Legal
Privacy policy
Last updated: 28 September 2026
In short: dental practices use Sage Connect to message their own patients on WhatsApp. The practice decides what happens to its patients' data; we store and process it only to deliver that service. We never sell data or use it for advertising.
1. Who we are
Sage Connect is operated by SAGGE CORE GROUP LIMITED, a company registered in England and Wales (company number 17245215), registered office 89–91 South Road, Southall, England, UB1 1SQ (“Sage Connect”, “we”, “us”).
Contact us about privacy at support@sageconnect.co.uk or by post at the address above.
2. Our role
Sage Connect is a software platform that lets dental practices send and receive WhatsApp messages with their patients through Meta's WhatsApp Business Platform.
- For patient data, the dental practice is the data controller and Sage Connect is a data processor. We process patient data only on the practice's documented instructions, under a data processing agreement with each practice.
- For practice staff account data and people who contact us directly (for example to book a demo), Sage Connect is the data controller.
If you are a patient, please contact your dental practice first about how it uses your information. We will help the practice respond.
3. Data we process
| Who | Data |
|---|---|
| Patients of a practice | Name, WhatsApp phone number, optional email and notes added by the practice, opt-in source, message content (text and media) sent to or from the practice, message timestamps, delivery and read status. |
| Practice staff | Name, work email address, role, hashed password, login and activity records (for example which staff member sent a message). |
| Practices | Practice name and address, WhatsApp Business Account ID, phone number ID, message templates, messaging usage and cost reported by Meta, and encrypted WhatsApp access tokens. |
| Enquiries | Name, email, phone number and anything you tell us when you contact us. |
Patients sometimes mention health information in their messages (for example about an appointment or treatment). This is special category data. We ask practices not to give clinical advice or discuss medication over WhatsApp, and to keep such exchanges to a minimum.
4. Where the data comes from
- From the dental practice, when staff add or upload patient details.
- From Meta's WhatsApp Business Platform, when a patient sends a message to the practice's WhatsApp number, and when Meta reports delivery status, template approvals and usage.
- From you directly, when you use Sage Connect as a staff member or contact us.
5. How we use it
- To deliver messages between practices and their patients and show conversations in the practice's inbox.
- To send approved message templates (such as appointment reminders and confirmations) when practice staff ask us to.
- To send an automatic acknowledgement when a patient starts a new conversation, if the practice turns this on.
- To create and submit message templates to Meta for approval, and to show their status.
- To provide reports and usage information to the practice.
- To manage staff accounts, keep the service secure, provide support and meet our legal obligations.
We do not sell personal data, use it for advertising or profiling, share it with data brokers, or use message content to train AI models. We never message people who are not patients of the practice.
6. Lawful basis
- Patient data: the practice decides the lawful basis for contacting its patients (usually legitimate interests or performance of a contract for appointment communications, and consent for WhatsApp contact). For any health information, the practice relies on the provision of health care under UK GDPR Article 9(2)(h). We process it as the practice's processor.
- Staff account data: performance of our contract with the practice, and our legitimate interest in running a secure service.
- Enquiries: our legitimate interest in responding to you.
7. Who we share data with
We use a small number of service providers (sub-processors) to run Sage Connect. Each is bound by a contract that protects your data.
| Provider | Purpose | Location |
|---|---|---|
| Meta Platforms (WhatsApp Business Platform, Cloud API) | Sending and receiving WhatsApp messages, template approval | Global, including the USA |
| Supabase | Database hosting | Frankfurt, Germany (EU) |
| Vercel | Application hosting | Global edge network, including the USA |
| Our email delivery provider | Staff invitation emails (no patient data) | UK / EU / USA |
We may also disclose data if the law requires it. We review any request from a public authority for legality, challenge requests we consider unlawful, and disclose only the minimum required.
8. International transfers
Our main database is in the EU, which the UK recognises as providing adequate protection. Where a provider processes data outside the UK or EU (for example Meta or Vercel in the USA), we rely on the UK Extension to the EU–US Data Privacy Framework where the provider is certified, or on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.
9. How long we keep data
- Patient records and messages are kept for as long as the practice keeps them in Sage Connect. Practices can erase a patient's data at any time.
- When a practice leaves Sage Connect, we delete its data within 90 days, unless the practice asks us to return it first or the law requires us to keep it.
- Staff account data is deleted when the account is removed, apart from activity records kept with the practice's message history.
- Enquiries are kept for up to 2 years.
10. Security
- All data is encrypted in transit (HTTPS/TLS).
- WhatsApp access tokens are encrypted at rest with a separate encryption key.
- Each staff member has their own login; passwords are hashed, and sessions expire after two hours.
- Each practice can only see its own patients and conversations.
- Access to production systems is limited to a small number of authorised Sage Connect staff, for support and maintenance only.
11. Your rights
Under UK GDPR you have the right to access your data, have it corrected or erased, restrict or object to its processing, and receive it in a portable format. You can withdraw consent at any time; for WhatsApp messages, you can also simply reply to the practice asking it to stop, or block the number.
Patients: please contact your dental practice, which controls your data. It can export your full conversation history or erase your data in Sage Connect. You can also email us and we will pass your request to the practice without delay.
Staff and enquirers: email support@sageconnect.co.uk. We respond within one month.
You can complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113. We'd appreciate the chance to help first.
12. Data deletion
See our data deletion instructions for how to have your data removed from Sage Connect.
13. Cookies
This website does not use advertising or analytics cookies. The Sage Connect app uses a strictly necessary session cookie to keep staff signed in.
14. Changes to this policy
We will update this page if our practices change and show the new date at the top. We will tell practices directly about significant changes.