Privacy Policy

Version 2.1 · Last updated 21 October 2026

1. Who We Are

This Privacy Policy applies to Breez, a software platform owned and operated by Bosco AI LTD, a company registered in Scotland under company number SC822121, with its registered address at Silver Moon, Clora Brae, Oxton, Lauder, TD2 6AE, United Kingdom.

Bosco AI LTD is the data controller for information about our customers (such as dentists and practice staff) and about people who contact us. For patient information recorded through Breez, the dental practice is the data controller and Bosco AI LTD is its data processor. Schedule 2 of our Terms of Service is the data processing agreement between us and each practice.

Our support team is our data protection contact. If you have any questions about this Privacy Policy or how we handle personal data, you can contact us at:
📧 support@bree-z.com
📍 Bosco AI LTD, Silver Moon, Clora Brae, Oxton, Lauder, TD2 6AE, United Kingdom

2. What Data We Collect

We collect and process different types of data depending on how you interact with our services. This may include:

a) Data We Collect from Breez Users (e.g. Dentists):

• Full name
• Email address
• Business/practice name
• Mobile phone number (used for support, for example on WhatsApp, and to send you sign-in or confirmation codes and order and delivery updates by text message)
• Billing and delivery details (e.g. address, VAT number)
• Payment method details (processed by our payment provider)
• Login details (username and your password, stored in scrambled form)
• Usage logs and device identifiers (e.g. a device number for each computer that runs the Breez app)
• The names of the clinician and any assistant at each recording, and the name of the computer used to make it

b) Data Collected from Patients (via Breez Software):

• Audio recordings of dental consultations
• Automatically transcribed text of consultations
• Patient names or identifiers (if mentioned)
• Clinical notes generated through the software
• Appointment details (e.g. time, duration, user ID)

We remove patients’ names and other details that identify them from transcripts and notes.

c) Website and Analytics Data:

• IP addresses
• Browser type and version
• Device identifiers
• Pages visited and time spent on site
• Referral information (e.g. links clicked to reach us)

We collect only the data we need to provide our services.

d) If You Meet Us at a Show or Ask About an Offer:

If you talk to us at a dental show, ask us to call you back through our website, or ask about an offer, we collect:

• Your name, mobile number, email address and any message you leave
• Your practice name
• Notes our team makes about the conversation
• The texts and emails we send you about the offer

We use this to follow up on our conversation and to send you the offer you asked about. Our lawful basis is legitimate interests, or consent where you ask us to send you news about Breez. You can ask us to stop contacting you at any time by emailing support@bree-z.com.

3. How We Collect Data

We collect personal data through the following methods:

a) Information You Provide Directly

• When you sign up for Breez and create an account
• When you enter your payment and billing details
• When you contact us via email, WhatsApp, or support channels
• When you provide feedback or respond to surveys
• When you talk to us at a show, ask us to call you back, or ask about an offer

b) Information Collected Automatically

• When you use the Breez desktop application (e.g. device number, timestamps, logs)
• When a clinician records an appointment, after telling the patient and asking their permission
• When transcripts are generated automatically from audio recordings
• When you visit our website (e.g. cookies, device/browser info, analytics data)

c) Information Collected via Third Parties

• Payment information, processed securely by our payment provider
• Transcripts of recordings, from our speech-to-text providers
• Draft clinical notes, from our AI providers
• Website error and crash reports from our error monitoring service. When an error on the website affects your account, a report can include your user ID, name and email address.
• Your address, from our address lookup service, when you enter your postcode
• Your name and email address from the sign-in service, if you choose to sign in with an existing account
• Your name and role, from your practice, when it adds you to its account

d) Cookies We Use

When you visit our website we use a small number of cookies and similar local storage. You can change your choice any time with the Cookie settings link. Declining the optional cookies leaves the site fully usable.

• Sign-in session cookies (essential): keep you signed in and secure your session. These are always on because the site cannot work without them.
• Your cookie choice (essential): remembers whether you allowed optional cookies, in your browser and in a cookie that lasts one year, so we do not ask on every visit.
• PostHog, product analytics (optional): usage analytics linked to your account when you are signed in. They show us which pages and features are helpful. Loaded only after you allow optional cookies.
• Microsoft Clarity, session recording (optional): records individual visits to our website, such as clicks and scrolling, linked to your account when you are signed in. Loaded only after you allow optional cookies.
• Sentry, error monitoring: reports errors so we can fix problems on the website. A short replay of the page when something goes wrong is added only after you allow optional cookies.
• Stripe, payment security (essential): __stripe_mid and __stripe_sid, set by our payment provider on checkout pages to help prevent fraud during payment. They are only present on pages where you enter payment details.

The Breez desktop app does not use cookies, so your choice on this website does not apply to it. The desktop app’s usage and error reports are linked to an account number and a device number only. We use them, on the basis of our legitimate interest, to keep the app working well.

We use these cookies and tools only to run, secure and improve our website.

4. Legal Basis for Processing

We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. The legal bases for our processing activities include:

a) For Breez Users (Dentists and Practice Staff):

We process user data on the basis of:

• Contractual necessity: to provide access to the Breez software and support services as agreed upon during sign-up, and to offer trial sign-ups
• Legitimate interests: to operate, maintain, and improve our services, to communicate with you, and to prevent misuse
• Legal obligation: to keep billing records for tax and to meet our other legal duties
• Consent: where you allow optional cookies, or where we send you optional news

b) For Patient Data Processed via the Software:

We process patient data (e.g. audio recordings and transcripts) on behalf of the dental practice, which is the data controller. Your practice chooses the legal basis. For clinical records this is normally the provision of health care (UK GDPR Article 9(2)(h)).

Separately, the practice tells each patient and asks their permission before recording, as the General Dental Council (GDC) requires. If a patient says no, the clinician does not record.

c) Do You Have to Give Us Your Data?

We need your account and billing details to provide Breez. Without them we cannot set up your account.

5. How We Use Personal Data

We use the personal data we collect for the following purposes:

a) To Provide and Operate the Breez Service

• Registering and managing user accounts
• Verifying user identity and managing subscriptions
• Confirming your mobile number and letting you sign in with a code sent by text message
• Recording and transcribing dental consultations
• Writing a draft clinical note from each recording, for the clinician to check before it is added to the patient’s record
• Delivering hardware (e.g. microphones), sending order and delivery updates, and handling warranty claims and returns

b) To Communicate with Users

• Providing support via WhatsApp, email, or phone (as appropriate)
• Sending account notifications, billing updates, and operational messages
• Following up on feedback, enquiries, or incident reports

c) To Improve Our Software and Services

• Analysing usage patterns and performance data
• Identifying bugs or areas for improvement
• Informing development of new features based on broader service trends

When you report a problem, our support team may review the note to fix it and improve your templates. We test improvements on demo and synthetic recordings. We never use your data for marketing, profiling or training AI models.

d) To Comply with Legal and Regulatory Obligations

• Keeping billing records for 6 years, as UK tax law requires
• Maintaining records for accounting and tax purposes
• Ensuring security, fraud prevention, and compliance with applicable laws

6. Sharing and Disclosure of Data

a) With Service Providers (Sub-Processors)

We share data with service providers that help us run Breez. Your data is stored by Cloudflare, in the UK and the EU. Our other providers give us AI services, payments, messaging, delivery, analytics, error monitoring, address lookup and optional sign-in.

Our text message provider sends sign-in codes, order and delivery updates and offer confirmations. Each provider may only use your data to provide its service to us.

b) With Legal or Regulatory Authorities

We may disclose personal data:

• To comply with legal obligations or regulatory requests
• To enforce our terms and investigate fraud or misuse
• To protect Breez, our users, or the public

If Bosco AI LTD receives a request from a public authority for personal data, we will: (1) review the legal basis of the request before responding; (2) challenge requests we consider unlawful; (3) disclose only the minimum data necessary; and (4) keep a record of each request, our response, and the legal reasoning and people involved.

c) In the Event of a Business Transfer

If Breez is acquired or merged, personal data may be transferred. We will inform users of any such change.

d) WhatsApp Messaging

We use WhatsApp to communicate with customers, prospective customers and people who contact us. When you message us on WhatsApp, or agree to receive WhatsApp messages from us, we process your name, WhatsApp number, profile name, message content, attachments and timestamps, and keep them in our support and customer records. This may include earlier conversations with our WhatsApp number.

We use this to answer enquiries, provide support, send account and service updates, and, where you have agreed, send news about Breez. Our lawful bases are contract (customers), legitimate interests (responding to enquiries from practices) and consent (marketing messages). You can stop marketing messages at any time by replying STOP or emailing support@bree-z.com.

WhatsApp may process this data outside the UK, under the safeguards described in section 7. We keep WhatsApp conversations for 2 years after our last contact, like other support messages, unless the law requires otherwise.

7. Where Data Is Stored and International Transfers

Your data is stored and processed in the UK and the EU. Any transfer outside the UK, such as WhatsApp messages, uses the safeguards UK law provides (UK adequacy, the UK International Data Transfer Agreement or the UK Addendum). You can ask us for a copy at support@bree-z.com.

8. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, to comply with legal obligations, and to support legitimate business interests.

a) Audio Recordings

We delete audio recordings 30 days after the recording.

b) Transcripts and Dental Notes

We keep transcripts and notes while your practice’s account is active. Your practice decides how long clinical records are kept. NHS guidance is 11 years for adults and until age 25 for children. We delete or return them when your practice asks.

c) Billing Records

We keep billing records for 6 years, as UK tax law requires.

d) Support Messages and Leads

We keep a copy of the WhatsApp messages, texts and emails between you and Breez, including photos, voice notes and files you send us, so our team can see your whole conversation with us. We never keep sign-in or security codes.

We keep support messages and leads for 2 years after our last contact.

e) Website Analytics and Error Reports

We keep website analytics and error reports for up to 12 months.

f) After Cancellation

Once your subscription ends:

• You have 30 days to download your notes and transcripts.
• We then delete your practice’s data within a further 30 days. Billing records (section 8c) and support messages (section 8d) are kept for the periods above. If you ask, we confirm the deletion in writing.

You can ask us to delete your account data sooner. We will do so unless the law requires us to keep it.

9. Your Rights Under UK GDPR

As a data subject under UK data protection law, you have the following rights in relation to your personal data:

a) Right to Access

You have the right to request a copy of the personal data we hold about you.

b) Right to Rectification

You can request that we correct any inaccurate or incomplete personal data.

c) Right to Erasure (“Right to be Forgotten”)

In certain cases, you may ask us to delete your personal data, subject to our legal obligations (e.g. billing records we must keep for tax).

d) Right to Restriction of Processing

You may request a restriction on how we process your personal data in specific circumstances.

e) Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to have it transferred to another provider where technically feasible.

f) Right to Object

You may object to our processing of your data in certain contexts, such as direct marketing or where processing is based on our legitimate interests.

g) Right to Withdraw Consent

If processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

h) Automated Decisions

We do not make decisions about you based solely on automated processing.

To exercise any of your rights, please contact us at support@bree-z.com.

If you are a patient: your dental practice is responsible for the records made at your appointments. Please contact your practice to use these rights. If you contact us, we pass your request to your practice.

10. How to Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or how we process your personal data, you can reach us using the details below:

Bosco AI LTD
Silver Moon, Clora Brae, Oxton, Lauder, TD2 6AE, United Kingdom
support@bree-z.com

We aim to respond to all privacy-related enquiries within one month of receipt, in accordance with UK GDPR.

11. Complaints

If you are unhappy with how we have handled your personal data, please tell us at support@bree-z.com and we will look into it.

You also have the right to complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk. Bosco AI LTD is registered with the ICO under number ZB916696.

12. Customers Outside the UK

Breez is provided from the United Kingdom. UK law governs this policy, and we apply it to every customer, wherever they are.

13. Changes to This Policy

The version and date at the top of this page show when this policy last changed. If we start using your data for a new purpose, we tell you first.