AI and patient data in a dental practice: the lawful basis, the DPIA and the five questions before any tool touches the records

A third of dentists in one 2026 survey use AI daily, mostly on radiographs, and practice management vendors are adding AI clinical-note transcription to their higher tiers. Admin AI, the kind that reads the diary and drafts the recall letter, has no UK benchmark yet. The rules are the same for all of it, and they are the practice's rules to meet, not the vendor's. This is what has to be true before a tool reads a patient record.

Two lawful footings

Patient records are health data, which is special category data under UK GDPR. Processing it needs an Article 6 lawful basis and, separately, an Article 9 condition. For a practice the usual pair is a legitimate interest or contract basis under Article 6 and the provision of health care under Article 9(2)(h), with the processing done by or under the responsibility of a professional subject to an obligation of secrecy. A tool that reads records for recalls or follow-ups sits inside that purpose; one that reads them to sell cosmetic treatment does not, and needs its own footing, which is usually consent.

The point for the owner: "the patient consented to treatment" is not consent to AI processing, and the practice's privacy notice has to say what the tool does.

The DPIA

A data protection impact assessment is required where processing is likely to be high risk, and the ICO's list of triggers includes both the use of innovative technology and the processing of special category data on any scale. An AI tool on patient records meets both. The DPIA is a document the practice writes before processing starts: what the tool does, what data it touches, what could go wrong for a patient, what the practice has done about it, and the information governance lead's sign-off. For a small practice it is four pages, and it doubles as the answer to a CQC inspector's question about the tool.

The processor contract

The vendor processes on the practice's instructions and is a processor; the practice is the controller. The contract has to say so and has to limit what the vendor may do with the data. If the vendor decides what the data is used for, including improving its own model, it is a controller too, and the contract has to reflect that. Dentistry's trade press now publishes questions to put to AI suppliers; the five that matter most follow.

Five questions before yes

1. Does the tool train on our patients' data? The answer has to be a written no, in the contract, not a reassurance.
2. Where is the data processed and how long is it kept? Named locations and a retention period that ends.
3. Who at the vendor can see it, and is there an audit log per user? Including the vendor's own staff.
4. What does the tool do when it is unsure? Drafts for review, or acts? For anything patient-facing, the answer has to be drafts.
5. What happens when we leave? Data returned or deleted, in writing, on a date.

A supplier who cannot answer all five in writing has told you the answer to the first.

Where Overlyft sits

An AI assistant set up by Overlyft runs on the practice's own commercial account with the model provider, whose terms exclude training on the practice's data; the practice holds the keys and sees the usage. The assistant itself retains nothing after a task, drafts everything for review and acts on nothing patient-facing by itself, and the DPIA template and privacy-notice paragraph are part of the install. The practice remains the controller, the information governance lead signs the DPIA, and a GDC registrant reviews anything that could be read as clinical. The CQC guide covers where the DPIA sits in the inspection file; the review reply writer is the everyday case of the same duty, confidentiality in public. This is general information, not legal advice.