Privacy notice · 2026-09-03-enquiry-v1
How your information is handled
This page describes the information used by the directory, patient enquiry flow and practice-owner workspace.
Who operates the service
TheJavaBoyz Ltd operates Highly Rated Dentists. Questions or privacy requests can be sent to [email protected]. The operator’s company details are on the Terms page.
Information we handle
- Patient enquiries: name, email address, administrative message, selected practice, notice version and submission time.
- Practice-owner access: email address, session, membership and claim records, profile changes, uploaded photos and audit events.
- Billing records: Stripe customer, subscription and payment references, status, dates, currency and amounts. Card details stay with Stripe.
- Technical information needed to operate and protect the service, including request data used for security and rate limiting.
How information is used and shared
Enquiry details are stored so the verified owner of the selected practice can read and answer the message. The notification email contains a secure inbox link, not the patient’s message. Account and profile information supports owner access, authorised editing and an audit trail. Billing information supports the Featured subscription, refunds and qualification credits.
Service providers include Stripe for billing, Resend for transactional email and Cloudflare for site delivery and owner-photo storage. We do not use your information for advertising.
Retention and security
Resolved enquiries receive a 90-day expiry and are removed by bounded cleanup runs. Payment-event records do not store raw Stripe payloads, and audit events for enquiries do not contain patient names, email addresses or message text. More detailed account and billing retention periods remain to be settled before launch.
Owner access uses a secure sign-in link and a necessary session cookie. We do not use advertising or analytics cookies.
Your choices
You can ask about information connected to you, request correction, or ask for deletion by emailing the contact above. Whether a request can be completed may depend on records that must be kept for security, audit, billing or other applicable obligations; that wording requires legal review before launch.