1. In short: who is responsible for the data
If you booked with a business that uses OraSync, that business decides what happens to your data. We only process it on its behalf.
- For the data of website visitors, people who write to us and users of business accounts, the controller is Doimih Design S.R.L.. The details are in the Privacy notice.
- For the data of a business's clients (bookings, contact details, history), the controller is the business you booked with. OraSync is the processor, under the Data processing agreement.
2. Your rights
| Right | What it means |
|---|---|
| Access (art. 15) | You can find out whether we process data about you and get a copy of it. |
| Rectification (art. 16) | We correct inaccurate or incomplete data. |
| Erasure (art. 17) | We delete data when it is no longer needed, when you withdraw consent or when it was processed unlawfully, except data the law requires us to keep. |
| Restriction (art. 18) | We pause processing for a while, for example while we check a complaint. |
| Data portability (art. 20) | You receive the data you gave us in a structured, machine-readable format. |
| Objection (art. 21) | You can object to processing based on our legitimate interests. |
| Withdrawing consent (art. 7) | At any time, without affecting the processing done before. For cookies, use "Cookie settings". |
| Complaint (art. 77) | You can complain to the ICO at any time (section 5). |
3. How to use your rights
If you have an OraSync account, you can download your data and delete your account yourself from the Account page of the app, under "Your data". Deletion is immediate; the download is a JSON file you can also use with another service (portability).
For any other right, or if you have no account, write to [email protected] and tell us which right you want to use. If you have an account, please write from the email address linked to it.
- We reply within one month of receiving your request. For complex requests this can be extended by up to two further months; if so, we tell you within the first month.
- Using your rights is free. For requests that are manifestly unfounded or excessive, we may charge a reasonable fee or refuse, and explain why.
- If we have reasonable doubts about your identity, we may ask for more information, only as much as we need to identify you.
4. If you are a client of a business that uses OraSync
Please send your request directly to the business you booked with: it is the controller and decides about your data. Its contact details appear in the confirmation messages and on the booking page.
If you write to us, we pass your request to that business without delay and help it reply to you.
To stop receiving WhatsApp messages, reply "STOP" to any of them. Messages about later bookings will then be sent by email, where there is one.
6. For businesses: how OraSync helps you comply
- A data processing agreement (UK GDPR art. 28) included in the contract, with no separate negotiation: see the DPA.
- Data hosted in the European Union, which the UK recognises as adequate, with encrypted backups in a separate location.
- Strict isolation of each business's data, enforced in the database, not only in the application.
- Role-based access: each member of the team sees only the locations and data they need.
- An audit log: who created, changed or cancelled a booking, and when.
- Messages to clients only about their bookings, with a record of consent and opt-out by replying "STOP".
- Deleting a client's data on request, keeping only the records the law requires.
- Technical logs with no phone numbers and no message content.
For clinics and other businesses handling health data, the processing agreement includes measures for special category data. Remember that UK businesses processing personal data usually have to pay the annual data protection fee to the ICO.