Effective Date: 1 January 2026
This Privacy Policy outlines how Tooth Castle Sylhet (“the Clinic,” “We,” “Us”) collects, uses, discloses, and protects the personal, medical, and financial information (“Patient Data”) provided by our patients (“You,” “Patient”). Our commitment to data privacy is a core extension of our brand pillar: Trust and Transparency.
We collect various types of Patient Data necessary to provide safe, effective, and personalized dental care, which fall into the following categories:
This includes information used to identify and contact you:
Full legal name, address, date of birth, and gender.
Contact details: Phone number, email address, and secure WhatsApp ID (especially for NRB patients).
National ID card (NID) or Passport details (for NRB/foreign patients) for verification purposes.
This is the sensitive information required for diagnosis and treatment planning:
Dental and medical history (past and present conditions, medications, allergies).
Clinical notes, examination findings, and treatment plans.
Diagnostic records: X-rays (RVG, OPG, CBCT scans), intra-oral photos, and digital scans used for Digital Smile Design.
Informed consent forms for specific procedures.
This includes data necessary for billing and financial transactions:
Payment records, transaction history, and outstanding balances.
Details required for processing card payments or mobile financial services (MFS) transactions (note: we do not store full credit card numbers).
Documentation related to EMI agreements and payment plans with third-party financial partners.
Information collected when interacting with our online presence:
Website usage (IP address, browser type, referring pages) for improving website experience.
Records of communication via WhatsApp or remote consultation platforms.
We process your Patient Data only for legitimate and defined purposes, primarily based on the necessity to provide professional healthcare and fulfill legal obligations.
| Purpose of Use | Details and Application |
Provision of Care (Primary) | Examination, diagnosis, treatment planning, and procedure execution. Ensures the safety and suitability of all treatments. |
Communication | Sending appointment reminders, follow-up instructions, aftercare advice, and responding to your inquiries. Critical for NRB remote consultations. |
Billing & Administration | Processing payments, managing insurance claims (if applicable), handling EMI documentation, and maintaining accurate financial records. |
Quality Control & Safety | Auditing clinical records, monitoring sterilization protocols, and ensuring compliance with clinical best practices and regulatory requirements. |
Research & Improvement | Using anonymized or aggregated data to evaluate treatment effectiveness and improve service protocols within the Clinic. |
Marketing (With Consent) | Only utilizing clinical photos (before/after) or contact details for promotional messages if explicit, written consent is provided. |
We treat your Patient Data with the highest level of confidentiality. Data is only disclosed under the following controlled circumstances:
We share the necessary clinical data (e.g., impressions, digital scans, specific material requirements) with external dental laboratories and specialized material suppliers for the fabrication of restorations (crowns, veneers, dentures, aligners). These partners are required to adhere to strict confidentiality agreements.
Financial Partners: We share necessary identification and transaction data with banks and EMI partners solely for the purpose of processing agreed-upon financing plans.
Legal/Regulatory: We will disclose data when legally required to do so by local law enforcement, regulatory bodies, or in compliance with a court order.
We will share your Patient Data, including copies of records and X-rays, with other healthcare providers only upon your explicit written request and signed authorization (e.g., if you are moving abroad or require a specialist referral).
Tooth Castle implements robust security measures to protect your data against unauthorized access, disclosure, alteration, or destruction, particularly concerning sensitive digital health records.
Secure Digital Storage: Clinical and financial data is stored on secured, encrypted servers with restricted access limited only to authorized Clinic personnel (dentists, clinic manager, and administration staff).
Physical Security: Hard copies of records (consent forms, original lab prescriptions) are stored in locked, access-controlled filing systems.
Digital Records: Consistent with our commitment to modern care, all digital records are backed up regularly to ensure data integrity and availability.
You have the following rights regarding your Patient Data held by Tooth Castle:
Right to Access: You may request a copy of your personal and clinical records. This request must be submitted in writing and may be subject to a nominal administrative fee.
Right to Correction: You have the right to request the correction of any inaccurate or incomplete personal or health information we hold about you.
Right to Withdraw Consent: You may withdraw your consent for any non-essential data processing (such as marketing) at any time without affecting the legality of processing carried out before withdrawal. Withdrawing consent for clinical purposes may impact our ability to provide certain treatments.
Right to Know Disclosure: You have the right to be informed of any disclosures of your health data to third-party partners (e.g., external laboratories).
For any questions regarding this Privacy Policy, your Patient Data, or to exercise any of your rights, please contact our designated Data Protection Officer:
Email: privacy@toothcastlesylhet.com
Address: Shwapnonir (Ground Floor), 17/A, Block-C, Main Road, Shahjalal Uposhohor, Sylhet Sadar, Sylhet-3100, Bangladesh.
Attention: Clinic Manager / Data Protection Officer
We reserve the right to modify this Privacy Policy at any time. Any changes will be posted on our website and, where appropriate, notified to you directly. Continued use of our services after such changes constitutes your acceptance of the new terms.
