Last updated: 28.01.2026

Data Controller: Denslux Hambaravi OÜ
Registration code: 11230217
Address: Tähe 4, Tartu 51010, Estonia
Phone: +372 7 344 347 / +372 52 59 058
E-mail: denslux@denslux.ee

1. Using cookies and video surveillance

1.1. Cookies (cookies)

The clinic’s website may use cookies to improve the user experience and to analyse the use of the website.

Cookies help us:

• ensure that the website works properly;

• improve the usability of the website;

• collect statistical information on website traffic.

Information about the use of cookies is provided when you visit the website, and you have the option to opt out of cookies or change your preferences via a notification.

The legal basis for the use of cookies is the legitimate interest (GDPR Art 6(1)(f)) or the consent of the user (GDPR Art 6(1)(a)), depending on the type of cookie.

1.2. Use of video surveillance

Video surveillance is used in the clinic premises and grounds to ensure security.

The objectives of video surveillance are:

• protection of patients, staff and property;

• ensuring security;

• preventing and, where necessary, investigating offences.

The existence of video surveillance will be indicated by appropriate signs.
Video surveillance recordings will be kept for a maximum of 30 days, unless the recordings need to be kept for longer in connection with the prosecution of an offence or a legal obligation.

The legal basis for the use of video surveillance is the legitimate interest of Denslux Hambaravi OÜ (GDPR art 6(1)(f)).

2. General provisions

This Privacy Notice describes how Denslux Hambaravi OÜ (“we”, “Denslux Hambaravi”) processes your personal data in accordance with the General Data Protection Regulation of the European Union (GDPR) and Estonian personal data protection legislation (including the Personal Data Protection Act).

The Privacy Notice applies to all situations where we process your personal data in connection with the provision of dental services and customer communications.

3. Personal data processed

We may process the following personal data where it is necessary for the provision of the service:

• Identifying information: first name, surname, personal identification number.

• Contact details: address, telephone number, e-mail address.

• Health information: health history, diagnoses, treatment plan, dental and oral health status.

• Other data: billing and payment data, customer communication and service-related information.

Health data is a special category of personal data, the processing of which is only carried out on lawful grounds in accordance with Article 9 of the GDPR and Estonian health and data protection legislation.

4. Purposes of processing and legal basis

4.1. Contract/Service provision

The processing of personal data is necessary for the provision of dental services, including the establishment of a treatment plan, the provision of treatment and customer communication
(GDPR art 6(1)(b)).

4.2. Legal obligations

As a health care provider, we are obliged to process patient data in accordance with Estonian health care legislation
(GDPR art 6(1)(c)).

4.3. Consent

For other purposes (e.g. marketing, publication of photos), we will only process the data on the basis of your free and informed consent
(GDPR Art 6(1)(a) and Art 9(2)(a) for health data).

5. Data retention

Personal data will be kept only for as long as necessary to provide the service or to comply with legal obligations.
The time limits for the retention of health data are based on applicable legislation.

6. Transfer of data to third parties

Personal data may be transferred to:

• national information systems (e.g. the Health Information System);

• collaborating partners (e.g. laboratories), if necessary for the provision of treatment;

• with your consent;

• under a legal obligation (e.g. to law enforcement authorities).

7. Your rights

You are right:

• access your personal data;

• ask for the data to be corrected;

• request the deletion of data where there is no legal basis for doing so;

• restrict the processing of data;

• get the data transferred;

• raise objections;

• withdraw consent at any time.

8. Contact and data protection

Please contact us to exercise your privacy-related questions or rights:
denslux@denslux.ee

9. Security and confidentiality

We implement appropriate technical and organisational measures to ensure the security of personal data and to protect it against unauthorised access, alteration, disclosure or destruction.