Patient record requests,
without the panic.
A 4-step process for Irish dental clinics: log, redact, respond, prove it. So the next solicitor letter — or “I want everything you have on me” — doesn’t stop your Tuesday morning.
No credit card · EU-hosted · Built to the same data-protection standards as regulated financial software.
The 4-step process
What a real DSAR Tuesday looks like with Ghost.
A solicitor letter lands. Or a patient asks for everything you hold on them. Without a process: half a day of charts, drives, and inboxes, and someone praying nothing was missed. With Ghost: four steps, every time.
Step 01
Log the request
Record who asked, when, and the statutory due date. The one-month clock starts the moment you have enough to identify the request — not when someone finally finds time to act.
Step 02
Collect records
Pull charts, letters, imaging exports, and admin files from your practice software and shared drives. Ghost does not replace your clinical system; it is where the request is managed once documents are exported.
Step 03
Redact what shouldn’t go out
Mask third-party identifiers, staff notes that are not the patient’s data, and anything else that shouldn’t be disclosed. AI suggestions on Solo DPO; you accept, reject, or refine every box.
Step 04
Send and keep proof
Deliver via a secure time-limited link, keep a copy of what was sent, and retain an append-only audit trail you can show the DPC, an insurer, or a patient’s solicitor.
Privacy request manager
The one-month clock starts the moment you log it.
A branded intake link your reception can share, identity verification before any disclosure, and the Article 12 deadline tracked automatically on every case. Assign the task to whoever is handling it; everyone else can see exactly where it stands.
- Branded intake link for reception to share
- Identity verification before disclosure
- Article 12 deadline tracked automatically
AI-assisted redaction
PII detected. You review. Clean PDF out in minutes.
Upload exports from your practice software, scanned letters, X-ray reports. Ghost detects names, addresses, IDs, and contact details and proposes redactions. You accept, reject, or refine. The afternoon of going through a printout with a black marker disappears.
- PDFs, images, and scanned documents
- PII detected on Solo DPO; manual on Free
- Client-side rendering — files stay in your browser
Case audit log
A documented trail of how the request was handled.
Each case keeps an append-only timeline — the intake, the identity check, redaction review sign-off, the final delivery, and who downloaded the pack. The record you’d otherwise have to reconstruct from email chains after a complaint.
- Append-only timeline per case
- Identity verification recorded with timestamps
- Audit pack export when the DPC, an insurer, or counsel asks
See it end to end
A short walk-through of the workspace.
Redaction, privacy requests, and the audit log — in about three minutes.
What practices ask us
The three things every practice says first.
“We never get these.”
Most practices say that until a solicitor writes. The risk isn’t volume — it’s that the one request you do get is time-bound and high-stakes. A documented process now beats improvising under a deadline.
“Our practice software handles GDPR.”
Practice management systems are great at storing records. Ghost lives in the moment a patient asks for everything: pulling exports together, redacting third-party detail, assembling the pack, and logging what was sent.
“We have a consultant.”
Ghost makes their job easier. They get a clear case log and exportable audit pack on every request they advise on. Invite them as a member; they review without sitting in your inbox.
Pricing
Built for a 1–5 chair practice budget.
Try the workflow free. Upgrade when you want to run every request through Ghost.
Free
Try the workflow on a real request before you commit.
- 1 active case
- Manual redaction (PDF, up to 5 pages/file)
- 10 redactions per month
- 1 Article 30 register entry
Solo DPO
For owner-dentists and practice managers running the privacy programme themselves.
- Unlimited cases and redactions
- AI-assisted PII detection
- Article 30 register + audit log
- Done-with-you 45-min setup included
- €39/mo billed annually (save 20%)
Done-with-you setup
A 45-minute call to configure intake, response wording, and your first case end-to-end.
- 45-min onboarding call
- Intake template + response wording configured
- First DSAR walked through together
- Recording you can share with the team
See all plans if you operate multiple sites or work with a consultancy.
10 steps to a GDPR-confident dental practice
A free checklist covering privacy notices, the 30-day rule, the 72-hour rule, retention, and staff awareness — adapted for Irish dental practices.
FAQ
Frequently asked questions
The next request lands when it lands.
Set up the process before it does. 30-day free trial — no credit card, EU-hosted, one 45-minute setup call included.
The regulatory landscape for Irish dental practices
Regulation (EU) 2016/679 (GDPR) applies to dental practices as data controllers. Health data is special category data under Article 9; processing must meet an Article 9 condition as well as a lawful basis under Article 6. Patients have a right of access under Article 15; you must respond within one month in most cases (Article 12), provide a copy in an appropriate format, and explain exemptions where you limit disclosure.
In Ireland, the Data Protection Commission (DPC) is the supervisory authority. Personal data breaches that are likely to result in a risk to individuals must be notified to the DPC without undue delay and, where feasible, within 72 hours of becoming aware (Article 33). Sector guidance from the Irish Dental Association and privacy practitioners stresses practical steps: clear privacy notices, a named person responsible for data protection, documented subject access procedures, retention discipline, and staff awareness — not heavyweight enterprise tooling.
Ghost helps you operate documented subject access and redaction workflows; it does not provide legal advice. For practice-specific questions — especially clinical confidentiality and Article 9 conditions — speak to your insurer, consultant, or solicitor.