Notice for patients of practices that use Chairfill
Agent-reviewed draft. Not legal advice and not in force until signed. A professional legal review is recommended once revenue allows.
Who is responsible for your data
Your dental practice is the data controller. Its legal name, address and contact for data requests are in the practice's own patient notice. This page explains the part Chairfill plays. It is for patients of practices that use Chairfill.
How your practice uses text messages and its scheduling tool
Your practice uses a service called Chairfill, made by Turstone Ltd, to help manage appointments. It sends you text messages (SMS):
- reminders about your appointment, with a link to confirm or cancel;
- a message when you are due a check-up (recall);
- if you asked to be on the practice's waitlist, an offer when an earlier appointment becomes free;
- if your practice uses reviews, after a visit, a message with a link to review the practice on Google. It is your choice whether to write one; the practice never writes, edits or chooses reviews, and offers nothing in return;
- if your practice uses payments, a payment request when it asks for a deposit or charges a fee, with a link to a payment page run by Stripe.
If you contact your practice
If your practice uses the booking page and you ask for an appointment on its booking-request page, it keeps your first name, your mobile number and the days and times you prefer, to call or text you back; nothing is booked by the page. If your practice uses the inbox and you text the number it uses, it receives your message and replies from Chairfill; please do not send clinical or urgent details by text, phone the practice instead. The text you send is stored securely and deleted after 90 days.
If you ask your practice to use WhatsApp
If your practice uses WhatsApp, then only if you ask it to, it sends these messages on WhatsApp instead of by text. WhatsApp is run by WhatsApp Ireland Limited, which passes the messages to WhatsApp LLC and Meta Platforms, Inc. in the United States. To go back to SMS, use the link in any of the practice's texts. Reply STOP to stop all texts.
If you pay your practice through a link
If your practice uses payments, you pay on a page run by Stripe, into the practice's own Stripe account. The practice is the merchant. Chairfill and Turstone never hold your money and never see your card number; Stripe may keep its own records under its own privacy notice.
What it uses
Your first name and the first letter of your surname, your mobile number, your email address, your last visit date and your appointment times. It never receives treatment details, the reason for your visit, notes or medical history. If the practice connects its calendar, appointment titles and descriptions are never stored.
Why your practice may do this
Your practice states its lawful basis in its own patient notice. Waitlist offers rest on your consent. WhatsApp rests on your consent. A payment request rests on the practice's agreement with you.
Who handles it
Chairfill processes this data for your practice, in the EU. Text messages are sent and received through the text-message provider in Ireland (the carriers that deliver them may handle them elsewhere). Chairfill's providers are listed on the sub-processor page. Some of the providers belong to groups based in the United States; where data could be accessed from there, the practice relies on Standard Contractual Clauses and the provider's EU data-protection commitments. If an agency helped your practice set this up, it acted for the practice and under the practice's agreement with it.
Opting out
Every text has a link to opt out at any time. If you opt out, all texts from your practice to that mobile number stop. You can also tell the practice.
How long
Your contact details and appointment times are deleted from Chairfill if they have not been seen in the practice's records or imports for 90 days, and in any case when the practice stops using the service. The text of a message, including one you send, is kept for 90 days, and a record that a message was sent (without its text) for 24 months. A record that the practice asked you for a review is kept for 365 days; a booking request for 90 days after it is dealt with; a payment request for 24 months, with its Stripe reference removed after 180 days; a note that you agreed to WhatsApp until 24 months after you withdraw it (or the practice cannot reach you on WhatsApp), or until the practice stops using the service.
Your rights
You can ask your practice for a copy of your data, to correct it, to delete it, to restrict its use, and to object to it. Where the practice relies on your consent (waitlist offers), you can withdraw it at any time. You can complain to the Data Protection Commission (dataprotection.ie). Contact your practice using the contact in its own patient notice. If you write to Turstone at privacy@turstone.com about your patient data, Turstone passes your request to your practice without undue delay and does not answer it itself.
People who sign in to Chairfill
If you are a practice owner, staff member or agency user, see Turstone's privacy notice.