Privacy notice.

1. Who we are

Lo Smiles (“we,” “us,” “our”) refers to LO SMILES UK LTD, a UK-registered company (Companies House 16629048, incorporated 5 August 2025) operating a dental hospital in Antalya, Turkey under licence of the Republic of Türkiye Ministry of Health. Our UK consultation address is Suite 2A, 72 Bridge Street, Manchester, M3 2RJ. Our Antalya hospital is in Güzeloba mah. Yaşar Sobutay Bulv. No: 115, Antalya. We are the data controller for the personal information you provide to us.

2. What we collect

We collect:

• Identification & contact data — name, email, mobile, address, date of birth.
• Health data — your dental and medical history, photographs of your teeth or smile, treatment preferences, medications, allergies, and anything else relevant to clinical safety. This is “special category data” under Article 9 of the UK GDPR.
• Treatment data — case notes, treatment plans, materials used, photographs taken in clinic, dentist names, appointment records.
• Financial data — payment information, finance application data routed to our regulated finance partner.
• Communications data — emails, WhatsApp messages, call recordings (where consented), enquiry form submissions.
• Technical data — IP address, device, browser, pages visited (where you have consented to non-essential cookies).

3. Lawful basis for processing

For ordinary personal data we rely on (a) contract (where processing is necessary to deliver care) and (b) legitimate interest (where we need to operate our service safely and reasonably). For health data we rely on (a) your explicit consent (Article 9(2)(a)) for marketing-related uses including the smile preview tool and (b) provision of health or social care (Article 9(2)(h)) where the processing is necessary for actual treatment.

4. The smile preview tool

If you upload a photograph to the smile preview tool, you are submitting biometric data — special category data under Article 9. We will use it only to generate an indicative simulation and to match a similar case study from our results library, then send these to your email and (if you ask us to) prepare a coordinator follow-up. We delete uploaded photographs within 30 days unless you book a consultation. If you book a consultation, the photograph is retained as part of your case file for the duration of treatment plus 8 years (the UK retention norm for clinical records).

5. The influencer programme

If you participate in any Lo Smiles influencer or content partnership, the use, scope, and disclosure obligations of any content produced under that arrangement are governed by a separate participation agreement. Your obligations under the CMA Influencer Code (including the requirement to disclose paid or gifted partnerships using #ad or equivalent) sit alongside this notice.

6. Sharing your data

We share your data with: our clinical team in Antalya (under a Data Processing Agreement); our UK consulting dentists (under their own GDC obligations); our regulated finance partner (only where you apply for finance); our hosting and infrastructure providers (all contractually bound under DPAs); our reviews provider (Google, where you choose to leave a review on our Google Business Profile); and law enforcement or regulators where required.

We do not sell your data to anyone, ever.

7. International transfers

Your treatment necessarily involves transfer of personal data to our Antalya hospital in Turkey. Turkey is recognised as offering an adequate level of protection in some contexts; however, we additionally rely on Standard Contractual Clauses (UK Addendum) and a Transfer Risk Assessment to govern this transfer. A copy of the SCCs in force is available on request to customer@losmiles.uk.

8. Retention

Clinical records are retained for the duration of care plus 8 years from the last entry (UK norm). Finance records are retained for 7 years (HMRC). Marketing data (where consented) is retained until you withdraw consent. Smile preview photographs are deleted within 30 days unless you book a consultation.

9. Your rights

You have the right to: access your data; correct it; have it erased (where consistent with our clinical retention obligations); restrict its processing; object to processing; receive it in a portable format; and lodge a complaint with the Information Commissioner’s Office (ico.org.uk).

To exercise any of these rights, email our Data Protection Officer at customer@losmiles.uk. We will respond within one calendar month.

10. Security

All clinical data is encrypted in transit (TLS 1.3) and at rest (AES-256). Form submissions are protected with Cloudflare Turnstile against automated abuse. Access to clinical records is role-controlled and audit-logged.

11. Updates

We update this notice when our practices change. The version and date at the top of the page tell you the current state. Material changes are notified by email to existing patients.