What is kept, and what cannot be deleted.

Who you are. Your name, your date of birth, and the practice’s own reference for you. Date of birth is there because age changes how a risk has to be explained and who may lawfully agree to treatment, not to profile anybody.

Your consent visit. Which procedure, which tooth, which clinician, which language, when it started and when it finished, every question you were shown, every answer you gave including the wrong ones, every part that was explained again, how long you spent, anything you refused, and anything the software told the clinician you had not yet understood.

Signatures. Your signature image and typed name, the time, and the same for a witness or a person with parental responsibility where one signed.

Ability to decide (capacity), children and best interests. Where a clinician checked whether you could make this decision, that check and their notes. Where treatment went ahead as a best-interests decision (made for you, in your interest) or in an emergency without the usual steps, the record of that decision.

Contact details, sometimes. If the practice sent you a link to read at home, your email address or mobile number is held with that consent, along with whether the message arrived.

Files. A photograph, X-ray or scanned form the clinician attached because it was part of what you were shown.

Other personal details, which have a space but are empty. The patient record has spaces for an address, a postcode, a telephone number, an NHS number, a guardian’s details and a legal representative’s details. Nothing in the product writes any of them today, and no deletion request reaches them. They are named here because a notice that only lists the fields currently in use is a notice that goes stale the day one is filled in.

For an adult, a record is kept for fifteen years from the day the consent was completed. For a patient who was under sixteen at the time, it is kept until their twenty-fifth birthday or fifteen years from completion, whichever falls later.

A practice can change those two numbers, within limits the software enforces: adult records kept for between eleven and thirty years, and the age for a child between twenty-five and thirty. Eleven years is a minimum, not a default. A practice cannot keep adult records for less, even if it wants to, and every change is written to the activity log (the permanent log of changes).

Once a record is sealed (locked so any change shows), its keep-until date is fixed on the record itself and the database refuses to change it. A practice that later shortens its policy does not shorten the clock on records already sealed.

We keep it because the law requires it. Not your consent, and not our interests. A record of what a patient was told before treatment is exactly the thing a claim made years afterwards turns on, and dental record-keeping obligations are why the period is what it is. UK GDPR (the UK law on personal data) Article 17(3)(b) says the right to erasure (deletion) does not apply where using the data is needed to meet a legal duty. That is the whole reason the clock cannot be shortened on request, and it is the honest answer rather than a convenient one.

Your answers are marked against the answer recorded with each question when a clinician approved it. An AI model is not asked whether you understood, and it is not asked anything about you.

An AI model drafts explanations, risk descriptions and questions for a clinician to read, change and approve. Until a clinician has approved it, the database refuses to show it to a patient. Nothing in this product produces a decision about you by automated means, and nothing here decides whether you are treated. Where the software notices that something was not understood, it tells the clinician and the conversation continues.