Privacy policy

Nodus is run by Nodus Studios, a sole trader based in Liskeard, Cornwall, UK (“we”, “us”). We set up and run AI assistants that answer missed calls, website chat and messages for dental practices and private clinics (“clients”). This policy explains what personal data we handle, why, how long we keep it and your rights. Contact: tommy@nodusstudios.co.

Our two roles

• Controller for our own business contacts: practice owners and staff who enquire, sign up or use the dashboard, and visitors to nodusstudios.co.
• Processor for the patients and other people who call, text or chat with our clients (“end users”). The client is the controller of that data and decides how it is used; we act only on their instructions under our data processing agreement. If you contacted a practice, that practice's privacy notice applies, and you should contact them first.

What we collect

• Enquiries and accounts: your name, practice name, email, phone number, the plan you're interested in, your practice software, and what you tell us on calls and emails.
• Billing: handled by Stripe. We see your name, email, plan and payment status, never your full card details.
• For clients (as processor): callers' phone numbers, messages and chat transcripts, names and contact details, appointment details, and patient lists the client uploads.
• Health information: patients sometimes mention symptoms or treatments in messages. This is special category data. We process it only as the client's processor, to pass the message on and hand clinical questions to their team. The client relies on its own lawful basis and Article 9 condition. We never use it for any other purpose.
• Technical: IP address, browser type, security logs, and the cookies and browser storage described in our cookies policy.

Why we use it (lawful basis, for data we control)

• To reply to your enquiry and provide the service you sign up for (contract, or steps before one).
• To keep the service secure, prevent abuse and improve it (legitimate interests).
• To keep tax and accounting records (legal obligation).
• To send occasional news about the service to business contacts (legitimate interests, or consent where the law needs it). You can opt out at any time.

AI and automated replies

Messages are sent to an AI provider to draft replies, which are checked against the client's rules before they are sent. The assistant says it is automated if asked and offers a person; it never gives clinical advice. It doesn't make decisions that have legal or similarly significant effects on anyone. We don't use client or patient data to train AI models, and we use provider settings that opt out of training wherever they exist.

Instagram and Facebook Messenger

If a practice connects its Facebook Page or Instagram professional account, Meta sends us, through Meta's official tools and only with the practice's permission:

• messages people send to that Page or account, and our replies;
• the sender's Page-scoped ID and, where Meta provides it, their name;
• the Page and Instagram account IDs and names, and an access token (stored encrypted).

We use this only to read and reply to those messages on the practice's behalf, and to show the conversation to the practice in their dashboard. We reply only within Meta's 24-hour messaging window. We don't use Meta data for advertising, profiling or AI training, and we never sell it or share it beyond the providers listed below. The practice can disconnect at any time, which stops all access. To have messages deleted, see data deletion; removing our app in your Facebook settings also deletes them automatically.

Who we share it with

Only these service providers, each under a contract that protects the data:

We may also share data where the law requires it, or with professional advisers (such as an accountant or solicitor) under a duty of confidence. We never sell personal data.

International transfers

Some providers are outside the UK. Transfers are protected by UK adequacy regulations, or by the UK International Data Transfer Agreement or Addendum.

How we keep it safe

Encryption in transit, encrypted storage of connected-account tokens, each client's data kept separate, access limited to the people who need it, and secret keys held only by our hosting provider. No system is perfectly secure; if a breach affects your data we will tell you and the ICO where the law requires.

How long we keep it

• Enquiries that don't become clients: up to 2 years, then deleted.
• Client and patient data: for as long as the client uses the service, or less if they delete it. When a client leaves, we delete it within 30 days, and from backups within 90 days.
• Invoices and accounting records: 6 years, as HMRC requires.

Children

The service is for businesses and isn't aimed at children. Where a practice's patients are under 16, the practice is responsible for the data as controller.

Your rights

You can ask to see, correct or delete your data, restrict or object to its use, and receive a copy to move elsewhere. Email tommy@nodusstudios.co; we reply within one month. If you contacted a practice, ask them first and we'll help them respond. You can complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113), though we'd appreciate the chance to put things right first.

Cookies and analytics

We use the cookies and browser storage the site needs to work. If you accept analytics cookies in our cookie banner, we also use Google Analytics to see which pages of our website are visited; the lawful basis is your consent, which you can withdraw any time with “Cookie settings” at the bottom of every page. Google processes this data for us and may store it in the USA (covered by the UK–US data bridge). We shorten IP addresses and never use analytics for advertising. See our cookies policy.

Changes

We'll update this page when things change, and show the date at the top.