Privacy policy
Who is responsible for your data, what we collect, where it is kept and how you can control it.
Who processes the data
The controller is Soul Dental OÜ, registry code 16030960, Lastekodu tn 35-18, 10113 Tallinn. The clinic operates under dental care licence L07244.
Questions and requests about your data: feedback@souldental.ee, +372 5885 7770.
What we collect
- Contact details: name, phone, e-mail, language of communication.
- Health data: symptoms, examination findings, images, treatment plan and its course — what a dentist is required to record.
- Appointment data: date, time, dentist, reason for the visit.
- Invoices and payment details, and Tervisekassa benefit data when treatment is covered.
- Whatever you wrote in the booking form yourself, including your comment and preferred time.
We do not ask for data we can do without, and we never ask you to send medical documents over unprotected channels.
Why, and on what legal basis
- Providing dental care and keeping records — a legal obligation; for health data, Article 9(2)(h) of the General Data Protection Regulation.
- Booking, reminders and staying in touch — performance of the treatment contract.
- Invoicing and accounting — a legal obligation.
- Handling enquiries and complaints, and defending the clinic in disputes — the clinic's legitimate interest.
- Website statistics — legitimate interest in knowing which pages are useful.
Where the data is stored
Medical records are kept in the Hammas system, supplied and maintained by Innovaatik OÜ (Estonia) under a contract with the clinic — as a processor acting only on our instructions.
The CRM holds only patient contact details and the dates of recent visits. No health data, images or treatment notes are stored there.
The website and the booking form are hosted on a server in the European Union.
We do not sell data and we do not pass it to third parties for advertising.
Who we share data with
- Tervisekassa — when treatment is covered by the health insurance fund.
- The dental laboratory — when a denture or crown is made, only as far as the work requires.
- Another dentist or clinic — on your referral or at your request.
- The clinic's insurer — when a claim for damages is being handled.
- Public authorities — where the clinic is required by law to hand data over.
How long we keep it
- Medical records — for the period set by the rules on documenting healthcare services: 30 years for outpatient records.
- Invoices and accounting documents — 7 years, as the Accounting Act requires.
- Contact details and visit dates — for as long as you are a patient of the clinic; deleted on request unless the law requires us to keep them longer.
- Booking requests that never became a visit — up to one year.
Your rights
- Find out what data we hold about you and get a copy of it.
- Have inaccurate data corrected.
- Restrict the processing or object to it.
- Withdraw consent where the processing rests on it.
- Receive your data in a machine-readable form.
- Ask for deletion — except for data we are required by law to keep.
Write to feedback@souldental.ee. We answer within one month. Before releasing anything we have to be sure the request comes from you — otherwise we risk handing health data to a stranger.
If you disagree with how we handle your data
Write to us first — feedback@souldental.ee. We will look into it and reply.
If our answer does not satisfy you, you may turn to the Estonian Data Protection Inspectorate: Andmekaitse Inspektsioon, Tatari 39, 10134 Tallinn, info@aki.ee, +372 627 4135.