Privacy notice & UK GDPR
Last updated: July 2026
Incydental Ltd (trading as Incydental Dental Laboratory) is the data controller for personal information processed through this portal and our laboratory workflow. We are committed to handling personal data lawfully, fairly and transparently under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Who we are
Incydental Ltd, company number 08355880, registered in England & Wales. Registered office and laboratory: Unit 12 Devonshire Business Park, 74 Eldon Street, Sheffield, S1 4GT, United Kingdom.
What data we collect
- Dental practice account data: practice name, billing address, contact names, email, mobile, landline, WhatsApp number.
- Case data: patient reference / initials, age, sex (where clinically relevant), tooth notation, lab prescription, clinical notes, shade and design parameters.
- Clinical files: STL/PLY intra-oral scans, photographs, X-rays, PDFs and other files uploaded by the prescribing dentist.
- Operational data: order status, technician assignment, dispatch and delivery records, invoicing and payment records.
- Technical data: authentication identifiers, IP address, device/browser information, audit logs for security and traceability.
Lawful basis
- Contract — to provide the laboratory service requested by the dental practice.
- Legal obligation — to comply with MHRA medical device regulations (UK MDR 2002 as amended), HMRC record keeping, and product traceability.
- Legitimate interests — to operate the portal securely, prevent fraud, and improve our service.
- Special category data (patient health data) is processed under Article 9(2)(h) UK GDPR — provision of health and dental care.
Patient data & the dentist relationship
For patient-identifiable clinical information, the prescribing dental practice is the data controller and Incydental Ltd acts as a data processor under a written agreement. The dentist is responsible for obtaining patient consent and providing privacy information to the patient. We minimise patient identifiers and recommend using a patient reference rather than full name where possible.
How long we keep data
Clinical records, prescriptions and device files are retained for a minimum of 11 years from the date of supply, in line with MHRA traceability requirements for custom-made medical devices and UK dental record-keeping guidance. Financial records are retained for 6 years for HMRC. Account data is retained while the account is active and for a reasonable period afterwards.
Sharing
We share data only with:
- Sub-processors providing hosting, authentication, email, payment processing and file storage, under written GDPR-compliant agreements.
- Couriers and postal services for dispatch.
- Regulators (MHRA, ICO, HMRC) where legally required.
We do not sell personal data. International transfers, where they occur, are protected by UK adequacy regulations or Standard Contractual Clauses.
Your rights
You have the right to access, rectify, erase, restrict or object to processing of your personal data, and the right to data portability. To exercise any right contact info@incydental.co.uk. You can complain to the Information Commissioner's Office at ico.org.uk or 0303 123 1113.
Security
The portal uses encryption in transit (TLS), encryption at rest for stored files, role-based access control, audit logging and least- privilege database policies. Access to patient files is restricted to the prescribing practice, the assigned technician, and laboratory administrators.
Contact
Privacy queries: info@incydental.co.uk
Director: joe@incydental.co.uk
Telephone: +44 (0)114 272 1392