Trust Centre
Last updated: 9 November 2026
OpenWide connects dental practices to patients for online booking. This page sets out how we look after clinic and patient data, for practice owners, group compliance teams and IT reviewers. If you need anything that is not here, email [email protected].
At a glance
- Role for clinic patient data
- Processor (the clinic is the controller)
- Primary data location
- Ireland (EU), AWS eu-west-1
- Breach notice to clinics
- Within 48 hours
- Clinical records
- Never accessed
- Card details
- Never seen or stored (Stripe)
- ICO registration
- ZC109416
What data we handle
For bookings, the practice is the data controller and OpenWide is its processor. We handle only what is needed to make and manage a booking:
- Patients: name, contact details, date of birth and gender where the practice system needs them to create or match a record, NHS or private status, appointment and payment details, and messages about the booking.
- Clinicians and staff: names, job titles and GDC numbers shown for booking, and the work emails of staff who use the clinic portal.
We do not access clinical records such as medical history, medications or treatment notes. Patients who create an OpenWide account have a direct relationship with us for that account, covered by our privacy policy.
Security
Encryption
All traffic uses HTTPS with HSTS preload. Data is encrypted at rest by our database provider. Practice management credentials are stored in an encrypted vault and are only ever read by our server-side systems.
Access control
Database row-level security keeps each clinic’s data separate. Clinic portal users only see the clinics they are assigned to. Access to production systems is limited to named OpenWide staff who need it.
Practice management connections
Cloud systems are connected through their official APIs. On-premise systems use a connector that makes an outbound encrypted tunnel, so the practice does not open any inbound ports. We read diary availability and create bookings only. We do not access clinical records.
Payments
Patients pay through Stripe, normally straight to the clinic’s own Stripe account. For clinics without one, OpenWide collects the payment as the clinic’s agent and passes it on. OpenWide never sees or stores card or bank details.
Application security
Strict security headers (Content Security Policy, frame blocking, no MIME sniffing), rate limiting on sensitive endpoints, and verified accounts before a patient can book.
Monitoring
Errors are reported to our monitoring service in real time. Any session replay used for debugging masks all text and blocks media, so patient details are not recorded.
Backups and deletion
The database is backed up automatically. When a clinic leaves, we delete or return its data within 30 days, and backup copies expire on their normal cycle, no longer than 30 days.
Incidents
If we become aware of a personal data breach affecting a clinic's data, we notify the clinic without undue delay and within 48 hours, even if our investigation is still going. The notice says what happened, who and what is affected, the likely consequences, what we are doing about it, and who to contact. We send updates as we learn more. To report a security concern, email [email protected].
Subprocessors
These suppliers may process clinic personal data on our behalf. Clinics get at least 30 days' notice by email before we add or replace one, and can object. Where data is processed outside the UK, the transfer is covered by UK adequacy regulations or an approved safeguard such as the UK International Data Transfer Agreement or UK Addendum.
| Supplier | What they do | Where | Data |
|---|---|---|---|
| Vercel Inc. | Website hosting and server-side processing | Served from London, UK; server-side processing in the United States | Request data, including booking and patient details as they pass through |
| Supabase Inc. | Database, authentication, file storage and encrypted credential storage | Ireland (AWS eu-west-1) | All clinic personal data held by OpenWide, and encrypted PMS credentials |
| Resend | Transactional email | Sending from Ireland; account and log data in the United States | Patient and clinic email addresses and booking email content |
| Stripe | Payments, under Stripe Connect | UK, EEA and United States | Patient payment details. Stripe is also a controller in its own right for payment data |
| Cloudflare, Inc. | DNS, network security and encrypted connector tunnels for on-premise systems | Nearest Cloudflare data centre; normally the UK for UK traffic | Encrypted request data in transit |
| Google Workspace email and documents | EEA and United States | Support emails and documents that may contain patient or clinic staff details | |
| Functional Software, Inc. (Sentry) | Error monitoring | Germany (EU region) | Technical error data, which may include user IDs and request details; screen text is masked |
| PostHog, Inc. | Product analytics, only with cookie consent | EU region | Account IDs and email addresses of signed-in users, and page and booking events |
| Upstash, Inc. | Rate limiting to protect the platform from abuse | Global, including the United States | IP addresses and account IDs, held for minutes only |
Other services we use
These do not process clinic personal data. We list them so reviewers have the full picture.
- Anthropic (Claude): Helps draft public directory content from publicly available clinic information. It never receives patient data or data from a clinic’s practice management system.
- Vercel Web Analytics and Speed Insights: Cookieless, aggregated page performance and visit counts.
- Google Analytics: Website analytics, loaded only if a visitor accepts all cookies.
- OpenStreetMap: Map tiles on search pages. Your browser requests tiles directly, so OpenStreetMap sees your IP address but no booking data.
- Cal.com: Scheduling demo calls with clinics that ask for one.
Data processing agreement
Every clinic accepts our Clinic Integration and Data Processing Agreement when it connects. It covers the UK GDPR Article 28 processor terms, the data we process, subprocessors, breach notification, audits and deletion. Audit requests are answered with documents first, such as this page and a security questionnaire.
Read the agreement (version 1.8)Company details
- Company number: 17098565
- Registered office: 109 Lever Street, London, EC1V 3RQ
- ICO registration: ZC109416
- Data protection contact: [email protected]