Privacy Policy
1. Data controller
The controller of personal data is LinkConnect Ltd. (Линк Кънект ЕООД), with the data-protection contact listed on the contact page. This policy describes how we process personal data under Regulation (EU) 2016/679 (GDPR).
2. What data we collect
For patients: name, email, telephone, age group, appointment preferences and an optional short note. For students: identification and verification data, including proof of student status. We do not require — and ask you not to enter — a national identification number, medical history or diagnoses.
3. Purposes and legal bases
We process data to: provide the service (performance of a contract), ensure security and prevent abuse (legitimate interest), meet accounting obligations (legal obligation), and run analytics where consent has been given.
4. Retention
Your account data is kept while your account is active; you can delete it at any time from your settings, upon which your data is deleted or anonymized. We apply the following periods: appointment and visit records (including free text) are anonymized after up to 24 months; patient–student messages are kept for up to 24 months; dental X-rays are deleted 6 months after upload (see “Dental images and health-related data”); notification logs for 12 months; audit logs for 24 months; analytics data for 14 months. Accounting data is kept for the statutory periods. After the applicable period, data is deleted or anonymized. Waitlist signups (email and any telephone number) are deleted within 30 days of the alert being sent, or 12 months from signup if no match occurs. A photo a student adds for an advertisement we run for them is used only in that advertisement on Facebook and Instagram. The student can remove it from their advertising page at any time, and we delete it within 90 days after the campaign ends.
5. Recipients
Dental students registered on UniDent read your request while it is on the waiting list, and verified students also see your first name (on a child’s request, yours and your child’s) before you have connected with anyone. Your surname, email address and telephone number reach only the student you connect with. If you ask one student to call you and agree, when we ask, that another student may call you if that one cannot, your request goes to the other students at the same faculty, and your telephone number reaches only the one who takes it. Students who see your request also see how many students you have been in contact with through UniDent in the last month, if there have been several, and how many of your visits in that time took place or were missed, but never with whom. We use processors for hosting and the database, the payment provider (Stripe) for student subscriptions and for the fee a patient pays for missing a confirmed visit, an email delivery provider, Google (Google Analytics) for web analytics, and Sentry for technical error monitoring. If you share your own words with the students of your city, an AI service (Anthropic) turns them into one short description, without your name or contact details, for the city's student channel on Telegram. Google Analytics loads ONLY if you have consented to analytics cookies; the IP address is anonymised and the advertising-profiling features (Google Signals and ad personalisation) are switched off. If you have consented to marketing cookies, we also use the Meta advertising pixel to measure the results of our advertising. In respect of the data it collects, we and Meta Platforms Ireland Limited act as joint controllers. The page address, IP address, browser information and a cookie identifier are transmitted to Meta, together with a “registration completed” event. We do NOT transmit to Meta any name, email address, telephone number, complaint, tooth information, X-ray or other health data. Separately from the pixel: if you fill in a contact form inside one of our advertisements on Facebook or Instagram, the details you enter there yourself — your name, telephone number and the availability you give — are collected by Meta, and we download them so that the student whose advertisement you saw can call you. We use them only for that call, we do not link them to a UniDent account if you do not have one, and we delete them within 90 days. We do not sell personal data.
6. Your rights
You have the right of access, rectification, erasure, restriction, portability and objection, and the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP). You can export your data and delete your account from your settings.
7. Security
We apply technical and organizational measures: encrypted connections (TLS), an authorization check on every request enforced in the application, signed expiring links for verification documents, an audit log of administrative actions, an access log for X-ray images, and the principle of least privilege. Files are stored outside the site’s public directory and are not reachable by direct URL.
International transfers
Google Analytics data may be transferred to Google servers in the United States. The transfer takes place on the basis of the European Commission’s standard contractual clauses and the EU–US Data Privacy Framework, under which Google is certified. Data collected through the Meta advertising pixel is processed by Meta Platforms Ireland Limited and may be transferred to servers in the United States on the same bases. Both are collected only with your consent, and you can withdraw it at any time from “Cookie settings” at the bottom of every page. Technical error data (Sentry) is processed on servers in the European Union (Germany) and does not leave the EU. Hosting, the database and file storage are located in the United States, with our hosting provider. Any X-ray images and identity documents you upload are stored there. Transfers to our hosting provider take place on the basis of the European Commission’s standard contractual clauses for the transfer of personal data to third countries. Anthropic may process those words on servers in the United States, on the basis of the European Commission’s standard contractual clauses.
Dental images and health-related data
When sending a request, patients may choose to upload dental X-ray images (radiographs) and to describe their complaint. Such information can reveal data concerning health, which is a special category of personal data under Article 9 GDPR. We process it ONLY on the basis of your explicit consent, and solely so that dental students can pre-assess your case before offering one of their limited faculty appointment slots. A request you send to one student is read by that student; a request on the waiting list is read by the dental students registered on UniDent, without your surname or contact details. X-rays are stored outside the site’s public directory, with strictly restricted access and a log recording every time one is opened. They can be opened only by the student you send a request to or, while your request is on the waiting list, by a verified student whose inbox it reaches, and by UniDent’s administrators. They are never made public, and are deleted automatically 6 months after upload, as well as at any time on your request. Providing an X-ray is always optional.
Telephone number for waitlist alerts and contact
If no student matches your search, you can join a waitlist with your email. A telephone number is required to join: a student reaches you by phone, not by email. We hold it because it is necessary to send you the alert you asked for, and we record when it was given. Waitlist alerts themselves are currently sent by email. We use the number to alert you by SMS or Viber message if we add those channels, and to contact you about your own request — by message or by telephone — where something about it needs an answer we cannot get by email. We do not use it for marketing, we do not sell it, and we do not pass it to students or to anyone other than the provider that delivers the message. You may withdraw consent at any time, and ask us to delete your waitlist entry including the number, using the contact details in this policy. We delete the entry, including the number, within 30 days of sending your alert, or within 12 months of signing up if no suitable student ever appears — whichever comes first.
Children's data
If the patient is under 18, the form asks for their exact age, their first name (optional) and how their previous dental visit went. All three are given by the parent or guardian submitting the request and are processed on the basis of their consent. The age is necessary because it determines whether the case can be taken on by a paediatric dentistry student at all; the first name tells the student who they would be treating and lets you tell your own requests apart if you bring more than one child; and the answer about the previous visit helps the student judge whether they can take the case before offering an appointment. We do not ask for or store a national identity number, an address, or any other data about the child. The exact age and the answer about the previous visit are visible only to the students the request is routed to; the child’s first name only to verified students, next to the parent’s first name. All three are erased together with the rest of the request when you ask for it to be erased. A UniDent account is created by an adult — the platform is not intended for independent registration by anyone under 18.
Notifications on your phone
If you turn on notifications in your account, your browser gives us a push address for that device, and we store it to send you the same alerts you get by email, such as a new request or an answer to your booking. We do this only after you turn them on. The message passes through your browser's push service (for example Google or Apple) to reach the device. We keep the address until you turn notifications off on that device, or until the browser tells us it no longer works, and then we delete it. Your email preferences apply to these notifications too.
Text messages (SMS)
When you send a treatment request, or leave your number for one student, and the number is a Bulgarian mobile, we text it one SMS with a 6-digit code and a link. Typing the code in or tapping the link confirms that the number is yours and that it works, and your request then goes to the students. If you have not confirmed within 1 hour, we send one reminder with a link, never at night. If you have not confirmed within 3 hours, your request is shown anyway, marked “Number not confirmed”. If our SMS cannot be sent, your request is sent on without it. A request from a number outside Bulgaria is not texted and is sent on at once. The number and the text of the message pass through our SMS provider, BulkGate (TOPefekt s.r.o., Czech Republic), which only delivers the message and keeps its data in the European Union. We keep a fingerprint of the code, never the code itself. The link works for 24 hours; then we delete our record of it, together with the number in it. When a student takes your request, we send you one SMS with their first name, so that you know who will call you; we delete our record of that SMS, with the number in it, after 24 hours. We also send one SMS to a patient whose chosen student has not called within 48 hours, to ask whether another student may call them; the number moves only to the student they then choose. When the student you left your number for proposes a first visit, we send one SMS with their first name, the day, time and faculty, and a link to answer; if you confirm, one more SMS the day before. When a patient leaves their number for one student, we send that student one SMS with a link to the request, without the patient’s name, number or any health information; for a number left at night, it arrives in the morning. If you left your number for one student without saying that another may call you, and nobody has taken your request within 24 hours, we send you one SMS with a link to ask whether another student of the Faculty may call you; your request goes on the Faculty’s list only if you answer yes. When you fill in a contact form in one of our advertisements on Facebook or Instagram, we send the student whose advertisement it is one SMS with your name and number, and an email with the details you entered, so that they can call you; for a form sent at night, the SMS arrives in the morning.