Privacy policy
Last updated: 30 October 2026
What changed: we now also name GitHub, which stores the code for this website and our encrypted database backups (kept for 14 days), and say where we use Google Tag Manager and Cloudflare Turnstile. How we use your data has not changed.
1. Who we are
Dentoscore is a revision service for candidates preparing for Part 1 of the Overseas Registration Examination. It is run by an independent sole trader established in the United Kingdom, trading as Dentoscore.
For the purposes of UK data protection law, that trader is the data controller for the personal data described in this policy. In this policy “we”, “us” and “our” mean that trader, and “you” means the person using the service.
Postal address: Dentoscore, 61 Bridge Street, Kington, HR5 3DJ, United Kingdom
Email: support@dentoscore.co.uk
Email is the quickest way to reach us, including about your personal data. You can also write to us at the postal address above. If you need further trading details — for example to make a formal complaint or to exercise a legal right — email us and we will provide them to you in writing.
We are not connected with the General Dental Council. Dentoscore is an independent study aid. It is not affiliated with, endorsed by, or approved by the General Dental Council or any body that sets or administers the Overseas Registration Examination.
2. What data we collect
Data you give us
| Data | When |
|---|---|
| Email address | When you create an account. It is your sign-in identifier. |
| Password | When you create an account or reset it. We never see or store your password itself — it is hashed by our authentication provider before storage. |
| Display name | Optional, if you set one. |
| Anything you type into the service | Session names, deck names, planner entries and similar. Please do not enter clinical information about real patients, or anyone else’s personal data. |
| A change of sign-in email address | If you ask to change the email address you sign in with: your current and new email address, when you asked, and whether it was approved. If the wrong password is entered for the request, we note when, to stop repeated guessing. |
Data created as you use the service
| Data | What it is |
|---|---|
| Study activity | Questions answered or skipped, answers given, how long you spent on each question, the questions you flag for review, flashcard ratings, which items you have seen, your position within a session, saved sessions, decks, the questions you bookmark and your rounds in the practice tools. |
| Progress and results | Scores, per-topic performance, streaks and similar figures shown back to you. |
| Problems you report | When you report a problem with a question: which question, the reason you picked, any note you write, and our answer. We use it to fix questions and to tell you what we did. Kept while your account is open and deleted with your account. |
| Notifications | When you last opened Notifications, so we can show which announcements and answers are new to you. |
| Usage counts | A daily tally of questions and cards issued to your account. We use it to apply fair-use limits and to detect bulk extraction of our content. |
| Devices | For each device you sign in on: a device name, the type of browser it uses, and when it was first and last used. We use this to apply the limit of two devices per account. |
| When you use the service | The days you used the service and when you were last signed in. We use them for your study streak and to tell when an account has gone unused (see section 9). |
| Technical data | Standard information sent by your browser when you request a page — IP address, user agent, and the time of the request. Our hosting and security providers process this to serve the site and to protect it from attack and abuse. |
| Approximate location | Only if you have agreed to analytics. Our analytics provider works out an approximate location — at country, region and city level — from your IP address, so we can see roughly where our users are. It is not a precise location, we do not use device GPS, and your IP address itself is not retained by the analytics provider. |
Data we do not collect
- We do not ask for, and do not want, health data about you or anyone else.
- We do not collect special category data as defined in UK GDPR.
- We do not buy personal data, and we do not build advertising profiles.
- We do not track you across other websites.
- The service is for adults. It is not intended for anyone under 18 and we do not knowingly collect data from children.
3. Why we use it, and our legal basis
| Purpose | Legal basis |
|---|---|
| Creating and running your account; letting you sign in; saving and restoring your study progress | Performance of a contract — this is the service you asked for |
| Applying fair-use limits, detecting bulk copying of our question bank, and keeping the service secure and available | Legitimate interests — protecting our content and other users. We have considered your interests and use the minimum data needed |
| Understanding, in aggregate, how the service is used so we can improve it | Consent — analytics does not run at all unless you agree to it. You can change your mind at any time, and withdrawing is as easy as giving it: see section 5 |
| Sending service emails you need — confirming your email address, resetting your password, changing the email address you sign in with, confirming a purchase, and warning you before an unused account is deleted | Performance of a contract |
| Keeping records of payments | Legal obligation — tax and accounting law |
| Answering you when you contact us | Legitimate interests |
We do not send marketing email. If that ever changes we will ask for your consent first, and you will be able to withdraw it at any time.
4. Cookies and similar storage
The rules here cover more than cookies. They apply to anything stored on, or read from, your device — including browser storage. Everything the site uses is listed below.
| What | Type | Purpose | Consent |
|---|---|---|---|
| Authentication session | Browser local storage, set by our authentication provider | Keeps you signed in as you move around the app. Without it, the service cannot work. | Strictly necessary — no consent needed |
| Your cookie choice | Browser local storage: ds_consent, and ds_analytics_optout if you say no | Records the choice you make in the cookie banner and when you made it, so that we do not ask again on every visit and can show that you were asked. It holds nothing but that preference and its date. | Strictly necessary — storing your choice is how we honour it |
| App settings on this device | Browser local and session storage, with names beginning ds_, ds- or ore_ (for example ds_device) | Small notes the app needs on this device: which device this is (for the device limit), that a password reset is under way, which “what’s new” and payment notices you have already closed, how far down the last screen you were (so going back returns you to the same place), whether you can open the in-depth notes, and how many questions you have asked the assistant today (ds_ask, so the daily limit works). They hold no name, email address or payment details, and are not sent to anyone else. | Strictly necessary — the app cannot work as described without them |
| Cloudflare Web Analytics | No cookie, and no identifier stored on your device | Counts page views and basic page-performance figures in aggregate. | Nothing is stored on your device, so there is nothing to consent to |
| Google Analytics | Cookies, named _ga and _ga_…, lasting up to two years | Aggregate statistics about how the service is used, so we can improve it. It is configured so that the data is not used for advertising, not used to build profiles, and not used to recognise you across other websites: Google Signals and advertising personalisation are switched off, and no advertising product is connected to it. | Your consent. These are not set, and nothing is requested from Google, unless you switch analytics on — see section 5 |
| Security challenges | Set by Cloudflare (including Cloudflare Turnstile on our account forms) when a request looks automated | Distinguishes people from bots, and protects the service from scraping and attack. | Strictly necessary |
Nothing optional runs until you say so. The first time you visit, a short cookie notice asks whether you are happy with analytics. Until you answer, no analytics is loaded and no request is made to Google at all — refusing is one click, it is free, and the service works exactly the same either way. There is no “reject” buried two screens deep and no pre-ticked box.
We could have asked for less than this. UK law now allows aggregate analytics without consent so long as you are told and can object. We ask anyway, because most of the people using Dentoscore are sitting a UK exam from outside the UK, and the rules where many of them live require being asked first. One standard for everybody is simpler to keep honest.
Nothing on this site is used for advertising. If we ever introduce advertising or cross-site tracking, we will ask for your consent separately and this page will change before that happens.
5. Your cookie choices
Analytics is off until you turn it on. You are asked once, in a notice at the bottom of the page the first time you visit, and your answer is remembered on that device for the whole site. To change it later, use Cookie settings in the footer of any page, which reopens that notice — or use the control below, which does the same thing from this page.
This control applies to this browser, takes effect immediately, and costs nothing. Everything strictly necessary to run the service keeps working either way.
Your choice is stored on your device only, so clearing your browser data resets it and you will be asked again. We also honour your browser’s own “do not track” and Global Privacy Control settings automatically — if either is switched on, analytics never loads and you are not asked. If you would rather we handled it by email, make a request under section 8 instead.
Cloudflare Web Analytics is the one thing this does not switch off, and deliberately so: it sets no cookie and stores no identifier on your device, so there is nothing on your device to consent to or withdraw. It counts page views and page-speed figures in aggregate and cannot single you out. It is listed in section 4 with everything else.
6. Who we share data with
We do not sell your data and we do not share it for anyone else’s marketing. We use the following service providers, who process data on our instructions:
| Provider | What they do for us |
|---|---|
| Supabase | Database, user accounts and authentication. Your account and study data are stored here, and the service emails described in section 3 are sent through it. |
| Resend | Sends our emails for us: confirming your email address, resetting your password, changing the email address you sign in with, confirming a purchase, and the warning before an unused account is deleted. It receives your email address and the content of the email. |
| Cloudflare | Hosting and delivery of the site, protection against attack and automated abuse, and the cookieless aggregate analytics described in section 4. It also runs the “Ask Dentoscore” assistant on our public pages: the question you type is sent to Cloudflare’s AI service (Workers AI) so it can write an answer from our own pages. We do not store your questions or link them to your account. Please do not type personal details or details about patients into it. |
| Google Analytics, loaded through Google Tag Manager only if you switch analytics on, and configured as described in section 4; and Search Console, which reports on how our pages appear in search results and does not identify you. | |
| GitHub | Stores the code for this website and our encrypted daily database backups, which are deleted after 14 days. |
Payments. Payments are handled for us by Stripe, using its Managed Payments service. Your card details go directly to Stripe and we never receive or store your card number.
Under Managed Payments the merchant of record is Link, LLC, a Stripe company, which uses the name Onelink. In practice that means three things you will see: your purchase is shown as “Sold through Onelink” at the checkout; your card statement will read ONELINK* DENTOSCORE (some banks show LINK.COM* DENTOSCORE); and your receipt, invoice and any refund notice are sent to you by Onelink, not by us.
Stripe and Onelink receive your email address, your billing country and the amount, so that they can take the payment, calculate the right tax and send you a receipt. We are sent confirmation that a payment succeeded, which plan it was for, the amount and the email address you paid with, so that we can send you a purchase confirmation — and nothing else.
We may also disclose data where we are legally required to, or to establish or defend legal claims.
7. How long we keep it
| Data | Retention |
|---|---|
| Account details and study data | While your account is open. If you delete your account, they are deleted — see section 9. If an account is not used for 24 months, we delete it after emailing a warning at least 30 days before — also in section 9. |
| An account whose email address was never confirmed | Deleted 7 days after it was created. No email is sent, because the address may not belong to the person who signed up. You can simply sign up again — see section 9. |
| Daily usage counts | Kept while your account is open, for fair-use and anti-abuse purposes, and deleted with your account. |
| Google Analytics data | 14 months, and only if you agreed to analytics — if you did not, none of it exists. Event-level analytics data, including the identifier in the _ga cookie, is deleted automatically after 14 months. Aggregate reports built from it — totals with no identifier in them — are kept for longer, because they no longer relate to an identifiable person. |
| Cloudflare Web Analytics data | Retained in aggregate only, in line with Cloudflare’s standard retention. It contains no identifier for your device. |
| Server and security logs | Retained for a limited period by our hosting and security providers, in line with their standard retention. |
| Payment and tax records, including the confirmations you gave at checkout and when you gave them | Retained for six years after the relevant tax year, because we are legally required to keep them. This applies even if you delete your account. |
| Correspondence with us | Kept for as long as needed to deal with the matter, and then for a reasonable period afterwards. |
| Backups of our database | Kept for 14 days, stored encrypted with GitHub. Each day’s backup is encrypted and replaced automatically after 14 days, so anything deleted from the service is gone from the backups within 14 days. Backups are used only to restore the service after a fault. |
8. Your rights
Under UK data protection law you have the right to:
- be told how your data is used — this policy;
- ask for a copy of the personal data we hold about you;
- have inaccurate data corrected;
- ask us to delete your data;
- ask us to restrict how we use it;
- object to processing we carry out on the basis of legitimate interests, and to object to analytics as described in section 5;
- ask us to transfer your data to you or another provider in a portable format.
To exercise any of these, email us using the address in section 13. We will respond within one month. There is no charge. We may need to verify your identity first, which normally means writing to us from the email address on the account.
9. Deleting your account
You can delete your account yourself, from inside the app. Sign in, open Your profile (the menu at the top right) and choose Delete account. You will be asked to enter your password and type the word DELETE to confirm, and nothing happens until you do. There is no charge and you do not have to give a reason.
If you would rather we did it for you, email support@dentoscore.co.uk from the account’s own email address and we will action it and confirm when it is done.
Deleting an account removes your account record, your study history, your saved sessions, decks, bookmarks and practice-tool rounds, the problems you reported, your planner entries and your display name.
Deletion is permanent. Your study progress cannot be recovered afterwards. Copies in our encrypted backups are gone within 14 days (see section 7). Two things survive deletion: payment and tax records, which we are legally required to keep for six years, and anonymised or aggregated statistics that no longer identify you. Aggregate counts of how the service was used are not restored to, or linked back to, a deleted account. If your plan still had time left, section 9 of our terms of use explains how we can move it to a new account.
Accounts that are not used
So that we do not keep your details for longer than we need them, an account that has not been used for 24 months is deleted. “Used” means signing in, studying, or having the app open while signed in. At least 30 days before the deletion we email the account’s address with the date; signing in before then keeps the account, and nothing else is needed. Accounts that still have paid time left are never deleted this way. The deletion works in the same way as deleting the account yourself, described above.
Accounts that are never confirmed
When you create an account we email a link to confirm your address. If the address is not confirmed within 7 days (you can ask for a new link at any time before then), the account is deleted, along with anything stored with it. If this happens, you can create a new account at any time.
10. Security
- All traffic is encrypted in transit using HTTPS.
- Passwords are hashed by our authentication provider. Nobody at Dentoscore can read your password.
- Our daily backups are encrypted.
- Access to your data is restricted at the database level, so one account cannot read another account’s data.
- Administrative access to the systems that hold your data is restricted to the operator of the service.
- Fair-use limits and automated-abuse protection are in place to detect bulk extraction.
No online service can promise perfect security. If a breach affects your rights and freedoms, we will tell the Information Commissioner’s Office within 72 hours where required, and we will tell you without undue delay where the law requires it.
11. Where your data is stored
Your account and study data are stored in Ireland (our database provider’s eu-west-1 region), which is inside the European Economic Area. The UK has formally recognised the EEA as providing an adequate level of protection for personal data, so no additional transfer safeguard is needed for that storage.
Some of our other providers — our hosting, security and analytics providers, and GitHub, which stores our code and encrypted backups — are based outside the United Kingdom or operate global networks, so your data may be processed outside the UK and the EEA. Where that happens we rely on one of the safeguards UK law allows: either that the destination has been formally recognised as providing adequate protection, or an approved UK data transfer agreement (the International Data Transfer Agreement, or the UK Addendum to the European Commission’s standard contractual clauses) together with any additional safeguards needed.
12. Changes to this policy
We will update this page when what we do changes. The date at the top always reflects the current version. If a change materially affects how we use your data — for example introducing advertising, or a new provider — we will make that clear rather than quietly amending the text, and where the law requires consent we will ask for it first.
13. Contact and complaints
For anything in this policy, including requests under section 8 and section 9, contact support@dentoscore.co.uk.
If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the UK’s data protection regulator, the Information Commissioner’s Office, at ico.org.uk/make-a-complaint, or by telephone on 0303 123 1113.