DentalX Back to home

United Kingdom Annex

ANX-UK · Draft of October 6, 2026 · revision 1 · version 1.0

Final draft for counsel's review. It is not in effect, and no clinic has accepted it. Items still to be confirmed are highlighted in the text.

This is the controlling text.

SHA-256 of this text: 435812919ee0d03bfbbc394dd26f898ff5b26b30ee9231772b069f3e64c0124b

PART II — ANX-UK: UK Annex

1. Relationship to the MDPA

This Annex adds to the MDPA for UK Clinics. It ranks as a Country Annex under MDPA clause 19.

2. Representative in the United Kingdom

  • Appointment. VstreamX has appointed a representative in the United Kingdom under Article 27 of the UK GDPR, for the processing in which VstreamX is itself subject to the UK GDPR (Account Data). The representative is [[TO CONFIRM: name, address and email of the UK Art. 27 representative]].
  • When it acts. The representative may be addressed by the Information Commissioner and by data subjects on all issues related to that processing.
  • No change to roles. Its appointment does not change the roles in MDPA clause 1.2.

3. Personal Data Breaches

  • The clock. MDPA clause 9 applies. VstreamX gives its initial notice within 24 hours of establishing that a Personal Data Breach affects Clinic Data. This allows the Clinic to meet its own 72-hour duty to the Information Commissioner under UK GDPR Article 33.
  • NHS practices. For an NHS practice, VstreamX's notice includes the information the practice needs to report through the Data Security and Protection Toolkit incident tool.

4. Complaints handling

VstreamX assists the Clinic, as MDPA clause 8 provides, in handling complaints made to the Clinic by data subjects under section 164A of the Data Protection Act 2018 (inserted by section 103 of the Data (Use and Access) Act 2025). This includes:

  • (a) providing, within 5 business days of the Clinic's request, the information VstreamX holds that the Clinic needs to investigate the complaint; and
  • (b) the Service's complaints-intake feature, which lets the Clinic acknowledge a complaint within 30 days. [[TO CONFIRM: release date of the complaints-intake feature]]

5. Artificial intelligence

  • No training. MDPA clause 4.2(c) applies. Clinic Data is never used to train, fine-tune or evaluate any AI model.
  • No AI radiograph analysis. It is not offered to UK Clinics, because it has not been classified or registered as software as a medical device with the MHRA.
  • Labelling. AI output is labelled as AI-generated.

6. Prescriptions

Prescriptions produced by DentalX are printed or emailed records. They are not electronic prescriptions meeting regulation 219 of the Human Medicines Regulations 2012 (advanced electronic signature). Where the Service shows a prescription, it says so.

7. Retention support

  • No auto-deletion. DentalX does not auto-delete clinical records.
  • Defaults by nation. The retention defaults offered follow the Clinic's nation (England 11 years for adults and to the 25th birthday for children, or the 26th if 17 when treatment ended; Scotland 10 years; Northern Ireland 10 years for private care; Wales as the Welsh schedule provides [[TO CONFIRM: Wales retention period]]). The Clinic may change them as MDPA clause 15 allows.
  • Record versions. For English Clinics, VstreamX keeps the version history of clinical records needed to evidence them for the 11-year period. It does so for as long as the Clinic keeps the record.

8. NHS practices

Where the Clinic records at signup that it provides NHS dental services:

  • (a) Assurance pack. VstreamX provides the NHS assurance pack: answers mapped to the Data Security and Protection Toolkit; this Annex and TM-UK with the transfer risk assessment; a Senior Information Risk Owner sign-off template for NHS England's guidance on offshoring and the use of public cloud services; and the MDPA Schedule 2 security summary [[TO CONFIRM: current NHS England offshoring guidance reference and date]];
  • (b) DPO. The Clinic records its data protection officer in the Service before patient data is entered; and
  • (c) NHS obligations. VstreamX cooperates with any assurance the NHS commissioner requires of the Clinic, under MDPA clause 12.

9. Information Commissioner's fee

VstreamX pays any data protection fee the Data Protection (Charges and Information) Regulations 2018 require of it. [[TO CONFIRM: ICO's answer on whether a controller not established in the UK must pay, or VstreamX's decision to pay voluntarily]]

10. Governing law and courts for this Annex

This Annex and the Addendum are governed by the laws of England and Wales. The courts of England and Wales have jurisdiction over disputes under them, without prejudice to a data subject's rights under the Addendum. In all other respects, MDPA clause 23 applies.

11. Key terms (UK)

Before acceptance, the Service shows the Clinic the highlighted UK key-terms box defined in acceptance.md § 5.2. It sits above the checkbox, and brings to the Clinic's attention, with a link to each, every term of the Terms, the MDPA and this Annex that is onerous or unusual:

  • the liability cap and exclusions, and their exceptions (Terms s. 18; MDPA clause 17);
  • the Clinic's indemnities (Terms s. 19; MDPA clause 17.4);
  • the audit limits (MDPA clause 12.2);
  • VstreamX's rights to suspend the Service (Terms s. 12) and to restrict patient features when a new version is not accepted (MDPA clause 18.3(c));
  • automatic renewal, price changes and non-refundable fees (Terms s. 11);
  • unilateral changes to the Terms and the MDPA (Terms s. 21; MDPA clause 18);
  • governing law and courts (Terms s. 23; MDPA clause 23; this Annex § 10); and
  • the sub-processor change process (MDPA clause 7).

[[TO CONFIRM: UK counsel's assessment of the liability cap's reasonableness under the Unfair Contract Terms Act 1977, ss. 3 and 11 (Part II in Scotland), including for losses from a Personal Data Breach]]

Items to confirm before publication (UK)

  1. Publication date.
  2. Both UK Extension (UK-US data bridge) listings verified live (Part I §1.3).
  3. Embedding of the ICO's official Mandatory Clauses text (Part I §1.4).
  4. The transfer risk assessment, dated and signed off under the post-DUAA "data protection test" (Part I §1.5).
  5. The Manitoba corporation number of VstreamX Studio Inc. (Table 1).
  6. Name, address and email of the UK Article 27 representative (Table 1; Part II §2).
  7. Counsel's choice for Table 4 ("Neither Party" or "Importer").
  8. Release date of the complaints-intake feature (Part II §4).
  9. The Welsh retention period (Part II §7).
  10. The current NHS England offshoring and public-cloud guidance reference (Part II §8).
  11. The ICO data protection fee position for VstreamX (Part II §9).
  12. UK counsel's assessment of the liability cap under the Unfair Contract Terms Act 1977 (Part II §11).