Privacy Policy

01Who we are

ExoLink is a product of Exodent Ltd, registered in England & Wales. Exodent Ltd is the controller of personal data collected through applications, contact forms and account administration.

02What we collect

Application details: business name, contact name, registration number (GDC or MHRA), address, email, phone, scanners, products, capacity, and any certificates you upload.

Account data: email address, role, and a securely hashed password. We never store or email plain-text passwords.

Messages you send through the contact form, and technical logs needed to keep the service secure.

03Why we use it

To assess and approve applications, create and secure accounts, respond to enquiries, and operate the service. Our lawful bases are legitimate interests and, once an account exists, performance of our agreement with you.

04Patient data

ExoLink is designed around data minimisation: cases use a patient reference rather than a full patient name. Where clinics send patient-related data, the Data Processing Agreement applies.

05Sharing

We share data only with providers that help us run ExoLink, such as email delivery and secure storage, and with labs only to the extent needed to make a case. Lab locations are never disclosed to clinics or the public.

06Retention and security

Uploaded certificates are held in private storage and accessed through short-lived signed links by authorised administrators. Sessions expire. We keep an audit log of administrative actions.

07Cookies

We use essential cookies to keep you signed in. No analytics are active. If added, they will run only with your consent.

08Your rights

Under UK GDPR you may request access, correction, deletion, restriction, portability, and object to processing. You may complain to the Information Commissioner's Office.