Privacy policy

Who we are

mzpay is an associate pay management system for dental practices, operated by Praxis Health Technologies Ltd ("we"), a company registered in England & Wales, company number 17294974, registered office 128 City Road, London, EC1V 2NX. We are registered with the Information Commissioner's Office under registration ZC180094. Contact: info@praxisdental.co.uk.

mzpay is used by dental practice staff - practice owners, managers, reception teams and associate dentists. It is not a public service and holds no accounts for members of the public.

Two roles: controller and processor

For staff account data - your name, work email address, role, GDC registration number (clinicians only), password hash and sign-in activity - the dental practice group that deployed mzpay decides who has an account and why; we process this data to run the service for them.

For patient-related data (below), the dental practice is the data controller and Praxis Health Technologies Ltd is the data processor, acting only on the practice's written instructions under a data processing agreement. If you are a patient of a practice that uses mzpay, your rights are exercised through the practice - they control the data; we hold it for them. We will assist the practice with any request.

What patient data mzpay holds - and what it never holds

mzpay is a financial administration tool. To divide laboratory and treatment costs correctly between a practice and its dentists, it processes, at the practice's instruction:

• patient names as they appear on laboratory invoices and payment records;
• treatment descriptions as billed (e.g. "zirconia crown"), including tooth references;
• amounts charged and paid, and the practice management system's patient reference number;
• scanned laboratory and supplier invoices, which may show a patient's name and treatment.

mzpay never holds patient contact details (address, phone, email), dates of birth, NHS numbers, medical histories, clinical notes, radiographs or any clinical record. It is not used in the delivery of care and no clinical decision is made in it.

Lawful basis

The practice, as controller, relies on its legitimate interests and legal obligations in administering contracts with its dentists and keeping accounting records. To the extent a treatment description linked to a named patient is health data, the practice's basis is Article 9(2)(h) UK GDPR (management of health care systems and services), and we act strictly as its processor. Our basis for staff account data is the performance of our contract with the practice and our legitimate interest in securing the service.

Where data lives and who touches it

mzpay runs on infrastructure in the European Union: the database and encrypted document storage are hosted by Supabase and the application by Vercel, both in EU regions. Data in transit is encrypted (TLS) and invoice scans are held in a private bucket that is never publicly accessible.

Our sub-processors:

• Supabase - database and document storage (EU).
• Vercel - application hosting (EU region).
• Anthropic - AI reading of scanned invoices (which may show a patient name and treatment) and of aggregate financial figures. Anthropic does not train models on this data.
• Resend - email delivery to staff, where email is enabled.
• Google - optional "Sign in with Google", where enabled; used for authentication only.

Each is bound by a data processing agreement with appropriate safeguards. The practice's own practice management system (e.g. Dentally) is not a sub-processor of ours - mzpay reads from it on the practice's own credentials, at the practice's instruction.

Cookies

mzpay sets strictly necessary cookies only: a signed session cookie that keeps you logged in, and a short-lived cookie when an administrator uses the read-only "Role Viewer". There are no analytics, advertising or tracking cookies of any kind.

Retention

Finalised pay statements and the records that support them are the practice's accounting records; we retain them for as long as the practice instructs, in line with UK accounting record requirements. Account and audit records are kept while the service is in use. On termination of our agreement with the practice, data is returned to the practice and then deleted, as the data processing agreement provides.

Your rights

You have the rights UK GDPR gives you, including access, rectification and erasure. Staff can raise these with us directly at info@praxisdental.co.uk. Patients should contact their dental practice, which controls the data; we support the practice in responding. You may also complain to the ICO (ico.org.uk).

Changes

If mzpay changes what it stores or who it shares data with, this page is updated at the same time, and the practice is told before the change takes effect.