Privacy and cookies

This notice explains what information the Friends & Family Test survey service at fftsurvey.com collects, why we collect it, and your rights. It covers dental practices that use the service and patients who answer the survey.

Last updated: 16 October 2026

Who we are

The service is provided by Pearl Dental Software, a trading name of Baker Heath Associates Limited, Sycamore Lodge, 69 Enderby Road, Blaby, Leicester LE8 4GD. Company number: 02569282 (registered in England and Wales). ICO registration number: Z6792196.

If you have a question about this notice or your information, email us at privacy@bhasoftware.com.

Who is responsible for your information

• Practice accounts and the activity log: Baker Heath Associates Limited decides how this information is used, so we are the controller.
• Patients' survey answers and comments: each dental practice is the controller of its own patients' feedback. We store and process it for the practice, on its behalf, as its processor.

If you're a patient

Your dental practice sent you a link to this survey, or asked you to answer it on a tablet at reception. The survey asks one question about your experience, with space for an optional comment.

We record:

• your answer
• your comment, if you leave one (up to 500 characters)
• whether you're happy for the practice to share your comment publicly
• the date and time you answered
• whether you answered on a phone, a computer or a tablet at the practice

The survey doesn't ask for your name or contact details. Please don't include your name, or anyone else's personal details, in your comment.

If you filled in a paper feedback card, the practice enters only the total number of each answer. Your card and any comment on it are not entered.

We store your feedback for the practice that sent you the survey. Each practice can see only its own results and comments. The practice decides how to use its patients' feedback, for example to report its results to the NHS, or to publish comments that patients said could be made public. If you have a question about how your practice uses your feedback, please contact the practice.

When you answer, our activity log also records your IP address (see "Activity log" below).

Some practices add a button to the thank-you page, for example to leave them a Google review. That opens another website, which has its own privacy policy. Using it is up to you, and it doesn't change your survey answer.

If you're a dental practice

When you sign up, we ask for:

• your title, first name and surname
• your practice name, address, county and postcode
• your email address and a contact phone number
• a password
• whether you already use Pearl Dental Software

If you choose to, you can also add your practice logo, colour, welcome and thank-you messages, and a link to your reviews or website. We show these on your survey pages.

We use these details to set up and run your account: to confirm your email address, let you log in, show you your survey link and results, send you a password reset link when you ask for one, and tell you about important changes to the service. We do this so we can provide the service you signed up for (performance of a contract).

We may also contact you about Pearl Dental Software products and services. We ask whether you already use Pearl Dental Software so that what we send is relevant to you. We do this because we have a legitimate interest in telling dental practices about our products. You can opt out at any time by emailing privacy@bhasoftware.com or using the unsubscribe link in any marketing email.

Your account isn't created until you confirm your email address. Until then, your details are held only in encrypted form inside the confirmation link we email you, and that link stops working after 24 hours.

We never store your password itself. We keep only a salted hash of it, which can't be turned back into your password.

Your survey results and comments are your practice's data. Each practice can see only its own results, and can download its own comments. We process patients' feedback only to provide the service to your practice.

Activity log

To keep the service secure and help us fix problems, we keep a log of activity on the site, such as logins, survey answers, sign-ups and password resets. Each entry includes the IP address it came from. Entries about practice accounts also include the practice's email address, and sign-up entries include the practice name and phone number.

We keep the log to protect the service and its users (our legitimate interest in keeping it secure), and we delete entries after 2 years.

Cookies

We only use cookies that the site needs to work. We don't use advertising or analytics cookies.

• ASP.NET_SessionId keeps track of your visit, for example so the survey knows which practice it's for. It's deleted when you close your browser.
• FFTAuth keeps a practice logged in. It's only set when a practice logs in, and it's deleted when you log out or close your browser.

Practice pages, including this one, load the Montserrat font from Google Fonts. This means your browser connects to Google, which receives your IP address. The patient survey pages don't use Google Fonts.

Who else handles your information

• Hosting UK hosts the website. The website and its database are hosted in the UK.
• Mailjet, an email delivery service, sends the service's emails, such as sign-up confirmations and password reset links. Mailjet stores data in the European Union, which UK law recognises as giving adequate protection.
• Google provides the fonts on practice pages, as described under "Cookies".

We don't sell your information, and we don't share it with anyone else except these service providers or where the law requires us to.

How long we keep information

• Practice accounts: while the account is open, and for 6 years after it's closed.
• Survey answers and comments: for as long as the practice's account is kept, then deleted with it. Practices can see results for the last 2 years.
• Activity log: 2 years.

Your rights

Under UK data protection law (the UK GDPR and the Data Protection Act 2018), you have the right to:

• ask for a copy of the personal information we hold about you
• ask us to correct information that's wrong or incomplete
• ask us to delete your information
• ask us to limit how we use your information, or object to us using it
• ask for your information in a format you can take elsewhere

Some of these rights only apply in certain situations. To use any of them, email privacy@bhasoftware.com. We'll normally reply within one month.

Practices: you can change your password yourself after logging in. To change your other account details, or to close your account, email privacy@bhasoftware.com.

Patients: the survey doesn't ask for your name, so we usually can't tell which answer is yours. If you have a question about your feedback, please contact your practice first.

Complaints

If you're unhappy with how we've handled your information, please contact us first at privacy@bhasoftware.com.

You can also complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk or by phone on 0303 123 1113.

Changes to this notice

We may update this notice from time to time. The "Last updated" date at the top shows when it last changed.