Privacy
Policy.
Your records.
Your rights.
Dentistry runs on information you would not hand to a stranger. Your name and number, what hurts and since when, the medicines you take, an OPG of your jaw, a scan of every tooth in your mouth. Hassaan Dental Clinic treats all of it as confidential clinical material, not as a marketing asset. This page sets out exactly what we hold, why we hold it, who else ever sees it, how long we keep it, and what you can ask us to do with it — in plain language, without the boilerplate.
Six sources.
One reason each.
Nothing collected “just in case”.
Hassaan Dental Clinic, Sultan Plaza, Bahria Enclave, Islamabad, is the data controller for the information described on this page. That means we decide what is collected and we are answerable for how it is handled. This policy covers both the clinic and this website, hassaandental.pk.
Where a section below applies only to the website and not to your clinical care, or the other way round, it says so. If anything here is unclear, ask — and we will explain it rather than point you back at the text.
Your name and contact number when you book by phone, WhatsApp, the appointment form, or in person at reception. Your medical and dental history when you complete a history form or answer Dr. Haris’s questions at the consultation. Answering honestly matters clinically — an undeclared blood thinner or diabetes changes how an extraction or implant is planned.
Clinical notes, charting, OPG and CBCT radiographs, intraoral scans, shade records, lab prescriptions, and clinical photographs. This is generated in the course of care and is retained as your dental record, which is also what allows a future dentist to understand what was done and why.
WhatsApp messages, emails, form submissions, and social media enquiries, including any photograph of a tooth you send us. These sit on the platform’s servers as well as ours. Anything you send to book or ask about treatment becomes part of your enquiry record.
When you browse hassaandental.pk we receive your IP address, browser, device type, approximate location at city level, the pages you open, and how you arrived. Used to see which treatment pages patients actually read and where the site is failing them. None of this is linked to your clinical file.
The site uses Google Analytics to measure traffic, and may use the Meta pixel and Google Ads tags to measure whether an advert led to an appointment enquiry. These set cookies and share event data with Google and Meta. They never receive your clinical information — only page and button events.
For kids’ dentistry and kids’ orthodontics, records are created in the child’s name with a parent or guardian present, and a parent or guardian gives consent for treatment and for any photography. We do not knowingly collect information from a child through the website without a parent involved.
Your dental record and
your website visit
are not the same thing.
Most privacy policies blur the two, which is how clinical information ends up feeding an advertising system. We keep them apart, and they are governed by different rules, different access, and different retention.
Your record exists so that treatment is safe, continuous, and reviewable. It is what tells Dr. Haris on your third visit what was found on your first, which tooth had a PMT base placed, and which medicine you reacted to. Held under professional confidentiality and accessible only to the treating clinician and the clinic staff who need it to run your appointment.
When you read a treatment page we record that the page was read, not who you are. This tells us that, for example, the implant page is read for four minutes but the pricing section is where people leave — so we rewrite it. Advertising tags tell us whether an advert produced an enquiry, so the budget is not wasted. You can refuse all of it and the site still works.
WhatsApp, Instagram and Facebook are not ours. When you message us on WhatsApp the message is end-to-end encrypted in transit, but metadata and your number sit with Meta, and the message stays on your phone and ours. For anything you would not want on a third party’s servers, call the clinic or discuss it in the chair instead. No system is completely secure. We use password-protected devices, restricted staff access, and reputable hosting, but we cannot guarantee that a determined attack, a lost device, or a breach at a service provider will never happen — and any policy that promises otherwise is not being straight with you. Google and Meta process data outside Pakistan, which means your website activity may be handled in jurisdictions with different rules. If that is not acceptable to you, block analytics and advertising cookies in your browser before using the site. Pakistan’s data protection framework is still developing — the Prevention of Electronic Crimes Act 2016 applies to unauthorised access to and disclosure of personal data, and a comprehensive personal data protection law has been in draft. We follow the stricter of current Pakistani law and accepted medical confidentiality practice, and this page will be updated when the law changes.
From first message
to final deletion.
Every point at which your information is created, moved, seen by someone, or destroyed — in the order it actually happens.
We record the minimum needed to call you back and book you in: your name, your number, and what you are calling about. An enquiry that does not turn into an appointment is deleted after 24 months. If you ask us to delete it sooner, we do — there is no clinical reason to keep it.
Your booking is entered in the clinic’s appointment system. We use your number to confirm, remind, and reschedule. Appointment reminders are not marketing — they are part of your care, and they continue unless you ask us to stop contacting you altogether.
At the consultation you complete a medical and dental history, and consent is taken before radiographs, scans, or treatment. Consent is explained rather than handed over as a form to sign. Photography consent is taken separately from treatment consent, and refusing photography never affects the treatment you are offered.
Because the clinic is fully digital, most of your record is digital: CBCT volumes, intraoral scan files, and CAD design files alongside the written notes. These are stored on clinic systems with password-protected access. Digital imaging is part of your record, not a marketing library — a scan is never repurposed as promotional content.
A crown, aligner, denture, or surgical guide has to be made by a laboratory, so the lab receives the scan or impression and the prescription for your case — the specific information needed for the item, not your history. If you are referred to a specialist or hospital, the relevant part of your record travels with the referral, with your agreement. Nothing goes anywhere else.
Dental records are retained for at least 10 years from your last visit. Implant, full-mouth rehabilitation, and orthodontic records are held longer, because these treatments are reviewed over decades and the original planning data matters if a component ever needs replacing. Children’s records are held until well past adulthood for the same reason.
You can ask us to delete your contact details, stop all non-clinical contact, remove your photographs, and erase an enquiry record, and we will. We cannot delete a clinical record of treatment already performed within its retention period — a record of what was done to a patient’s teeth is a legal and professional obligation, and destroying it would leave you and us unable to prove what happened. Once the retention period ends, records are securely destroyed and digital files permanently deleted.
Six things you can ask for —
and how to ask.
These are not requests we grudgingly accommodate. They are the reason a record exists in your name rather than ours.
Ask what information we hold about you and where it came from. You will get a plain answer covering your clinical record, your contact details, and your billing history — not a fee schedule and a form.
Treatment notes, prescriptions, and imaging. OPG and CBCT can be supplied as DICOM or JPEG, intraoral scans as STL. Useful if you move city, change dentist, or want a second opinion. First copy is free.
A misspelled name, a wrong number, a missing allergy, an out-of-date medication list. Factual errors are corrected on request. A clinical finding you disagree with is not deleted, but your objection is recorded alongside it.
Withdraw consent for photography, for the use of an existing image, or for a referral, at any time. Withdrawal applies from the moment you tell us; images already printed in past material cannot be recalled, but they are removed from anything we control.
Tell us to stop and we stop — no offers, no campaign messages, no promotional broadcasts. Appointment reminders and clinically necessary follow-up continue unless you ask us to stop contacting you entirely.
Raise a privacy concern with Dr. Haris directly and you will get a substantive reply, not an acknowledgement. If you are not satisfied, you retain the right to escalate to the relevant Pakistani regulatory or legal authority.
How to exercise any of these: email [email protected], call 0335-0600111, or ask at reception. Say what you want rather than citing a clause — “please send me my OPG” is a valid request. You will be asked to verify your identity with CNIC or passport before any record is released, because otherwise anyone who knows your name could ask for your dental history. Requests are answered within 30 days and usually much sooner. If a request is refused, you will be told which part was refused and why — a refusal without a reason is not an answer.
How long we keep it —
and what you can switch off.
Keep the site working — page loading, form submission, security. These cannot be switched off without breaking the site, and they carry no advertising data.
Google Analytics. Tell us which treatment pages are read and where visitors leave. Blocking them costs you nothing — every page still works exactly the same.
Meta pixel and Google Ads tags. Measure whether an advert led to an enquiry. They may cause you to see clinic adverts elsewhere. Safe to block.
Use your browser’s privacy settings to block or clear cookies, or browse in a private window. Your browser, not this clinic, is the reliable control.
Privacy questions
answered directly.
Including who sees your X-rays, whether WhatsApp is safe to use, and what happens to your photographs.
Dr. Haris Mehmood.
Privacy is not delegated to a policy document here. Dr. Haris Mehmood is the responsible person for patient information at Hassaan Dental Clinic — the same clinician who takes your history, reads your CBCT, and performs your treatment. A privacy question, a request for your imaging, or a complaint about how your information was handled reaches him, and he answers it. Write to [email protected] or call 0335-0600111.
It is your record.
Ask us anything
about it.
A question about who has seen your imaging, a request for a copy of your notes, or an instruction to stop contacting you — all of it goes to the same address, and all of it gets a real answer within 30 days.
Note: this policy describes how Hassaan Dental Clinic handles your information. It is written to be read and understood, not to limit your rights. Where it conflicts with Pakistani law or with professional confidentiality obligations, the law and those obligations take precedence over anything written here. Version dated 9 September 2026.
