GDPR Compliance

Our GDPR posture in one paragraph

iDentiCal Sync is designed so that personal data does not leave your practice infrastructure except via the user-authorised Google Calendar API. We are the data processor; you are the data controller. We are registered with the UK Information Commissioner's Office under registration number Z2608112.

Controller, processor, and your patients

• Data controller: the dental practice that purchases and operates iDentiCal Sync.
• Data processor: Walker IT Support, providing the iDentiCal Sync software under contract.
• Data subjects: patients of the practice (in respect of appointment data) and authorised users (in respect of Google account information).

Lawful bases

The practice is responsible for ensuring it has a lawful basis to process patient appointment data. iDentiCal Sync supports the following bases under UK GDPR:

• Article 6(1)(b) — performance of a contract (the sync service you bought).
• Article 9(2)(h) — provision of health or social care, for the special-category aspect of appointment data.

Data minimisation by design

iDentiCal Sync was built with data minimisation as a hard constraint. Specifically:

• Read-only OpenDental access. iDentiCal Sync connects to your OpenDental MySQL database with a read-only user. It cannot write, alter, or delete a single row.
• No middleman servers. Data flows directly from your network to Google over HTTPS. Nothing is proxied through Walker IT Support infrastructure.
• Minimal Google scopes. We request calendar.events.owned (only events we created) — not the broader calendar scope. See the scope table.
• Anonymous event titles by default. The default title format is "Appointment" or "Appointment #1234". Initials, names, and procedure information are opt-in.
• Procedure-code exclusion list. Sensitive treatments can be excluded from sync entirely.
• Encrypted token storage. OAuth tokens are sealed with Windows DPAPI bound to the local machine account.
• Auto-redacting logs. Patient identifiers, tokens, and connection strings are redacted from log files before they are written.

Data Protection Impact Assessment (DPIA)

Because iDentiCal Sync processes special-category data (health) on behalf of dental practices, we recommend that each practice complete a brief DPIA before deployment. The ICO provides a DPIA template you can use.

Walker IT Support is happy to provide a vendor-side DPIA summary covering our processing on request — email gdpr@identicalsync.com.

Data subject rights

Patients of your practice have the standard UK GDPR rights (access, rectification, erasure, restriction, objection, portability). Because iDentiCal Sync only writes calendar events derived from your OpenDental data, requests should be directed to the practice (as controller). We will assist as processor with any technical steps needed to fulfil a request — typically running "clear managed events" for that patient on the relevant calendars.

Key contacts

• Walker IT Support Privacy contact: gdpr@identicalsync.com
• UK supervisory authority: Information Commissioner's Office — ico.org.uk · 0303 123 1113
• ICO registration number: Z2608112

Full privacy notice

For the formal, line-by-line privacy disclosure required for OAuth verification — including the Google API Services User Data Policy Limited Use disclosure — see the Privacy Notice.