This Privacy Policy is published by YHC Smiles Ltd, a company registered in the United Kingdom with its practice desk at 5 South Charlotte Street, Edinburgh - EH2 4AN, United Kingdom (GB). The website and the coordination service described on it are operated by the developer YHC Smiles on behalf of the company. Where this policy mentions the Company, it means YHC Smiles Ltd. Where it mentions the Desk, it means the team that answers enquiries and maintains the appointment record at the Edinburgh address. This document describes what information is collected, why it is collected, how long it is kept and what choices are available to the people whose information is held.
1. Who We Are
The Company is YHC Smiles Ltd. The practice desk is located at 5 South Charlotte Street, Edinburgh - EH2 4AN, United Kingdom (GB). The Desk can be reached by email at quotes@yhcsimiles.buzz and by telephone on +13095804782. The Company is the controller for the personal information described in this policy, which means it decides why that information is held and how it is used.
The Company provides coordination services for dental appointments. It arranges checkups, hygiene recalls, whitening consults, family appointment blocks, nervous patient clinics and sports guard fittings. It does not perform clinical treatment, and it does not make clinical decisions. The registered practitioner remains responsible for examination, diagnosis and treatment, and the clinical records created during a visit belong to the practice rather than to the Desk.
The developer named in the introduction, YHC Smiles, maintains this website and the systems that support enquiry handling. Questions about this policy can be directed to the contact details above, and the Desk will route technical questions to the developer where that is helpful.
2. Scope of This Policy
This policy covers personal information handled through the website at yhcsimiles.buzz, through the enquiry form on the contact page, through email and telephone contact with the Desk, and through the appointment records maintained for the practice. It also covers information collected from visitors who simply browse the site without making contact.
This policy does not cover the clinical records created by the treating practitioner during an appointment. Those records are governed by the practice policy and by the professional obligations that apply to registered dental professionals. Where a patient wishes to view or correct a clinical record, the Desk will explain the correct route and will pass the request to the practice team.
The website links to pages that describe services. Those pages are part of the same site and are covered by this policy. The site does not host third party advertising and does not embed third party tracking scripts.
3. Information We Collect
The information collected falls into a small number of categories, and each category has a clear purpose. The Desk does not collect information simply because it is available, and it does not combine information from unrelated sources without a reason.
Contact information
Name, email address, telephone number and postal address are collected when a person sends an enquiry or asks for an appointment. These details are used to reply, to confirm the appointment and to send the recall notice at the agreed interval.
Appointment information
The service requested, the preferred dates and times, the practitioner involved, the length of the slot and any note about access or anxiety that the patient chooses to share. This information is used to arrange the visit and to prepare the short brief read by the clinician before the appointment.
Correspondence
The content of emails, messages sent through the website form and notes taken during telephone calls. Correspondence is kept so that a question answered once is answered consistently the next time.
Technical information
When a visitor loads a page, the web server records routine technical data such as the requested page, the date and time of the request, the browser type and an approximate location derived from the network address. This data is used to keep the site available and secure and is not used to build a profile of an individual.
Sensitive information
Health information is only recorded when a patient provides it and when it is needed to arrange a suitable appointment, for example when someone explains that they feel anxious about dental visits. The Desk asks for the minimum detail necessary and does not request clinical history through the website form.
4. How Information Is Collected
Most information arrives directly from the person it concerns. A visitor fills in the contact form, sends an email, makes a telephone call or speaks to the Desk in person. Because the website form is prepared in the visitors own email application, the message is reviewed before it is sent and the site itself does not receive or store the form content.
Some information is created by the Desk as it coordinates an appointment. A confirmation note, a brief for the clinician, a recall card with its month tag and a record of the contact attempts are all examples. These records are created so that the service is consistent and so that the patient does not have to repeat information at every visit.
A small amount of technical information is generated automatically by the web server when a page is requested. This information is used for availability, security and fault diagnosis, and it is retained for a short period before routine rotation.
5. Why We Use Information
Personal information is used to answer enquiries, arrange appointments, prepare the clinical brief, send recall notices and keep the record accurate. Each of these uses is closely tied to the coordination service. If a use is not described in this section, it is not part of the service.
- To reply to a question sent by email, telephone or the website form and to keep a note of the answer given.
- To arrange, confirm, move or cancel an appointment at the request of the patient or the practice.
- To prepare a short written brief for the clinician so the visit begins with shared context.
- To send recall notices at the interval agreed with the clinician and to record the response.
- To keep the appointment diary accurate and to plan clinics in clusters where that shortens waiting.
- To meet legal, accounting and record keeping duties that apply to the Company.
- To protect the website and the appointment systems from misuse, fraud and unauthorised access.
Information is not used to make automated decisions about a person, and it is not sold, rented or traded. The Desk does not use personal information to build advertising audiences and does not share contact details with marketing partners.
6. Lawful Basis for Processing
The Company relies on a small set of lawful bases, and the basis used depends on the activity. Correspondence about an enquiry is handled on the basis of taking steps at the request of the person before entering into a service arrangement. Appointment coordination and recall work are handled on the basis of performing the service that has been agreed. Records required by law are kept because the Company has a legal obligation to keep them.
Where health information is recorded to arrange a suitable appointment, the Company relies on the provision of health or social care services and on the explicit consent given when the patient chooses to share that detail. Consent can be withdrawn at any time, and the Desk will explain what changes follow from a withdrawal. A withdrawal does not affect work already completed, and it does not prevent the Company from meeting record keeping duties that apply by law.
The Company may also rely on legitimate interests for limited purposes such as securing the website, preventing misuse and improving the clarity of written communications. Where legitimate interests are used, the Company balances its interest against the rights of the individual and will stop using the information for that purpose if the balance suggests it should.
7. Appointment and Recall Records
The appointment record is the centre of the coordination service. It holds the service booked, the practitioner, the slot length, any note about access or anxiety that the patient shared, the brief prepared for the clinician and the recall interval set after the visit. The record is kept in a small number of controlled systems rather than spread across personal devices.
Recall cards are filed by month on a rail so the Desk can see which months are full and which have room. The card holds the name, the interval, the reason for the interval and the contact history. When the recall is answered, the appointment is booked and the card is updated. When the recall is not answered after three contacts, the card returns to the practice for a clinical review.
Patients can ask what is recorded about their appointments, can ask for a correction where a detail is wrong and can ask for a note to be added where context is missing. The Desk will explain any limit that applies, for example where the clinical record belongs to the practice and must be corrected by the practitioner.
9. Service Providers
A small number of service providers support the website and the appointment systems. These providers may process personal information on behalf of the Company, and they are bound by written terms that require them to protect it and to use it only for the agreed purpose. Typical providers include the hosting service that serves the website, the email service that delivers messages to quotes@yhcsimiles.buzz and the booking tools used to hold the appointment diary.
The Company reviews its providers before they are engaged and at reasonable intervals afterwards. A review considers the security measures in place, the locations where information is stored and the process for deleting information when the relationship ends. Where a provider cannot meet the required standard, the Company looks for an alternative rather than accepting a lower level of protection.
The Desk does not share personal information with advertising networks, data brokers or analytics companies that build cross site profiles. If a measurement tool is used to count page views, it is configured to avoid identifying individual visitors and is described in the cookies section of this policy.
10. International Transfers
The Company is based in the United Kingdom and keeps its principal records there. Some service providers operate infrastructure in other countries, and information may therefore be transferred outside the United Kingdom in the course of hosting, email delivery or system support. Where a transfer takes place, the Company relies on an approved transfer mechanism and on written terms that require an equivalent standard of protection.
Transfers are kept to what the service requires. A hosting provider may store a copy of the website in more than one region for resilience, and an email provider may route a message through a relay in another country. These transfers are technical rather than a decision to move records abroad, and the Company reviews the arrangement when a provider changes its infrastructure.
Anyone who wishes to know more about the countries involved, or about the safeguards used for a particular transfer, can contact the Desk at quotes@yhcsimiles.buzz and will receive a written explanation.
11. How Long We Keep Information
Information is kept only for as long as it is needed for the purpose it was collected for, unless a longer period is required by law. The periods below are the general rules applied by the Desk, and a particular record may be kept longer where a legal duty or an open query requires it.
- Enquiries that do not lead to an appointment are kept for twelve months and then deleted, so the Desk can answer a follow up question in the same year.
- Appointment records are kept for the period required by the record keeping rules that apply to the practice, and the clinical record is held by the practice under its own policy.
- Recall cards are kept until the recall is answered or until the practice decides the recall is no longer appropriate.
- Telephone and email correspondence is kept for twenty four months unless it forms part of an appointment record.
- Server logs are kept for a short technical period, usually no more than ninety days, and are then rotated.
- Accounting records are kept for the period required by tax law in the United Kingdom.
When a retention period ends, the information is deleted or irreversibly anonymised so that it can no longer be linked to a person. Where deletion is not immediately possible because a backup copy exists, the copy is placed beyond ordinary use and is removed when the backup cycle completes.
12. Security Measures
The Company uses technical and organisational measures to protect personal information. Access to appointment records is limited to members of the Desk and to clinicians who need the brief for a visit. Accounts are protected by strong passwords and are removed when a member of the team leaves. Devices that hold records are encrypted and are kept up to date with security updates.
The website itself is a set of static pages. It does not contain a database, and the contact form prepares a message in the visitors email application rather than sending data to a server. This design reduces the amount of information that can be exposed through the website, and it means the Desk receives enquiries through the same email channel that patients already use.
If a security incident occurs, the Company will contain it, assess its effect and notify the relevant authority and the affected individuals where the law requires that step. The Desk keeps a written record of any incident, including the action taken and the lesson learned, so that the same issue is less likely to recur.
13. Your Rights
People whose information is held by the Company have rights under data protection law. The Desk will explain how to exercise a right and will respond within the period set by law. A request can be made by email to quotes@yhcsimiles.buzz or by letter to the practice desk at 5 South Charlotte Street, Edinburgh - EH2 4AN, United Kingdom (GB).
- The right to be informed about how personal information is used, which is the purpose of this policy.
- The right of access to the information held, together with an explanation of why it is held.
- The right to correction where a detail is inaccurate or incomplete.
- The right to erasure where there is no remaining reason to keep the information.
- The right to restrict processing while a question about accuracy or use is resolved.
- The right to object to processing based on legitimate interests.
- The right to data portability where processing is based on consent or on an agreed service and is carried out automatically.
- The right to withdraw consent where processing is based on consent.
Some limits apply. A record required by law cannot be deleted on request, and a clinical record held by the practice must be managed through the practice process. Where a limit applies, the Desk will explain it in writing and will set out the alternatives that are available.
15. Privacy for Children
The coordination service includes family appointment blocks and guard fittings for young people, so the Desk sometimes holds information about a child. Where a child is under the age that applies in the United Kingdom, the guardian provides the contact details and gives permission for the appointment to be arranged. The child is told what the visit will involve in language suited to their age.
The Desk collects only the information needed to arrange the visit: the name, the guardian contact, the service requested and any note that helps the visit go well. The website is not directed at children, and the contact form is intended for use by a guardian or an adult acting for a young person.
A guardian can ask what is recorded about a child, can ask for a correction and can ask for a record to be removed where the law allows. When a young person reaches the age at which they can act for themselves, the Desk will explain how the record is handled and will respect the choices the young person makes.
16. Marketing Communications
The Desk does not send marketing email. Messages sent from the practice desk relate to a request that was made, an appointment that was booked or a recall that is due. A patient who asks to be reminded about a seasonal service, such as the winter checkup window or the pre-season guard fitting, gives specific permission for that reminder and can withdraw it at any time.
Where a reminder is sent, it includes the name of the Company, the reason for the message and a simple route to stop receiving it. The Desk acts on a stop request immediately and adds a note to the record so that the reminder is not sent again by mistake.
The site does not run advertising and does not share contact details with any advertising partner. Any future change to this practice would be described in an updated policy before the change took effect.
17. Complaints and Contacts
Anyone who is concerned about the way personal information has been handled should contact the Desk first. The Desk will acknowledge the concern, investigate it and reply in writing within the period set by law. The address is 5 South Charlotte Street, Edinburgh - EH2 4AN, United Kingdom (GB), the email is quotes@yhcsimiles.buzz and the telephone number is +13095804782.
If a concern cannot be resolved through the Desk, it can be raised with the Information Commissioner in the United Kingdom, which is the supervisory authority for data protection matters. The Desk will provide the relevant contact details on request and will cooperate fully with any enquiry.
Complaints about clinical treatment are handled by the practice rather than by the Desk, because the Desk does not provide treatment. Where a person is unsure which route applies, the Desk will explain the difference and will pass the matter to the right team.
18. Changes to This Policy
This policy may be updated when the service changes, when a provider changes or when the law requires a different approach. The current version is always available on this page, and the date of the most recent review is shown below. A material change will be explained in a short notice at the top of the page for a reasonable period.
Where a change affects the way information is used, the Desk will take reasonable steps to inform people whose contact details are held. Continuing to use the website or the service after a change takes effect indicates acceptance of the updated policy, and a person who does not accept the change can ask the Desk to close their enquiry record.
This policy was last reviewed in 2026. Questions about it can be sent to quotes@yhcsimiles.buzz at any time. The Desk aims to answer every privacy question in plain language, and it will explain any term that is unclear.