1. Scope
This notice applies to visitors of enamela.app who are located in the European Union or the United Kingdom, and describes how the General Data Protection Regulation (GDPR) and the UK GDPR apply to the personal data collected from those visitors, as described in the Privacy Policy. It does not apply to patient data collected by a clinic through Enamela, which is a business-to-business relationship between the clinic and its patients.
2. Legal basis for processing
For EU and UK website visitors, Enamela processes personal data on the following legal bases: legitimate interest, for basic site operation, security, and first-party attribution needed to run the website; consent, for analytics cookies (such as GA4) that are only set after you consent through the cookie banner (see the Cookie Policy); and contractual necessity, where you sign up for an account or request a demo.
3. International transfers
Data collected from EU and UK website visitors may be transferred to and hosted in regions outside the EU/UK, including Enamela's current hosting region (ap-southeast-1, Singapore) and the regions of the subprocessors listed on the Subprocessors page. Where such a transfer occurs, Enamela intends to rely on an appropriate safeguard recognized under the GDPR or UK GDPR (such as Standard Contractual Clauses or the UK's International Data Transfer Addendum); the specific mechanism for each subprocessor is being confirmed with counsel [confirm transfer mechanism].
4. Your rights
If you are located in the EU or UK, you have rights under the GDPR/UK GDPR to access, correct, delete, or export your personal data, to object to or restrict certain processing, to withdraw consent at any time (without affecting processing before withdrawal), and to lodge a complaint with your local supervisory authority (in the UK, the Information Commissioner's Office).
To exercise these rights, contact privacy@enamela.app [confirm address]. We will respond in line with the timeframes required by applicable law.
5. Relationship to the Privacy Policy
This notice supplements, and does not replace, the Privacy Policy. Where this notice and the Privacy Policy address the same topic for an EU or UK visitor, this notice controls for that visitor.
6. No compliance claim
This notice describes our intended approach to GDPR/UK GDPR compliance for website visitors. It is not legal advice and is not a certification of compliance; specific transfer mechanisms and retention periods remain subject to confirmation with counsel.
7. Contact
Questions about this notice can be sent to privacy@enamela.app [confirm address]. [Company legal name]; [registered address].