid requests within one calendar month. If your request is complex or numerous, we may extend this period by a further two months, in which case we will notify you.

There is no charge for exercising your rights, unless a request is manifestly unfounded or excessive, in which case we may charge a reasonable administrative fee or refuse to act on the request.

You can delete your Nosht account at any time from within the application settings. Account deletion will trigger the deletion or de-identification of your data in accordance with the retention periods set out in Section 6 above. In particular, completed clinical notes are not deleted on account closure; instead, they are de-identified — your account identity (user_id) is removed and the six structured patient-identifier fields captured by the optional Referral Letter template are scrubbed — and are retained for the statutory GDC/NHS dental-records period as explained in Section 6. Clinicians are instructed not to enter patient-identifying information into other note fields; however, any other clinical free text that was entered is retained as part of the dento-legal record and is not guaranteed to be redacted.

10. How we protect your data

We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, disclosure, alteration, or destruction. Measures in place include:

All data is transmitted over encrypted connections (HTTPS/TLS).
Passwords are hashed using industry-standard algorithms — we do not store passwords in plain text.
Our database (Supabase) enforces Row-Level Security (RLS) policies so that each user can access only their own data.
Access to production systems is restricted to authorised personnel only.
Support access: only when you have asked us for help, a Nosht superadmin can open a read-only view of your account. It cannot change, send, export or delete anything, ends after 15 minutes at most, and its start, end and reason are logged. Ending it signs your account out on every device, so you may need to sign in again. We do not notify you each time.
We rely on SOC 2 Type II certified and PCI DSS Level 1 compliant third-party infrastructure providers.
We conduct periodic security reviews of our application and infrastructure.

Whilst we take all reasonable steps to protect your data, no method of transmission over the internet or electronic storage is entirely secure. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours of becoming aware and will inform you without undue delay where required.

11. Children's privacy

Nosht is a professional tool intended solely for use by qualified dental professionals and those in dental training or employment. The service is not directed at, and is not intended for use by, children under the age of 18. We do not knowingly collect personal data from anyone under 18. If you believe we have inadvertently collected data from a minor, please contact us at hello@nosht.io and we will promptly delete it.

12. Third-party links

Our website or application may contain links to third-party websites, resources, or services (for example, links to our payment provider or relevant professional bodies). This Privacy Policy applies only to data processed by Nosht. We are not responsible for the privacy practices or content of any third-party website. We recommend that you read the privacy policy of any third-party site you visit.

13. Changes to this privacy policy

We will tell you about material changes by email and in the app at least 30 days before they take effect. Where a change requires your consent under data protection law, we will ask for it.

14. How to complain

If you have a concern about how we handle your personal data, we ask that you contact us in the first instance so that we can attempt to resolve the matter:

Email: hello@nosht.io

If you are not satisfied with our response, or if you believe we are processing your personal data unlawfully, you have the right to lodge a complaint with the UK supervisory authority:

Authority: Information Commissioner's Office (ICO)
Website: ico.org.uk
Helpline: 0303 123 1113
Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

You also have the right to seek a judicial remedy against us or against the ICO.

Privacy Policy