Privacy Policy — Millineer Chat UI

Last updated: 17 May 2026

1. Who we are

This chat interface is operated by Royston Dental Practice (data controller, registered in Scotland) trading as Millineer. Our registered address and ICO registration number will appear here once registration is complete. For any data-related queries, contact us at info@millineer.com.

2. What this tool is

The Millineer chat interface is an internal tool used by Royston Dental Practice staff to view and respond to WhatsApp messages from patients who have enquired about dental treatments. It is not a public-facing service. Access is restricted to authorised staff.

3. What personal data we process

Through this interface, our staff may access the following personal data about patients:

• Patient's first and full name
• Phone number (used for WhatsApp messaging)
• Email address (if provided in lead form)
• WhatsApp conversation history (messages between patient and our automated assistant / staff)
• Treatment interest (e.g. veneer, implant) and stated concerns
• Appointment booking status and deposit payment status

4. Legal basis for processing

We rely on the following GDPR legal bases:

• Legitimate interest — to respond to patients who have proactively contacted us seeking dental treatment information.
• Consent — when patients fill out our lead form on millineer.com or via Facebook Lead Ads, they consent to be contacted by Royston Dental.
• Contract performance — when patients book a consultation and pay a deposit, we process their data to deliver the service.

5. Where data is stored

Patient data is stored in:

• Google Sheets (operated by Google Workspace, EU data residency) — for lead and conversation records
• WhatsApp Business Cloud (operated by Meta, EU data residency) — for message delivery
• Our self-hosted server on Hetzner Cloud, Germany (EU) — for the chat interface itself, which holds no patient data persistently; data is fetched and displayed in real time

6. Who has access

Access to this interface is limited to authorised Royston Dental staff and contracted operators. Access is protected by password authentication. No data is shared with third parties for marketing purposes.

7. How long we keep data

Patient conversation data is retained for 24 months from last contact, after which it is deleted. Booked patient records are retained in line with NHS / GDC clinical record retention requirements (typically 11 years for adults).

8. Your rights

Under UK GDPR, you have the right to:

• Request a copy of all data we hold about you (right of access)
• Request correction of inaccurate data
• Request deletion of your data (right to be forgotten), subject to clinical record retention obligations
• Object to processing
• Lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk

To exercise any of these rights, contact info@millineer.com. We will respond within one calendar month.

9. Cookies and tracking

This interface uses browser local storage only to remember staff session preferences (such as auto-handback timeout). No marketing or analytics cookies are set within this interface.

10. Changes to this policy

We may update this policy from time to time. The "last updated" date at the top reflects the most recent change.