Privacy Policy

This Privacy Policy explains how SimplyRoots Limited ("we", "us", or "our"), trading as SmadiDesk, collects, uses, stores, and protects your personal data when you use our AI voice receptionist service for dental practices.

We are committed to protecting your privacy and handling your data in a transparent and lawful manner in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

The data controller responsible for your personal data is:

Where SmadiDesk processes personal data on behalf of a dental practice (for example, caller information during voice calls or information imported from practice website pages and uploaded materials), the dental practice acts as the data controller and SmadiDesk acts as the data processor. Our responsibilities are governed by a Data Processing Agreement between SmadiDesk and each practice. You can review the current DPA on our Data Processing Addendum page.

We may collect and process the following categories of data:

We process personal data for the following purposes:

• Service delivery: Providing the AI voice receptionist service, including handling calls and capturing enquiries for dental practices
• Onboarding, configuration, and knowledge import: Importing information from publicly accessible practice website pages and uploaded practice materials to configure the service and answer practice-specific questions
• AI processing: Processing customer-call audio and conversation data to deliver the subscribed service
• Public-demo delivery: Sending live demo voice audio and transcription to ElevenLabs, and conversation text to its language-model provider, to run the requested conversation
• Emergency detection: Identifying urgent call scenarios and flagging them for attention
• Lead capture: Recording caller details and appointment requests for practice follow-up
• Integration: Sharing authorised data with connected practice systems
• Billing and payments: Managing subscriptions and payments
• Service improvement: Analysing aggregated, anonymised usage data to improve our AI and platform
• Communication: Sending service emails such as account and billing notices
• Legal compliance: Meeting our legal and regulatory obligations

We process your personal data based on the following legal grounds under the UK GDPR:

• Contract performance (Article 6(1)(b)): Processing necessary to deliver the SmadiDesk service to subscribing dental practices
• Legitimate interests (Article 6(1)(f)): Processing caller data to provide receptionist services on behalf of the dental practice; service improvement and fraud prevention
• Legal obligation (Article 6(1)(c)): Where we are required to retain data for tax, accounting, or legal purposes
• Consent (Article 6(1)(a)): Where applicable, such as for optional marketing communications

We share personal data with the following third-party service providers who process data on our behalf:

All third-party processors are bound by data processing agreements and are required to handle your data securely and in accordance with applicable data protection laws.

Some of our third-party processors are based outside the UK. Where personal data is transferred internationally, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner's Office
• Adequacy decisions by the UK government where applicable
• Binding corporate rules or other approved transfer mechanisms

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected:

• Account data: Cancelling a subscription, a late or failed payment, or service suspension does not automatically delete account data. To request account closure or exercise a data protection right, contact us at [email protected]. We will verify the request, assess what action applies, and respond under applicable law. Where deletion or return applies, we delete, return, or anonymise the relevant data, subject to the limited retention and backup treatment described below.
• Customer-call recordings: Scheduled for deletion once they are more than 90 days old
• Customer-call transcriptions and lead data: Handled as account data. Subscription cancellation does not automatically delete them; a closure, return, or erasure request is assessed as described above
• Public live voice demo: SmadiDesk application storage does not save demo audio or transcripts. The required ElevenLabs demo-agent configuration disables saved audio recordings and sets audio, transcript, and PII to 0-day scheduled deletion for new conversations. A separate provider readback must confirm those settings before the public demo is enabled. This is not ElevenLabs Enterprise Zero Retention Mode; ElevenLabs documents that deleted non-ZRM data may remain in backups for up to 30 days and that related debugging or moderation logs may be retained.
• Billing records: Some company-accounting and VAT records may need to be retained after the service ends to meet applicable record-keeping obligations. Applicable periods are commonly six years, but the period and start point depend on the record and circumstances; no single period applies to all billing or account data
• Technical logs: Retention depends on the log source and service provider. We assess those periods against security, reliability, fraud prevention, and applicable legal obligations rather than applying one blanket maximum to every log

Other data is retained only where applicable law requires it or for a documented, narrowly scoped legal hold. Data kept for those reasons is protected and restricted to that purpose, then deleted or anonymised when the requirement ends. Residual backup or service-provider copies may not be capable of immediate deletion and may remain subject to provider recovery or retention processes. We do not treat those copies as deleted until deletion or expiry is verified.

We implement appropriate technical and organisational measures to protect your personal data, including:

• Encryption of data in transit (TLS/SSL) and at rest
• Row-level security in our database ensuring strict data isolation between practices
• Regular security assessments and monitoring
• Access controls limiting data access to authorised personnel only
• Secure authentication with password hashing and session management

Under the UK GDPR, you have the following rights regarding your personal data:

• Right of access: Request a copy of the personal data we hold about you
• Right to rectification: Request correction of inaccurate or incomplete data
• Right to erasure: Request deletion of your personal data where there is no compelling reason for continued processing
• Right to restrict processing: Request that we limit how we use your data
• Right to data portability: Request the personal data you provided to us in a structured, commonly used, machine-readable format where the legal conditions for portability apply
• Right to object: Object to processing based on legitimate interests
• Rights related to automated decision-making: Our AI processes calls automatically but does not make decisions with significant legal effects on callers

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within one month.

Note for callers: If you have called a dental practice that uses SmadiDesk and wish to exercise your data rights, please contact the dental practice directly as they are the data controller for your call data.

Our website uses cookies and similar technologies. For full details on what cookies we use and how to manage them, please see our Cookie Policy.

SmadiDesk is a business-to-business service. Account creation, onboarding, and administration of the service are intended for dental practice staff and other authorised adult users, not children.

Where the service processes caller or patient data, including data relating to children, it does so on behalf of dental practices acting as data controllers, with SmadiDesk acting as data processor where applicable. Questions or requests about that data should usually be directed to the relevant dental practice.

So that we can tell dental practices about our service, we keep basic business contact information about UK dental practices and, where publicly listed, the people who run them: practice name and address, publicly listed phone number and email address, practice website, company registration details, and the published name and role of the practice owner or practice manager. We collect this from public sources: the NHS Find-a-Dentist directory, the Care Quality Commission register, Companies House, the General Dental Council public register, and practices' own websites. We do not collect patient information, and we do not buy marketing lists.

We use this information to contact practices about our service by post, telephone, or (for corporate subscribers) email. Our legal basis is our legitimate interest in marketing a relevant business service to the businesses it serves (UK GDPR Article 6(1)(f)). We have carried out and keep under review a legitimate interests assessment; you can request a summary via the contact details below. Our telephone marketing is screened against the TPS and CTPS registers.

If a practice shows no interest, we delete its record within 12 months of collection. If you ask us to stop contacting you, we keep the minimum needed (your contact point and the date) on a suppression list solely so that we never contact you again.

You can object to marketing at any time — tell us by any channel (or use the unsubscribe link in any email) and we will stop immediately; this right is absolute. You also have the rights described in Section 10, and we will respond to any request within one month. We share this information only with the service providers that host our systems and send our communications, under contracts that protect it. We never sell or share our contact lists for others' marketing.

We may update this Privacy Policy from time to time. We will notify registered users of material changes via email or through our platform. The "Last updated" date at the top of this page indicates when this policy was last revised.

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO):

We would appreciate the opportunity to address your concerns before you contact the ICO. Please reach out to us first at [email protected].

If you have any questions about this Privacy Policy or our data practices, please contact us: