Privacy Policy

1. Introduction

This Privacy Policy outlines how Dev8 Labs collects, uses, and safeguards your personal data. Dev8 Labs ("we," "our," or "us") is a registered sole proprietorship based in India. For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data (Use and Access) Act (DUAA), Dev8 Labs operates as the Data Controller.

Because Dev8 Labs is established outside of the United Kingdom but processes the personal data of UK residents, we have appointed Dev8 Labs to act as our UK Representative under Article 27 of the UK GDPR. You may contact our UK Representative regarding matters pertaining to this policy at: 123 High Holborn, London, WC1V 6QH, United Kingdom | hello@dev8labs.co.uk.

By utilizing this website, engaging our done-for-you dental review management services, or interacting with our digital assets, you acknowledge the data practices described herein.

2. Information We Collect

We may collect and process the following categories of data from you:

• Personal Identification Information: Name, clinical position, dental practice name, email address, phone number, and business details provided voluntarily via contact forms, scheduling software, or service onboarding.
• Financial Data: Processed securely via our designated international payment gateway infrastructure (including Razorpay). We do not store sensitive payment details (such as full credit card numbers) on our systems; we retain only transactional references necessary to manage your agency subscription or retainers.
• Technical Data: IP address, geographic location, browser type and version, time zone setting, operating system, and hardware platform.
• Usage Data: Detailed metrics regarding how you interact with our website, marketing funnels, and performance optimization pages, aggregated via privacy-compliant ad tech infrastructure.

3. How We Use Your Information

We process your personal data under the lawful bases of Contractual Necessity and Legitimate Interests for the following clear business purposes:

• Service Delivery: To deliver our done-for-you, GDC-compliant Google Business Profile review monitoring, response drafting, and publishing service for your dental practice.
• Financial Management: To securely execute transaction reporting, invoicing, and cross-border accounting compliance.
• Campaign Optimization: To refine our corporate acquisition strategies and deliver hyper-relevant B2B advertising via tailored ad tech integrations.
• Client Communications: To distribute performance updates, technical support logs, and critical operational notifications.
• Regulatory Compliance: To satisfy global legal frameworks, counter fraud, and enforce our core structural terms.

Data Retention Periods: We do not hold data indefinitely.

• Patient Review Invitation Lists (CSV): Patient contact details provided by dental practice clients strictly for review invitation dispatch are permanently purged from all active systems within fourteen (14) days.
• General marketing inquiries and unverified leads are purged after 12 months of inactivity.
• Active client business data, invoicing records, and contract logs are retained for the duration of the commercial contract, plus a period of 6 years following termination to satisfy statutory tax and accounting requirements.

4. Strict Prohibition on Special Category Data & Zero Direct PMS Access

As a B2B dental review management service, Dev8 Labs strictly prohibits the collection, storage, or processing of Special Category Data (including patient clinical records, medical histories, dental charts, or biometric data) in strict accordance with Article 9 of the UK GDPR and the Data Protection Act 2018 (DPA 2018).

Zero Direct PMS Access Guarantee: Dev8 Labs operates exclusively via public review feeds and secure practice-initiated CSV contact uploads. We maintain zero direct database integrations, API bridges, or administrative credentials to internal practice Patient Management Systems (PMS, including Dentally and Software of Excellence).

Our website and review request systems are designed exclusively to process non-sensitive contact details. Practices must not upload clinical notes or treatment data. Any inadvertent transmission of health data will be immediately and securely erased upon discovery, prioritizing data minimization principles.

5. Third-Party Disclosures & International Transfers

We do not sell, trade, or otherwise market your personally identifiable information to external brokers. Data is shared exclusively with verified operational partners integral to delivering our services:

• Payment Infrastructure Providers: Such as Razorpay, for secure cross-border currency settlement and billing operations.
• Infrastructure, Database & Cloud Hosting Partners: Including Cloudflare and Google (for secure network routing, encrypted database storage, and system diagnostics).
• AI-Assisted Language Processing Infrastructure: We utilize secure cloud AI language providers to assist our team in generating professional, GDC-compliant response templates to publicly posted Google reviews. These enterprise providers process data under strict confidentiality terms and do not use submitted review text to train public AI models.

International Data Safeguards: Because Dev8 Labs operates internationally, personal data collected within the United Kingdom will be securely transferred to and processed within our administrative offices in India. To guarantee your information receives a level of protection equivalent to UK statutory requirements, all intra-entity processing relies on robust technical barriers and the formal UK International Data Transfer Agreement (IDTA).

6. Data Security

We maintain a highly secure multi-tenant network layer. Our underlying stack utilizes encrypted database communication protocols, strict access-control layers, and regular security audits to maintain strict data confidentiality and integrity across all cross-border digital workflows.

7. Cookies and Consent Management

This website implements a dedicated Cookie Consent framework in accordance with the Privacy and Electronic Communications Regulations (PECR). Non-essential tracking scripts—including advanced marketing and personalization pixels—are strictly governed by your browser inputs. No tracking identifiers or marketing cookies are initiated or stored without explicit user opt-in via our frontend consent banner.

For a detailed, dynamically updated list of all cookies used on this site, please review our Cookie Policy.

8. Direct Client Communications via WhatsApp and Email

If you choose to communicate with our team via WhatsApp or email for onboarding, customer support, or review approval notifications, the following processing rules apply:

• Data Captured: We process your contact name, business phone number, email address, and the timestamped message text exchanged during support or review approval workflows.
• Operational Execution: This data is processed solely to provide customer support, deliver operational review alerts, and coordinate review approvals.
• No Unsolicited Marketing: We never use your WhatsApp contact details for unsolicited marketing broadcasts or share them with third-party marketers.

9. Your Privacy Rights

Under UK data protection laws (UK GDPR & DPA 2018), you have full control over your personal data, including the right to:

• Access & Portability: Request a copy of the personal information we hold about you.
• Correction & Deletion: Ask us to correct inaccurate details or permanently delete your data.
• Restrict & Object: Limit or object to how we process your information.
• Withdraw Consent: Opt out or withdraw your consent at any time without penalty.

To exercise any of your statutory rights, simply email us at hello@dev8labs.co.uk. We respond to all requests within one calendar month free of charge.

10. Data Deletion & Erasure Requests

To request the permanent removal of your communication history, practice contact information, or review records:

• Email your deletion request to hello@dev8labs.co.uk specifying your name, practice name, and registered email address.
• Our engineering team will securely purge all identifiable records from our active production systems within seven (7) business days and provide written confirmation.

11. Contact Us & Supervisory Authority

For any inquiries regarding this policy, corporate data processing safeguards, or our operational structure, contact us at:

You also maintain the right to lodge a complaint with the UK supervisory authority, the Information Commissioner's Office (ICO), at ico.org.uk (Registration: ZC209448) or by calling 0303 123 1113.