Policies

Privacy Policy

R&G Dental and Implant Surgery is committed to protecting your personal information and handling it lawfully, fairly, and transparently. We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and applicable professional and healthcare record-keeping standards.

The personal information we collect

To provide safe and appropriate dental care, we may collect and store the following information:

your full name, date of birth, age, address, telephone number, and email address;
details of your GP and other relevant healthcare professionals;
your medical and dental history, including past and current conditions;
clinical notes, treatment records, referrals, radiographs, clinical photographs, scans, and study models;
records of consent to treatment, treatment plans, and consent to referrals;
correspondence between you, the practice, and other healthcare professionals or organisations involved in your care;
notes of relevant conversations, complaints, incidents, concerns, or safeguarding matters where a record needs to be kept;
payment, insurance, or dental scheme information where relevant to your treatment or administration;
information you submit through our website, contact forms, call-back forms, or booking forms.

How we use your personal information

We use your information to:

provide you with safe, effective, and appropriate dental care;
assess your medical suitability for treatment;
arrange, confirm, reschedule, and manage appointments;
contact you about your enquiry, treatment, appointment, booking issue, missed appointment, or any delay affecting your care;
communicate with you following a request submitted through our website;
make referrals and liaise with your GP, hospitals, specialists, laboratories, insurers, or dental schemes where necessary;
maintain accurate clinical records and comply with legal, regulatory, professional, and contractual obligations;
investigate complaints, incidents, claims, or concerns;
improve our services, systems, and patient administration.

We will only use your personal data for marketing where we have a lawful basis to do so, such as your consent where required.

Our lawful bases for processing

Depending on the purpose, we process your personal data on one or more of the following lawful bases:

performance of a contract – to provide dental services and manage your appointments;
legal obligation – to comply with healthcare, regulatory, safeguarding, tax, employment, and record-keeping requirements;
legitimate interests – to operate and improve our practice, follow up on enquiries or appointment issues, maintain records, and protect the practice and patients;
vital interests – where necessary to protect someone’s life;
provision of health or social care and public health / healthcare management grounds under Article 9 UK GDPR for special category health data;
consent – where consent is specifically required, such as for certain optional uses of your data.

Where we rely on consent, you may withdraw it at any time. This will not affect any use of your information that took place before consent was withdrawn.

Information from website forms and follow-up contact

If you submit your details through rgdental.co.uk, including an enquiry form, booking form, or call-back request, we may use that information to contact you about:

your enquiry or treatment request;
appointment availability;
booking problems or incomplete bookings;
delays, cancellations, or follow-up relating to your dental care;
administrative matters connected with your enquiry or appointment.

We use this information to help ensure patients receive timely support and do not miss important follow-up where there has been an issue or delay.

Sharing your information

We only share your personal data where it is necessary, lawful, and proportionate. This may include sharing with:

your GP;
other dentists, specialists, hygienists, therapists, or healthcare professionals involved in your care;
hospitals, laboratories, referral providers, or community dental services;
dental payment plan providers, insurers, or private dental schemes where relevant;
IT service providers, practice management software providers, website providers, and other data processors who support our services under appropriate contractual controls;
legal advisers, regulators, NHS bodies, professional bodies, or public authorities where required by law or regulation;
safeguarding bodies, the police, courts, or other authorities where disclosure is necessary and lawful.

We disclose information on a strict need-to-know basis and only to the extent necessary for the relevant purpose.

How long we keep your information

We retain patient records in line with applicable legal and healthcare records management requirements. In general:

dental clinical care records are retained for at least 11 years;
where the record relates to a child, records are retained until the 25th birthday or for the applicable minimum retention period, whichever is longer;
some records may need to be retained for longer where required for legal claims, safeguarding, regulatory reasons, implants or medical devices, or other legitimate record-keeping needs.

We also retain employee and administrative records only for as long as necessary for the purpose for which they were collected and in accordance with applicable legal requirements.

Keeping your information secure

We take appropriate technical and organisational measures to protect your personal data. These measures may include:

secure practice management systems;
password-protected devices and accounts;
role-based staff access controls;
locked storage for paper records where used;
audit trails and access monitoring;
routine backups;
staff confidentiality obligations and data protection training.

Although we take security seriously, no method of transmission or storage is completely risk-free. We continuously review our systems and procedures to reduce risk.

Personal data breaches

We have procedures in place to detect, investigate, contain, and respond to suspected personal data breaches. Where required, we will report a personal data breach to the Information Commissioner’s Office (ICO) without undue delay and, where feasible, within 72 hours of becoming aware of it. Where legally required, we will also inform affected individuals.

We maintain a record of personal data breaches, including the facts of the breach, its effects, and the remedial action taken.

Your rights

Subject to legal and professional restrictions, you have the right to:

request access to the personal data we hold about you;
request correction of inaccurate or incomplete information;
request erasure in certain circumstances;
request restriction of processing in certain circumstances;
object to certain types of processing;
request transfer of your information where applicable;
withdraw consent where processing is based on consent;
complain to the Information Commissioner’s Office (ICO).

Requests relating to your records should be made in writing to the Data Protection Lead using the contact details above. We may need to verify your identity before responding.

A parent or person with parental responsibility may request access to a child’s records where this is lawful, in the child’s best interests, and not contrary to the wishes of a competent child.

If you do not want your information used in this way

If you do not want your personal data to be used or disclosed in the ways described in this policy, please contact the practice. We will consider your request carefully. However, in some cases this may affect our ability to provide you with safe and appropriate dental care or comply with our legal obligations.

Complaints

If you have concerns about how we handle your personal data, please contact us first so we can try to resolve the matter. You also have the right to complain to the Information Commissioner’s Office (ICO).

Updates to this policy

We may update this Privacy Policy from time to time to reflect changes in legal requirements, professional guidance, technology, or the way we operate. The latest version will be made available through rgdental.co.uk and at the practice.

Last updated: 23/04/2026

‍