In force from 29 October 2026 · written under the law of the United Kingdom
Ivorwyn is made by a dental practice, and that creates one risk worth addressing before
anything else: people reasonably assume an app from their dentist can see what the dentist can see.
It cannot, and this notice is built as the wall between the two. Ten questions, each answered
twice — once for the app on your phone, once for the record held at the practice — with the gold line
down the middle marking the join that is never crossed.
In one sentence. This notice covers Ivorwyn Oral Care, a habit
and information app. It does not cover your dental record, your appointments, your x-rays or anything
else held at a 210 Dental Clinic practice — those are governed by the practice's own patient privacy
notice, which you can ask for at reception or by writing to
teeth@210dentalclinic.online.
01
Who is answerable for this?
The app · Ivorwyn
210 Dental Clinic, as the publisher of Ivorwyn Oral Care, is the data controller for anything the
app does. In practice that responsibility is small, for reasons question 02 explains.
The practice that treats you is the controller for your clinical record, and the dentist
responsible for your care answers for it.
Same company, different document, different obligations. Ask at reception for the patient privacy
notice.
02
What is actually written down?
The app · Ivorwyn
Only what you put there yourself, and it is written into the app's own storage area on your
phone, which Android keeps fenced off from other apps:
Ticks in the daily routine log — brushed, cleaned between the teeth — and the dates they fall on
The streak and calendar the app builds from those ticks
When you last recorded changing a brush or brush head
Your settings, and your answers in the myth quiz
The timer, the library, the map of the mouth and the glossary record nothing at all. Reading is
not logged.
The clinic · your record
Your name, contact details, medical history, charting, treatment, radiographs, payments and
correspondence — a substantial health record with statutory retention periods behind it.
None of it is visible to the app, and nothing the app holds is added to it.
03
Why is anyone allowed to hold it?
The app · Ivorwyn
The question barely arises, because the UK GDPR governs what a controller processes, and
a file that is written and read only on your own handset is not something we process. We never
receive it.
Where we do hold something — an e-mail you send us — the basis is our legitimate interest in
replying to our own post, under Article 6(1)(f).
The clinic · your record
A clinical record rests on quite different ground: Article 6(1)(c) and (f) for the record itself,
and Article 9(2)(h) for the health data within it — the provision of health care by or under the
responsibility of a professional bound by confidentiality.
04
Is a brushing log health data?
The app · Ivorwyn
We think it would be, if anyone held it. A dated record of whether a person cleaned their teeth
is information about their health and their habits, and under Article 9 that is special category
data with the strongest protection the Regulation offers.
So the honest position is this: we treat it as special category data, and we have
arranged not to hold it. The cheapest way to protect a category of data properly is not
to collect it.
The clinic · your record
Unambiguously yes, and handled as such — with confidentiality obligations on top of data
protection law, since dental records carry a professional duty of confidence as well as a
statutory one.
05
Who else can see it?
The app · Ivorwyn
Nobody. Not your dentist, not the hygienist, not the receptionist, and not us. There is no screen
anywhere in the practice that shows whether you have kept your streak, and no member of staff can
look it up.
If you want your dentist to see it, show them your phone. That is the only route, and it is
yours.
The clinic · your record
The clinical team involved in your care, and others only where the law or your consent allows —
a referral, a laboratory, an indemnity matter, an NHS or insurance claim.
The patient notice lists these properly. This one cannot, and should not try.
06
How long does it stay?
The app · Ivorwyn
As long as you leave the app installed, and not a moment longer. There is no retention schedule
here because there is nothing of yours in our keeping to schedule.
An e-mail you send us is kept while the matter is open and deleted when it closes.
The clinic · your record
Years, by law and by professional guidance, and not at the patient's discretion. Dental records
are retained long after treatment ends precisely so that they can be relied upon later.
07
How do I get it out, or get rid of it?
The app · Ivorwyn
Getting it out: open the app. It is all there, and it was never anywhere else.
Getting rid of it: Android Settings → Apps → Ivorwyn Oral Care → Storage → Clear
data, or uninstall. Your log, streaks and settings go with it. Nothing survives
elsewhere, so there is nothing to ask us to delete and no copy for us to miss.
The clinic · your record
A subject access request to the practice, in writing, answered within one month. Erasure, by
contrast, is largely not available for a clinical record — retention there is a legal
obligation, and Article 17(3) carves exactly that out.
08
What if a child is using it?
The app · Ivorwyn
Ivorwyn has a section built for children, with a two-minute timer of their own, so it is plainly
a service children will use. That brings the Information Commissioner's Age Appropriate
Design Code into play, and the design answers it the simplest way available: nothing is
collected, nothing is profiled, nothing is nudged, and there is no advertising to aim at anyone.
In the United Kingdom a child may consent for themselves to an information society service from
the age of 13, under section 9 of the Data Protection Act 2018. No consent is
sought here at any age, because there is nothing to consent to.
The clinic · your record
A child patient's record is held like any other, with parental responsibility and the child's own
developing capacity both bearing on who may see it and who may ask for it.
Those judgements are made at the practice, case by case.
09
What if something goes wrong?
The app · Ivorwyn
A personal data breach must be reported to the Information Commissioner within 72 hours where it
is likely to risk people's rights, and to the people affected where the risk is high.
The only thing we hold is correspondence, so that is what such a report could concern. Your
brushing log cannot leak from us; it can only leak from your phone, which is why the lock screen
on it matters more than anything on this page.
The clinic · your record
A far more serious proposition, and handled under the practice's own breach procedure. Health
data breaches sit at the high-risk end by default.
The Information Commissioner's Office takes complaints about any UK controller:
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, or
ico.org.uk.
The clinic · your record
The same ICO route for data matters. For the care itself, the practice's complaints procedure
comes first, and the General Dental Council regulates the professionals involved.
Your rights, and what each one would actually fetch
The UK GDPR and the Data Protection Act 2018 give you the following. They are yours whatever any page
says, which is why it is worth being straight about the result of exercising them against the
app — set out below — rather than letting the list imply a bigger holding than exists.
AccessArticle 15
Ask what we hold. Unless you have written to us, the answer is nothing, and you will get that in writing. Your log you can already read in full.
RectificationArticle 16
Correct an error. A routine log is edited where you made it; we have no record of you to put right.
ErasureArticle 17
Have it deleted. Clearing the app's data does it in two taps, without involving us. Correspondence goes on request.
RestrictionArticle 18
Have processing paused. There is no processing of yours running to pause.
PortabilityArticle 20
Receive your data in a machine-readable form. We hold no dataset of yours to hand over.
ObjectionArticle 21
Object to legitimate-interest processing or to direct marketing. The only legitimate interest claimed is answering your own message, and no marketing is sent.
Automated decisionsArticle 22
Not be subject to a decision made solely by machine. Nothing in Ivorwyn reaches any conclusion about you. A streak is a count, not a judgement.
Withdraw consentArticle 7(3)
Take back a consent. None was asked of you, which is why the app opens without a dialogue.
Against the practice, the same rights have real weight and will produce a real file —
that is where to aim them if what you want is your dental record. A request costs nothing and is
answered within a month.
What Ivorwyn is not
It is a habit tracker and a library. It shares general, publicly available information about looking
after teeth, of the kind the NHS publishes, and it is not a substitute for professional
care. It does not diagnose, does not monitor a condition, and makes no clinical claim about
your mouth.
Which matters most when something is wrong
If you have pain, swelling, bleeding that will not settle, or anything that worries you, contact a
dentist urgently or call NHS 111. Do not work through a library article and do not
wait for an e-mail reply. An app that quietly encouraged people to delay would be doing harm whatever
its privacy policy said, and that is a design question rather than a legal one.
And the page you are reading
No cookie is set here and no analytics script runs. One request does leave: the two typefaces are
served by Google Fonts, so your browser fetches them from Google and Google sees the address that
asked. That exchange is between you and Google, and nothing from it returns to us.
United Kingdom · UK GDPR and the Data Protection Act 2018
210 Dental Clinic is the publisher of Ivorwyn Oral Care on Google Play and the controller
for the app. The practice treating you is the controller for your clinical record, under a separate
patient privacy notice available at reception. No data protection officer has been appointed for the
app; privacy correspondence reaches the address above. Where this page summarises the UK GDPR or the
Data Protection Act 2018, the summary is for a reader's convenience — the legislation itself is what
governs.
Ten questions, each answered twice, and the gold line in the middle is the whole
document. An app from a dentist that could see your record would be a convenience; one that cannot is
a guarantee, and the second is worth more. If that ever stops being true, this page is rewritten before
the release that changes it reaches the store, and the date under the title moves with it. There is no
earlier version: this is the first.