Privacy Policy

1. Who we are and what this policy covers

Kaizo Ltd (“Kaizo”, “we”, “us”) provides software for dental practices in the United Kingdom. This policy explains how we handle personal data for which we are the data controller: the people who visit our website, enquire about or use Kaizo, and the staff of the dental practices we work with.

Kaizo also processes patient data (including health data) on behalf of dental practices. For that data the dental practice is the controller and Kaizo is its processor: we act only on the practice's documented instructions under a written data processing agreement, and we do not use patient data for our own purposes. If you are a patient, your rights are exercised through your dental practice; ask them for their own privacy notice.

2. The information we collect (as controller)

• Account and contact details: name, work email, phone number, job role and the practice you belong to.
• Business details: practice name, address and the settings you configure in Kaizo.
• Usage and technical data: pages used, actions taken, device and browser information, IP address, and security logs.
• Communications: messages you send us (support, demos, email) and our replies.
• Billing details: the information needed to invoice a practice (billing contact, plan).

3. Messages sent to practices on Instagram, Facebook and WhatsApp

When someone messages a dental practice through the practice's Instagram or Facebook account, Meta sends Kaizo the information needed to show that conversation to the practice: the message content, the sender's name and platform ID, the sender's profile picture, and message timestamps. When someone messages a practice's WhatsApp Business number, Meta sends Kaizo the message content, the sender's phone number, their WhatsApp profile name and message timestamps.

We use this information for one purpose: so that practice staff can read and reply to enquiries in Kaizo. Kaizo processes it on the practice's behalf, as its processor. We never use it for advertising, and we never sell it.

To have this data deleted, see our data deletion page: you can remove Kaizo from your Facebook or Instagram settings, or email privacy@kaizosystems.com.

4. Health and other special-category data

Patient records, clinical notes, consultation audio and phone call transcripts are special-category (health) data. Kaizo only ever processes these as a processor for a dental practice, under our data processing agreement with that practice. We do not sell this data, and we do not use it to train third parties' AI models for their own purposes.

If a practice switches on call recording for calls its staff make from Kaizo, the person called hears a notice that the call may be recorded before they are connected. The recording is transcribed and summarised, then deleted at Twilio. Kaizo keeps the transcript and summary, not the audio.

A practice can also switch on an AI phone receptionist. It is off unless the practice turns it on. It answers calls the practice cannot take, tells each caller at the start that it is an automated assistant and that the call is transcribed, never gives clinical advice, directs emergencies to 999 or NHS 111, and passes bookings and other requests to practice staff as tasks. Twilio turns the caller's speech into text and Kaizo's AI provider writes the replies. Kaizo keeps a transcript and summary of each call, and no audio.

5. Why we use your information and our lawful bases

• To provide and secure the service, and to administer accounts (performance of our contract with your practice).
• To respond to enquiries and provide support (our legitimate interests in running and improving Kaizo).
• To send service and security notices (legitimate interests / contract). Marketing emails, if any, are sent only where permitted and you can opt out at any time.
• To meet legal and regulatory obligations (legal obligation).

6. Who we share it with

We share personal data with the service providers (“subprocessors”) that help us run Kaizo. This includes hosting (Amazon Web Services, in the UK region), web hosting (Vercel, which carries traffic between your browser and Kaizo through the United States), phone calls and SMS (Twilio, which also turns speech into text and text into speech for the AI receptionist), messaging, email delivery, error monitoring and AI processing providers. We are putting written data processing agreements in place with each of them.

Our current subprocessors, what each one does and the data each one touches are listed on our subprocessors page. We may also disclose information where required by law, or to protect our rights, users or the public.

Practices that take patient card payments in Kaizo do so through Stripe, on the practice's own Stripe account. Card details are entered on Stripe's page and never reach Kaizo. Kaizo stores the amount, status and Stripe ids for each payment.

7. International transfers

Kaizo's own database and backups are held in the United Kingdom (Amazon Web Services, London region). Some of our providers are based in the United States and process the data they need for their part of the service, such as web traffic, messages, live phone calls, and the text and audio sent for AI processing. Our subprocessors page lists them. We are putting UK transfer safeguards (a UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses) in place with each of them.

8. How long we keep it

We keep personal data only for as long as we need it for the purposes above, or as required by law or our contracts. Account data is kept for the life of the account and a reasonable period afterwards. For patient data, consultation recordings are deleted 90 days after the clinical note is signed, and other patient data is kept while the practice uses Kaizo.

Kaizo does not keep phone call audio. Recordings of staff calls are deleted at Twilio once they have been transcribed, AI receptionist calls are not recorded as audio, and voicemail recordings stay with Twilio until the practice erases that patient's records. Call transcripts and summaries are kept while the practice uses Kaizo, and are removed when the practice erases a patient's records.

9. How we protect it

• Encryption in transit and at rest, including envelope encryption for sensitive fields and encrypted, backed-up databases.
• Multi-factor authentication, role-based access controls and per-practice data isolation.
• A tamper-evident audit trail of sensitive actions.
• Staff approval before any message the AI drafts is sent to a patient, or any booking or payment request it proposes goes ahead. The AI receptionist, if the practice switches it on, talks to callers live without a person checking each reply, so it works within fixed safety rules: it says it is automated, gives no clinical advice, sends emergencies to 999 or NHS 111, and books nothing itself.

10. Your rights

Under UK data protection law you have the right to access your personal data, to have it corrected or erased, to restrict or object to processing, to data portability, and to withdraw consent where we rely on it. To exercise these rights for data we control, email privacy@kaizosystems.com. If you are a patient, please contact your dental practice, which is the controller of your records.

You also have the right to complain to the UK Information Commissioner's Office at ico.org.uk, though we would welcome the chance to resolve your concern first.

11. Cookies

Kaizo uses only the cookies needed to sign you in and keep the service secure. See our Cookie Policy for details.

12. Children

Kaizo is a business tool used by dental practices and is not directed at children. Any patient information about a child is provided and controlled by the dental practice, not by us.

13. Changes to this policy

We may update this policy from time to time. We will change the “last updated” date above and, for material changes affecting our customers, give notice through the service or by email.

14. Contact us

For any privacy question, or to reach our data protection contact, email privacy@kaizosystems.com or write to Kaizo Ltd (company number 17266896), registered office 83 Langley Way, Watford, WD17 3FA, United Kingdom.