Legal
Privacy policy
What we collect, why, who sees it, and how to get it back or get it deleted.
This policy explains what personal information SmileBound collects about you, why, who sees it, and what you can do about it. It covers this website and every way you deal with us — the enquiry form, WhatsApp, email, phone and the booking checkout.
The short version: we collect what we need to match you to a clinic and get you treated safely, we pass your clinical details only to the clinic you are being matched with, we do not sell anything to anyone, and you can ask us to delete it.
1Who controls your data
The data controller is Musa Tariq, trading as SmileBound, a sole trader established in the United Kingdom.
- Address: 85 Great Portland Street, London, W1W 7LT, United Kingdom
- Email: info@smile-bound.com
Any question about your data, or any request under this policy, goes to info@smile-bound.com. We answer within one month.
The clinic you are matched with is a separate controller of the information it holds about you, under Bulgarian and EU law, and has its own privacy notice. Ask us for it and we will send it to you.
2What we collect
- Who you are and how to reach you: name, email address, phone number, country, and your WhatsApp profile name if you message us there.
- What you want done: the treatment you are enquiring about, your budget, your preferred travel dates, and whatever you tell us in your messages.
- Clinical information: photographs of your teeth, X-rays or scans, your dental and relevant medical history, medication and allergies — where you choose to send them. See section 3.
- Payment information: that you paid, when, and how much. Card details are handled entirely by Stripe and we never see or store your card number.
- How you found us and how you use the site: pages viewed, approximate location from your IP address, device and browser, and which advert or link brought you here. See section 9.
- Our correspondence: the messages between us, and our notes of calls and of what a clinic has told us about your case.
3Health information — treated differently
Photographs of your mouth, X-rays, dental records and anything you tell us about your health are special category data under UK GDPR and get stricter treatment.
We process them on the basis of your explicit consent, which you give by choosing to send them to us for the purpose of getting a treatment plan. You can withdraw that consent at any time by emailing us, and we will delete them — though we cannot undo what has already been sent to a clinic, and the clinic keeps its own medical records under Bulgarian law.
Please do not send clinical information through the payment checkout. It does not belong there, and we do not collect it there.
4Why we use it, and our lawful basis
| What for | Lawful basis |
|---|---|
| Answering your enquiry and giving you an estimate | Steps taken at your request before entering a contract |
| Matching you to a clinic, arranging your treatment plan, coordinating appointments and travel | Performance of our contract with you |
| Passing your photographs, scans and dental history to a clinic | Your explicit consent |
| Taking payment, keeping accounting records | Contract, and our legal obligations |
| Following up after treatment, handling complaints, defending claims | Our legitimate interest in running the service and protecting our position |
| Measuring which adverts and pages bring people to us | Consent, for non-essential cookies and similar technologies |
| Sending you marketing about our service | Your consent, or our legitimate interest where you are an existing customer. Every message has an unsubscribe. |
We do not make decisions about you by automated means alone, and we do not profile you in any way that produces legal effects. We use AI tools to help draft replies and summarise enquiries; a person reviews and sends everything.
5Who we share it with
We do not sell your data and we do not share it with anyone for their own marketing.
| Who | What they get, and why |
|---|---|
| The clinic you are being matched with | Your name, contact details and clinical information, so it can prepare a treatment plan and treat you. Shared only with the specific clinic under discussion, and only with your agreement. |
| Stripe Payments UK, Ltd. | Takes your payment. Handles card details directly; we receive only the fact and amount of payment. |
| Netlify | Hosts this website and receives enquiry form submissions. |
| Railway, and GitHub | Host the internal system where your enquiry record is stored, in a private repository. |
| Google (Analytics) | Website usage statistics. |
| Meta Platforms | Advertising measurement, and the WhatsApp and Instagram messages you send us. |
| Telegram | Notifies us that a new enquiry has arrived. |
| Anthropic | Provides the AI assistance used to draft replies and summarise enquiries. Not used to train its models on your data. |
| Professional advisers, or an authority | Where we are required by law, or need advice on a dispute. |
6Sending your data abroad
Your data will go to Bulgaria, because that is where your clinic is. Bulgaria is in the European Union and the UK recognises the EU as providing an adequate level of protection, so no additional safeguard is needed.
Some of the suppliers listed above are based in, or store data in, the United States. Where that happens we rely on the UK Extension to the EU–US Data Privacy Framework, or on the International Data Transfer Addendum to the standard contractual clauses, so that your data keeps an equivalent level of protection.
7How long we keep it
- Enquiries that do not become bookings: 24 months from your last contact with us, then deleted.
- Bookings: 6 years after your treatment finishes — the period in which a claim could still be brought.
- Payment and accounting records: 6 years, as HMRC requires.
- Clinical photographs and scans: deleted from our systems once your treatment plan is settled, or sooner if you ask. The clinic keeps its own records under Bulgarian medical law.
- Marketing consent: until you withdraw it.
8Your rights
You can ask us to:
- show you the personal data we hold about you;
- correct anything wrong or incomplete;
- delete it, where we have no continuing reason to keep it;
- restrict or object to how we use it, including stopping marketing at any time;
- send you a copy in a portable format, or send it to someone else;
- withdraw consent you previously gave, including for your clinical photographs.
Email info@smile-bound.com. It is free, and we will respond within one month. We may ask you to confirm who you are first, so that we do not hand your records to someone else.
9Cookies and tracking
This site uses:
- Essential cookies, which make the site work. These do not need your consent.
- Google Analytics 4, which tells us how many people visit and which pages they read.
- The Meta pixel, which tells us whether an advert led to an enquiry.
The analytics and advertising technologies are not essential to the site working, and you can refuse them. You can block or delete cookies in your browser settings, install the Google Analytics opt-out add-on, and change what Meta uses for advertising in your Facebook or Instagram ad preferences. Blocking them does not stop you using this site.
10Complaints
If you think we have handled your data badly, please tell us first — info@smile-bound.com — so we can put it right.
You also have the right to complain to the Information Commissioner's Office, the UK data protection regulator: ico.org.uk/make-a-complaint, or 0303 123 1113.
11Changes
If we change this policy we will update the date at the top, and if the change is significant we will tell people who have an active booking with us.