Privacy policy

Privacy notice

Last updated: 29 September 2026.

1. Data controller and contact details

Data controller: POTIDENTAL Szolgáltató Korlátolt Felelősségű Társaság (POTIDENTAL Kft.).
Registered office and correspondence address: 4032 Debrecen, József Attila utca 7., Hungary.
Company registration number: 09-09-030122.
Tax number: 26534329-1-09.
Representative: Dr. Póti László Levente, Managing Director.
Email: info@potidental.hu.
Telephone: +36 20 212 0202.
Website: https://www.potidental.hu.

Please use these contact details for questions, requests or complaints about the processing of your personal data.

2. Scope and principles

This notice covers website visitors, enquiries, callback requests, patients and their legal representatives. Separate notices apply to employees and job applicants.

We process personal data confidentially, for specified purposes, only to the extent and for the period needed. The relevant legal framework includes Regulation (EU) 2016/679 (GDPR), Hungarian Act CXII of 2011, Act CLIV of 1997, Act XLVII of 1997 and Act C of 2000. Data primarily comes from you or your legal representative and is supplemented by examination results and treatment records created during care.

3. Telephone appointments and online callback requests

Purpose: contacting you, returning your call and arranging an in-person consultation. The online form requests a callback; submitting it does not itself confirm an appointment.

Data: name, telephone number optional email address and message content. Legal basis: Article 6(1)(b) GDPR, taking steps at your request before entering into a contract, or performing that contract. Without the name and contact details required to arrange an appointment, we cannot fulfil the request.

Retention: telephone appointment data is retained for no more than one year after treatment ends; where no dental care takes place, the data must be deleted without delay. Data forming part of medical records is subject to section 5.

Storage and retention of online callback requests: callback requests submitted through the website form are stored in Hygraph. We retain them for one year from submission and then delete them. Dr. Póti László Levente, Managing Director, and authorised staff responsible for reception may access these requests to contact you and arrange an appointment. This one-year period applies to callback requests; retention of medical records created during treatment is described in section 5.

4. Email enquiries and communication

Data: name, email address, any telephone number provided, message content and necessary attachments. Purpose: answering questions and requests and communicating about care. Legal basis: Article 6(1)(b) GDPR for enquiries relating to services. Data protection requests are covered by section 11.

Retention: no more than one year from receipt of the message; where dental care does not take place, personal data must be deleted without delay. Ongoing communication data may be retained for no more than one year after care ends. Separate rules apply to medical and accounting records that must be retained by law.

Appointments are arranged by telephone. We do not provide online consultations by email or through the website form. Please send only the information needed to handle your enquiry.

5. Patient registration, treatment planning and dental care

Data: name, birth name, place and date of birth, address, Hungarian social security number where necessary for care and statutory reporting, contact details, medical history, illnesses, allergies, medication, symptoms, examination results, treatment plan, treatment provided and medical documents supplied.

Purpose: identification, planning and providing safe and appropriate care, documenting care and fulfilling mandatory reporting obligations. Legal basis: Article 6(1)(b) GDPR for data needed to perform the contract and Article 6(1)(c) for statutory documentation and retention obligations. Article 9(2)(h) GDPR and healthcare legislation provide the additional condition for processing health data. Failure to supply necessary information may prevent us from providing safe care.

Retention under section 30 of Hungarian Act XLVII of 1997: medical records for at least 30 years from collection and discharge summaries for at least 50 years; diagnostic images for 10 years from creation and their reports for 30 years from creation of the image. Withdrawing consent or requesting deletion does not in itself end mandatory retention obligations.

Callback storage and content management: Hygraph GmbH. Address: Dircksenstraße 47, 10178 Berlin, Germany. Contact: info@hygraph.com. Hygraph stores callback form submissions and provides website content management. Section 3 describes callback data and retention. Provider notice: Hygraph privacy.

International providers may process data outside the EEA, including in the United States. Provider privacy notices explain transfer conditions and safeguards. You can request information about transfers affecting you and copies of the safeguards at info@potidental.hu.

Access is limited to staff and professionals who need the data for their work. Necessary information may be shared with the dental technician involved in your treatment. Data is transmitted to Hungary’s Electronic Health Service Space (EESZT) and competent authorities where required by law.

6. Clinical photographs, case presentations and reviews

Documenting treatment and presenting cases publicly are different purposes. Clinical records are covered by section 5. Publishing identifiable photographs or treatment cases on the website, social media or promotional materials requires separate, voluntary consent covering that use; health data also requires explicit consent under Article 9(2)(a) GDPR.

Consent-based use continues until consent is withdrawn. Giving consent is not a condition of receiving care. Withdrawal does not affect the lawfulness of previous processing or the mandatory retention of medical records.

For feedback, we process the patient’s name, email address, review, personal information included in the review and photograph. The purposes are handling feedback and improving services. The legal basis is consent, with retention until consent is withdrawn.

7. Invoicing and payments

Data: payer’s name, billing address, description of the service, accounting document details and necessary payment and bank account information for transfers. Purpose: invoicing, settlement and compliance with tax and accounting obligations. Legal basis: Article 6(1)(c) GDPR. Retention: accounting documents for 8 years under Hungarian accounting legislation. Necessary billing information must be supplied to issue the invoice.

Recipients may include the accountant, invoicing provider, bank handling the payment and competent authorities, to the extent required for their respective tasks.

8. Complaints

Data: the complainant’s name, contact details, complaint and documents necessary to investigate it. Purpose: investigating, answering and documenting the complaint. Legal basis: Article 6(1)(c) GDPR; Article 9(2)(h) GDPR applies to health data related to care, and Article 9(2)(f) where necessary for legal claims.

Records of complaints concerning healthcare are retained for 5 years under section 29(4) of Hungarian Act CLIV of 1997.

9. Website browsing, cookies and analytics

The website is hosted by Netlify. Technical information needed to serve and protect the website may include the IP address, request time, browser type and requested page. The purpose is operation and security; the legal basis is our legitimate interest under Article 6(1)(f) GDPR.

We use Google Analytics and Microsoft Clarity to understand visits and website usage and improve the user experience. The legal basis for analytics cookies and similar technologies is your consent under Article 6(1)(a) GDPR.

Google Analytics: processes page views, events, device and browser data and cookie-related identifiers. Cookies named _ga and starting with _ga_ help distinguish visitors and sessions. Their default lifetime is 2 years and may differ according to settings. User- and event-level retention depends on the Analytics property's configuration: standard GA4 offers 2 or 14 months, and new activity may reset certain retention periods. Different rules apply to aggregated reports. Details: Google Privacy Policy and Analytics data retention.

Microsoft Clarity: uses usage and device information, clicks, scrolling, heatmaps and session replays to analyse website use. The _clck cookie supports visitor identification and preferences; _clsk connects page views within a session. Microsoft's documentation specifies 30 days for replays and 9 months for labelled or favourited sessions, heatmaps and click data. Microsoft may also process data under its own privacy terms. Details: Microsoft Privacy Statement and Clarity data retention.

You can delete or block cookies in your browser settings; doing so may affect some website functions. You may also contact info@potidental.hu to withdraw consent or exercise your data protection rights. Deleting cookies does not itself delete data previously transmitted to providers.

10. Processors, recipients and data security

Hosting provider: Netlify.
Company identified in the provider’s public privacy statement: Netlify, Inc.
Contact address: 101 2nd Street, San Francisco, CA 94105, United States.
Purpose: hosting the website and making it available.
Privacy contact: privacy@netlify.com.
Provider privacy statement: https://www.netlify.com/privacy/.

Access is limited to what is necessary for the relevant task. Paper and electronic records must be protected against unauthorised access, alteration, loss and destruction. Processors act under their agreements and the controller’s instructions; some recipients may act as controllers in their own right.

11. Your rights and handling your requests

Subject to the applicable conditions, you may request information, access and a copy, rectification, erasure, restriction of processing and data portability. You may object to processing based on legitimate interests or a task in the public interest. You may withdraw consent at any time by writing to info@potidental.hu; withdrawal does not affect the lawfulness of processing before withdrawal. The right to erasure does not override mandatory retention obligations.

We respond without undue delay, normally within one month. Where necessary, this may be extended by two further months; we will explain the reasons within the first month. We may verify your identity to the extent needed to fulfil your request. The first copy is generally free of charge. Exercising your rights does not require separate consent to processing.

We handle data subject requests to fulfil our GDPR obligations, under Article 6(1)(c) GDPR. Request data is retained for the time needed to handle the request and demonstrate compliance, taking applicable retention obligations into account.

12. Remedies

You may complain to us or to the Hungarian National Authority for Data Protection and Freedom of Information (NAIH). Authority contact details: 1055 Budapest, Falk Miksa utca 9–11., Hungary; postal address: 1363 Budapest, Pf. 9.; email: ugyfelszolgalat@naih.hu; website: https://www.naih.hu.

You may also seek a judicial remedy if your rights are infringed. Subject to the applicable legal conditions, proceedings may also be brought before the competent court for your place of residence or stay.


Technical Background Addendum to Potidental's Current Policy

The points below extend Potidental's current privacy and legal policy with technical background information.

We use cookies to improve your browsing experience.

Privacy policy