Privacy Policy

Who we are

The Croft Dental Practice Limited, trading as Croft Dental & Implant Practice, is the data controller for the personal information described in this policy.

• Address:
  64 Manchester Road, Wilmslow, Cheshire, SK9 2JY
• Telephone:
  01625 523 524
• Email:
  dentist@croftdental.co.uk
• Company registration number:
  [to confirm]
• ICO registration number:
  [to confirm]

We are registered with the Information Commissioner’s Office as a data controller.

Our Data Protection Lead is Dr Nikhil Oberai. Any questions about how we handle your information should be directed to them at the address above.

What this policy covers

This policy explains how we collect, use, store and protect personal information about:

• Patients and prospective patients
• Visitors to our website
• People who contact us by telephone, email, WhatsApp or through our website
• Referring dental practices and their patients
• Job applicants

It covers both the information we hold as your dental practice and the information collected through our website.

The information we collect

Information about patients

• Personal details:
  Name, date of birth, home address, telephone numbers, email address, and where relevant your next of kin or emergency contact.
• Health information:
  Your medical history, medications, allergies, dental history, clinical notes, treatment plans, radiographs and other images, laboratory prescriptions, and correspondence with other healthcare professionals about your care. This is special category data under UK GDPR and we treat it accordingly.
• Financial information:
  Payment records, outstanding balances, and where you use finance, the fact that an application was made. We do not hold your card details, since payments are processed by our payment provider.
• Communications:
  Records of appointments, correspondence, telephone notes, emails, WhatsApp messages and enquiry form submissions.
• Images:
  Clinical photographs and radiographs taken as part of your care. Where we wish to use images for teaching, publication or marketing, we ask for your separate written consent and you can withdraw it at any time.

Information about website visitors

Your IP address, approximate geographical location, browser type and version, operating system, referral source, pages viewed, and how you navigate the site. This is collected through cookies and analytics tools, as set out in our cookie policy.

Information about referring dentists

Practice name and address, referring clinician name and GDC number, and correspondence relating to referred patients.

Information about job applicants

Anything you provide in an application, including CV, employment history, qualifications, GDC registration where applicable, and references.

How we use your information and our lawful basis

Under UK GDPR we must have a lawful basis for processing your information. Where we process health information, we also need a separate condition under Article 9.

What we use it for	Lawful basis	Article 9 condition, where health data
Providing dental care and treatment	Legitimate interests	Provision of health or social care treatment
Keeping clinical records	Legal obligation	Provision of health or social care treatment
Managing appointments and reminders	Legitimate interests	Provision of health or social care treatment
Taking payment and managing accounts	Contract	Not applicable
Referring you to another clinician	Legitimate interests	Provision of health or social care treatment
Responding to your enquiries	Legitimate interests	Where relevant, provision of health care
Meeting legal and regulatory obligations, including CQC and GDC	Legal obligation	Reasons of public interest in public health
Dealing with complaints, claims or legal proceedings	Legal obligation and legitimate interests	Establishment or exercise of legal claims
Sending marketing communications	Consent	Not applicable
Using your images in marketing or teaching	Consent	Explicit consent
Website analytics and advertising	Consent	Not applicable
Recruitment	Legitimate interests and contract	Not applicable

• Where our basis is consent:
  You can withdraw it at any time and we will stop that processing. Withdrawing consent for marketing does not affect your dental care.
• Where our basis is legitimate interests:
  Our interest is in providing and administering dental care safely and effectively. You have the right to object, and we will stop unless we have compelling grounds to continue.

Marketing

We will only send you marketing about our treatments and offers if you have agreed to receive it.

You can opt out at any time by using the unsubscribe link in any email, replying to any message asking us to stop, or contacting the practice.

We do not sell your information and we do not share it with third parties for their own marketing.

Appointment reminders, recall notices and information directly about your treatment are not marketing and will continue regardless, since they form part of providing your care.

Who we share your information with

We share your information only where necessary. This may include:

• Other healthcare professionals:
  Specialists we refer you to, your GP where relevant, and dental laboratories producing your crowns, dentures or aligners.
• Our software and service providers:
  Who process information on our behalf under written contracts, including our practice management and booking system, our patient communication system, our website host, and our email provider.
• Finance providers:
  Where you apply for finance, so your application can be processed.
• Insurers and dental plan administrators:
  Where you are covered by a plan or making a claim.
• Regulators:
  Including the Care Quality Commission and the General Dental Council, where we are required to provide information.
• Our professional advisers:
  Including indemnity providers, solicitors and accountants, where necessary.
• Law enforcement, courts or public authorities:
  Where we are legally required to disclose.

We do not share your information with anyone else without your consent unless we are legally obliged to do so.

Where your information is held

Your information is held on secure systems within the UK or the European Economic Area wherever possible.

Some of our service providers store data outside the UK. Where that happens, we make sure appropriate safeguards are in place, such as UK approved standard contractual clauses or an international data transfer agreement, so your information receives equivalent protection.

How long we keep your information

• Adult clinical records:
  Retained for at least eleven years from the date of the last entry, in line with guidance for dental records.
• Records of patients treated as children:
  Retained until the patient’s twenty-fifth birthday, or eleven years after the last entry, whichever is longer.
• Radiographs and clinical images:
  Retained for the same period as the associated clinical record.
• Financial records:
  Retained for at least six years, in line with HMRC requirements.
• Enquiries that do not become patients:
  Retained for up to [X] months and then deleted.
• Marketing consents and preferences:
  Retained until you withdraw consent, plus a record of the withdrawal so we do not contact you again in error.
• Job applications from unsuccessful candidates:
  Retained for 30  months and then deleted.
• Website analytics data:
  Retained according to the settings in each analytics platform, as described in our cookie policy.

Your rights

Under UK data protection law you have the following rights.

• The right to be informed:
  To know what we do with your information, which is what this policy sets out.
• The right of access:
  To ask for a copy of the information we hold about you. This is free of charge and we will respond within one month. We may extend this by two further months for complex requests, and we will tell you if we do.
• The right to rectification:
  To have inaccurate information corrected. Note that clinical records cannot be altered retrospectively, but we can add a note recording your disagreement.
• The right to erasure:
  To ask us to delete your information. This right is limited where we are legally required to retain clinical records, which is usually the case for patients we have treated.
• The right to restrict processing:
  To ask us to limit how we use your information in certain circumstances.
• The right to data portability:
  To receive certain information in a machine readable format, or have it transferred to another controller.
• The right to object:
  To object to processing based on legitimate interests, and to object to direct marketing at any time.
• Rights relating to automated decision making:
  We do not make decisions about your care using automated processing alone.

To exercise any of these rights, contact us at dentist@croftdental.co.uk or write to the practice.

Identification. We may ask you to confirm your identity before releasing information, to make sure we are not disclosing it to the wrong person. We will ask only for what is proportionate, which will usually be one form of identification rather than certified documents.

There is no charge for exercising your rights. We may charge a reasonable fee only where a request is manifestly unfounded or excessive, or for additional copies.

Security

We take appropriate technical and organisational measures to protect your information, including access controls, encryption where appropriate, secure storage of paper records, staff training, and confidentiality obligations for everyone working at the practice.

No system is completely secure, and information sent over the internet is never entirely without risk.

If a data breach occurs that is likely to result in a risk to your rights and freedoms, we will report it to the ICO within seventy two hours and will tell you directly where the risk is high.

WhatsApp, text and email

Where you contact us by WhatsApp, text message or ordinary email, please be aware these are not secure channels for clinical information.

We use messaging for general enquiries, appointment arrangements and call backs. We cannot provide clinical advice by message and we will ask you to come in.

Please do not send clinical information or photographs of your teeth by message or email. If we need those, we will tell you how to send them securely.

Messages are not automatically part of your clinical record. Where a message contains information relevant to your care, we will record it in your notes.

Cookies and website analytics

Our website uses cookies and similar technologies to make the site work, understand how it is used, and where you consent, to support advertising.

Non essential cookies are only set with your consent, which you give through the banner when you first visit and can change at any time.

Full details of the cookies used are set out in our cookie policy.

[Cookie Policy]

Children

We treat children and hold records for them in the same way as adults, with the same protections.

Where a child is not able to make decisions about their own information, a parent or guardian exercises those rights on their behalf. As children grow older they may be able to make decisions themselves, and we assess this individually.

Links to other websites

Our website links to other sites, including our online booking system and our finance provider. We are not responsible for their privacy practices and we recommend reading their policies.

Changes to this policy

We review this policy regularly and may update it. Any changes will be posted here with a revised date at the top.

Where changes are significant, we will make that clear rather than relying on you to notice.

Complaints

If you are unhappy with how we have handled your personal information, please tell us first so we have the chance to put it right. Contact us at dentist@croftdental.co.uk or write to the practice.

You also have the right to complain to the Information Commissioner’s Office.

Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Telephone: 0303 123 1113
Website: ico.org.uk

Complaints about your dental care rather than your data are handled under our separate complaints procedure.

Contact us

Questions about this policy or about how we handle your information:

Croft Dental & Implant Practice
64 Manchester Road, Wilmslow, Cheshire, SK9 2JY
01625 523 524
dentist@croftdental.co.uk