Data Processing Agreement

Last updated 29 October 2026

This agreement is between the dental practice or laboratory whose account admin accepts it in Labcomm (“you”, the controller) and the company that operates Labcomm (“Labcomm”, the processor). It applies whenever Labcomm processes personal data on your behalf, and forms part of the Terms of use. It is intended to meet Article 28 of the UK GDPR.

1. The processing

Subject matter and purpose: providing Labcomm, so practices and labs can track lab work for patients.
Duration: while your account is open, and until deletion under section 9.
Nature: storing, organising, displaying and transmitting case information in the app and on WhatsApp; filing messages with AI.
Data subjects: your patients, and your staff and the lab's staff who use Labcomm.
Personal data: patient name and practice reference, the lab work requested (including teeth, shade, materials and instructions), appointment and delivery dates, photos and scans of the work, and messages about it; staff names, emails, roles and mobile numbers.
Special category data: information about dental treatment is health data. You must only add what is needed for the lab work.

2. Your instructions

Labcomm processes the data only on your documented instructions, which are these terms and the way you and your team use the app, unless the law requires otherwise (in which case we will tell you first if we legally can). We will tell you if we think an instruction breaks data protection law.

3. Confidentiality

Everyone at Labcomm who can access the data is bound by confidentiality.

4. Security

We keep appropriate technical and organisational measures, including:

encryption in transit (HTTPS) and at rest; data stored in the UK (London);
access limited by account, practice and role, enforced in the database;
no use of the data for advertising or for training AI models;
removal of location data from photos uploaded in the app;
access by Labcomm staff only where needed to run or support the service.

5. Sub-processors

You authorise Labcomm to use these sub-processors, each under a written agreement with equivalent data protection obligations:

Supabase: database, file storage and sign-in (UK, London).
Vercel: web hosting and server functions (UK, London region).
Meta Platforms (WhatsApp Business Platform): WhatsApp messages, only for people who connect WhatsApp.
Anthropic: AI that reads WhatsApp messages to file them and answer questions about cases.
OpenAI: speech-to-text for WhatsApp voice notes.

We will give account admins at least 30 days' notice of a new sub-processor, so you can object. Where a sub-processor may process data outside the UK, the transfer is covered by UK-approved safeguards (adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses).

6. Helping you

We will help you, taking into account the nature of the processing, to respond to requests from people exercising their rights (most can be handled in the app: correcting or deleting case details), and with security, breach notification, data protection impact assessments and consultations with the ICO.

7. Personal data breaches

We will tell you without undue delay, and in any case within 48 hours, after becoming aware of a breach affecting your data, with the information you need to meet your own obligations.

8. Audits

We will make available the information needed to show we meet these obligations, and allow and contribute to reasonable audits by you or an auditor you appoint, with reasonable notice.

9. End of the service

When you close your account, or ask us to, we will delete your data (or return it to you first if you ask) within 30 days, unless the law requires us to keep it. Backups held by our providers are overwritten on their normal cycle.

10. Labs

A laboratory accepting this agreement does so for the staff and account data it controls, and agrees to use patient information shared with it by practices only for making and delivering their lab work.