Your privacy,in plain terms

This policy applies to Dr. Saad Irfan & Associates Dentistry and to all three of our clinics in DHA Phase 5, DHA Phase 8 and Clifton Block 9, Karachi. It covers information we hold about you whether you are a registered patient, the parent or guardian of a patient, an enquirer who has never attended, or simply a visitor to drsaaddentistry.pk. We are the data controller for that information. That means the decisions about what is collected and why are ours, and so is the accountability when something goes wrong.

The law we work to

We operate in Pakistan and follow the confidentiality obligations placed on registered dental practitioners by the Pakistan Medical & Dental Council, together with the Prevention of Electronic Crimes Act 2016 as it applies to electronic records. Where Pakistan's data-protection framework is developed further, this policy will be updated to meet it rather than waiting to be compelled. We have also chosen to extend the core patient-facing rights recognised internationally — access, correction, portability and objection — to every patient, regardless of where they live. It costs us little and it is the standard we would want applied to our own records.

Identity and contact details

Your name, date of birth, gender, phone number, email address, home or postal address, and the name and number of an emergency contact where you give one. For patients under 18, we also record the parent or guardian who consents to treatment.

Health and clinical information

Medical history, current medication, allergies, previous dental treatment, clinical notes, treatment plans, consent records, dental charts, intraoral photographs, digital radiographs (OPG and periapical), CBCT scans where taken, impressions and scan files, and correspondence with any specialist we refer you to. This is the most sensitive category of information we hold and it is handled accordingly: access is restricted to the clinical team involved in your care, and every access is attributable to a named user account.

Financial and administrative information

Appointment history, treatment invoices, receipts, payment method used and outstanding balances. We do not store card numbers, CVV codes or banking credentials — card payments where taken are processed on the terminal itself and we retain only the transaction reference on the receipt.

Website and technical information

When you visit drsaaddentistry.pk we collect your IP address (truncated for analytics), browser and device type, referring page, the pages you viewed and how long you stayed. This is aggregated statistical data — we do not attempt to identify individual website visitors, and we do not link website activity to a patient record.

Messages you send us

WhatsApp messages, emails, contact-form submissions, missed-call records and appointment requests, together with our replies. These are retained as part of the enquiry trail so that a booking dispute can be resolved from evidence rather than memory.

To provide dental care

The primary purpose. Diagnosis, treatment planning, obtaining informed consent, carrying out and recording treatment, prescribing where clinically indicated, arranging follow-up, and referring you to a specialist where your case needs one. A dental record is also a safety mechanism. Knowing that you reacted badly to a local anaesthetic three years ago, or that a particular tooth has already been root-treated, is what prevents the next appointment from going wrong.

To run the practice

Scheduling, sending appointment confirmations and reminders, taking payment, issuing receipts and invoices, and keeping the financial and audit records a business is required to keep.

To contact you

Appointment confirmations and reminders, post-treatment follow-up calls, recall reminders when a checkup or a scale and polish is due, and answers to anything you have asked us. These are care-related and continue for as long as you are a patient. Separately, we may occasionally tell you about a new service or a clinic. That is marketing, it is optional, and you can stop it at any time by replying STOP, clicking unsubscribe, or telling reception — without losing any care-related message.

To improve what we do

Anonymised and aggregated data — how long appointments actually take, which treatments are most requested at which clinic, where patients drop out of the booking process — is used to plan staffing and improve the service. This analysis never identifies an individual and is never sold.

To meet legal and regulatory obligations

Retention of clinical records, tax and accounting records, responding to a lawful order of a court or a competent authority, and defending a claim brought against the practice.

We do not process your information simply because we can. Each use rests on one of the following:

• Your consent — for marketing messages, for taking clinical photographs used beyond your own record, and for anything published (see 'Photographs and case studies' below).
• Providing the care you asked for — the treatment you attended for cannot be delivered without a record of it.
• A legal obligation — record retention, tax records, and responses to lawful orders.
• Vital interests — an emergency where you cannot consent and treatment cannot wait.
• Our legitimate interests — running an appointment book, preventing fraud, and securing our premises and systems, provided your interests do not override ours.

The clinical team

The dentists, hygienists, dental assistants and reception staff involved in your care see what they need to see and no more. Reception can view your appointment and balance; they do not need your clinical notes, and access is scoped accordingly.

Dental laboratories

Crown, bridge, veneer, denture and aligner work is manufactured by external dental laboratories. They receive your impressions or scan files, the shade and material prescription, and a case reference. They do not receive your medical history, your contact details or your address.

Referral to another clinician

Where your case needs a specialist we do not have in-house, or where you ask to be referred, we share the clinical information relevant to that referral — usually the notes, the radiograph and the reason for referral. We tell you before we do it.

Service providers

A small number of suppliers process data on our behalf under contract: our practice-management and records software, our website host, our email provider, and Google Analytics for anonymised website statistics. Each is bound to use the data only for the service we have engaged them for.

Insurers and employer panels

If you are claiming against a dental insurance policy or an employer panel arrangement, we will — with your instruction — provide the itemised invoice, treatment notes and radiographs that the claim requires. We share what the claim needs and nothing beyond it.

When the law requires it

We may disclose information where compelled by a court order or a lawful demand from a competent authority, where a child or vulnerable adult is at risk, or where disclosure is necessary to prevent serious harm. We disclose the minimum the situation requires and, where we are permitted to tell you, we do.

We never sell your data

Dr. Saad Irfan & Associates Dentistry does not sell, rent, trade, or license your personal or health information to anyone, for marketing, analytics, research, or any other commercial purpose. There is no price at which this changes.

Clinical photographs and radiographs are a routine part of dentistry. They document the starting position, guide the plan, and prove what changed. Taken for your record, they need no separate permission beyond your consent to treatment. Using an image anywhere else is a different decision and requires separate, written, specific consent from you.

What separate consent means here

• We ask for it in writing, for a named purpose — website smile gallery, social media, printed material, or clinical teaching.
• You may consent to one use and refuse the others.
• You may withdraw consent at any time. We will remove the image from anything we control, though we cannot recall material already printed or already reshared by someone else.
• Refusing has no effect whatsoever on your treatment, your priority or your fees.
• For a patient under 18, consent comes from the parent or guardian.

Technical measures

Patient records are held in access-controlled practice software with individual named logins — no shared accounts. The website runs over TLS. Backups are encrypted. Devices holding clinical data are password-protected and screen-locked. Access rights are reviewed when a staff member changes role and revoked the day they leave.

Physical measures

Any paper records and imaging media are stored in locked cabinets in staff-only areas. Consultation rooms are private. Screens at reception are angled away from the waiting area so the person behind you in the queue cannot read your file.

People

Every member of staff is bound by a written confidentiality obligation as a condition of employment, and clinical staff are additionally bound by the professional confidentiality duty owed by a PMDC-registered practitioner. Discussing an identifiable patient outside the clinical need to do so is a disciplinary matter.

Honesty about limits

No system is perfectly secure, and any organisation that tells you otherwise is selling something. What we can commit to is that we do not collect data we do not need, we do not keep it longer than we should, and we will tell you promptly if something goes wrong.

Keeping a record forever is as much a failure as losing it. Our retention periods:

• Adult dental records — 10 years from your last appointment.
• Records of a patient treated as a child — until their 25th birthday, or 10 years from the last appointment, whichever is later.
• Radiographs, CBCT scans and clinical photographs — retained with the record they belong to.
• Financial and tax records — as required by Pakistani tax law.
• Enquiries that never became appointments — 24 months.
• Website analytics — 14 months, in anonymised aggregate.
• CCTV, where installed at a clinic entrance — 30 days, then overwritten.

At the end of the retention period, records are securely destroyed: digital data is deleted from live systems and backups on the next backup cycle, and paper is shredded.

Access — get a copy

You can ask for a copy of what we hold about you, including your clinical notes and your radiographs. Write to contact@drsaaddentistry.pk or ask at any reception desk. We will verify your identity — this protects you, not us — and respond within 30 days. There is no charge for a first copy. Radiographs and scan files are provided in a standard format you can take to another clinician.

Correction

If something in your record is factually wrong — a misspelled name, the wrong date of birth, an allergy recorded against the wrong drug class — tell us and we will correct it. Clinical opinion recorded at the time cannot be rewritten after the fact, but your disagreement with it will be recorded alongside it, which is the professionally correct way to handle that.

Deletion

You may ask us to delete your information. We will do so where we are able. We usually cannot delete a clinical record before its retention period expires: the record is the evidence of what was done to you, and destroying it would remove your protection as much as ours. We will always tell you what we deleted and what we could not, and why.

Portability

You can ask us to send your record directly to another dental practice. We will do it, and we will not make it awkward — a patient who wants a second opinion should be able to get one without a fight.

Objection and restriction

You can object to a particular use of your information, or ask us to restrict processing while a dispute is resolved. Where we cannot agree, we will explain why in writing rather than simply declining.

Withdrawing consent

Where we rely on your consent — marketing, published photographs, teaching use — you can withdraw it at any time, without giving a reason and without any effect on your care.

Complaining

If we get this wrong, tell us first: contact@drsaaddentistry.pk. We would rather fix it than have you escalate. You retain every right to complain to the Pakistan Medical & Dental Council or to seek a legal remedy, and using our complaints procedure never removes that right.

Our website uses a small number of cookies: strictly necessary ones that make the site work, and analytics cookies that tell us, anonymously, which pages people actually read. We do not use advertising cookies, cross-site tracking pixels, or data brokers.

Full detail

The complete list — what each cookie is, who sets it, how long it lasts and how to refuse it — is set out in our Cookie Policy, and your choice can be changed at any time from the cookie banner.

We treat children, and we hold records about them. Consent to treatment for a patient under 18 is given by a parent or legal guardian, who also exercises that child's information rights on their behalf. As a child matures, we involve them directly in decisions about their own treatment to the extent they are able to understand them. From 18, the record becomes theirs alone, and a parent no longer has an automatic right of access to it.

Our website is not directed at children and we do not knowingly collect information from a child through it. If you believe a child has submitted information to us online, contact us and we will delete it.

Some of the services we use — email, website hosting, analytics, cloud backup — store data on servers outside Pakistan. Where that happens, we choose established providers with recognised security practices and contractual obligations to process data only on our instructions. Your core clinical record is held in our practice-management system with encrypted backup. Nothing about your treatment is transferred abroad for any commercial or research purpose.

If a breach occurs that is likely to affect your personal or health information, we will:

• Contain it and assess the scope immediately.
• Notify affected patients directly, in plain language, normally within 72 hours of establishing that they are affected.
• Tell you what was exposed, what we have done, and what — if anything — you should do.
• Notify the relevant authority where required.
• Publish a summary of what changed afterwards, so the fix is accountable and not just claimed.

How to reach us

Privacy requests, questions and complaints go to Dr. Saad Irfan, who acts as Privacy Officer for the practice: Dr. Saad Irfan & Associates Dentistry Email: contact@drsaaddentistry.pk Phone: +92 313 3466661 Clinics: 1. DHA Phase 5 — Plot 4-C, Shop 2, 5 Badar Commercial Street 2, Badar Commercial Area, Phase 5, DHA, Karachi, 75500 · +92 313 3466661 2. DHA Phase 8 — H#202/2, 21 Street Khayaban-e-Iqbal, DHA Phase 8 Zone A, Karachi, 75533 · +92 313 3466661 3. Clifton Block 9 — Shop No. 6, Ground Floor, Vincy Mall, Block 9, Clifton, Karachi, 75600 · +92 334 3930986 Open 9:00 AM – 11:00 PM, seven days a week, including public holidays.

Changes to this policy

We review this policy at least once a year and whenever our practices change materially. The current version is 3.0, effective 15 August 2026. Material changes are announced on this page with a new effective date, and — where the change affects how we use information we already hold about you — we will contact you directly rather than relying on you to re-read the page.