Privacy Notice

Patient Privacy Notice

Dentaria is an independent dental practice providing a range of dental treatments on a private and NHS basis. Our practice comprises of employed and self-employed individuals. We work together to ensure our patient’s privacy is respected and their personal data is protected.

This privacy notice outlines how we handle patient information according to the UK GDPR and Data Protection Act 2018 (DPA18).

We have appointed an in-house Data Protection Officer who can be contacted using the details above.

Collecting Your Personal Data

Most of the personal information we process is provided to us directly, such as when you contact the practice, engage with our website or during your appointment.

Occasionally, however, we may receive patient information from other sources such as:

• Another dental professional that has treated you
• GP or hospital
• Carer, family member or partner
• Insurance or dental plan provider
• The NHS, a regulator or other authority, such as the Police.
• Your solicitor

We may receive data from third parties, including analytics providers such as Google located outside the UK, advertising networks such as Facebook located outside the UK providers of technical, payment and delivery services.

The Types of Personal Information We Collect and Process

The table below sets out the main types of patient information we process, the reasons why and the lawful basis for doing so.

*For this purpose, we also rely on the lawful bases set out in the Data Protection Act 2018, Schedule 2, Part 1, Paragraph 2.2.C and 2.2.D, which states processing is necessary for medical diagnosis, and the provision of health care and treatment, respectively.

**For this purpose, we also rely on the lawful bases set out in the Data Protection Act 2018, Schedule 2, Part 2, Paragraph 8.1.B. This states processing is necessary for identifying or keeping under review the existence or absence of equality of opportunity or treatment between groups of people specified in relation to that category with a view to enabling such equality to be promoted or maintained.

*** For this purpose, we also rely on the lawful bases set out in the Data Protection Act 2018, Schedule 2, Part 2, Paragraph 20.1.A. This states processing is necessary for insurance purposes.

Providing you with private dental treatment means the practice and your treating clinician must collect and process your personal data. Refusal to provide personal data connected to these lawful bases may directly impact our ability to treat you and we may be unable to continue your treatment at the practice.

We process data relating to NHS treatment under the public task legal basis. Under the NHS dental contract, we must collect and share data as defined by the NHS. For example, the NHS PR form is used to claim for free or reduced cost NHS dental services. This form collects additional information which the practice would not usually ask where the treatment is privately funded.

You can view an online copy of the NHS PR form, which includes a privacy statement by the NHSBSA.

https://www.nhsbsa.nhs.uk/sites/default/files/2020-04/Dental_PR_form_R8_20200401.pdf

Withdrawing Consent

The above table sets out where we rely on your consent to process your personal data. You can request to withdraw your consent for these purposes by contacting the practice using the contact details found at the top of this notice.

How We Store Your Data

Your information is securely stored paper and digital formats. We use online and cloud-based digital storage. Where data is stored outside of the UK, we ensure the correct legal protection are in place to ensure compliance with international data transfer rules.

How long we keep your Personal Data

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including to satisfy any medical, legal, accounting, or reporting requirements.

When deciding the correct time to keep the data, we look at the amount, nature and sensitivity, potential risk of harm from unauthorised use or disclosure, and necessary ongoing purposes of the processing.

Sharing Your Personal Data

Your information is typically used internally by staff employed by the practice and self-employed dentists working at the practice and responsible for your treatment.

There may be instances where we need to share it – for example, with:

• Your GP
• The hospital or community dental services or other health professionals caring for you
• Private dental plans (if applicable) of which you are a member.
• Dental labs
• Finance companies concerning your payment plan
• The General Dental Council and other healthcare regulators
• NHS entities such as the NHS Business Services Authority (NHSBSA)
• Any professionals advising us or you, such as any lawyers and insurance companies
• Our IT system providers
• Your next of kin, such as in an emergency
• Pharmacists
• Social services
• Translators or interpreters, such as if you need help using our products and services
• Debt recovery services providers, such as when we seek to recover any debts from you
• Any third party who buys us

We will only disclose your information on a need-to-know basis and limit any information we share to the minimum necessary.

In certain circumstances or if required by law, we may need to disclose your information to a third party not connected with your health care, including HMRC or other law enforcement or government agencies.

International Transfer of Personal Data

Where we transfer your data to third parties outside of the UK, we will ensure that certain safeguards are in place to provide a similar degree of security for your personal data. As such:

• We may transfer your personal data to countries that the UK has approved as providing an adequate level of protection for personal data by; or
• If we use US-based providers that are part of a UK approved legal privacy framework, we may transfer data to them, as they have appropriate safeguards in place; or
• Where we use certain service providers who are established outside of the UK, we may use specific contractual clauses approved by the European Commission, giving personal data the same protection it has in Europe.

If none of the above safeguards is available, we may request your explicit consent to the specific transfer. You will have the right to withdraw this consent at any time.

Knowing Your Information Rights

Under data protection law, you have rights including:

Your right of access – You have the right to ask us for copies of your personal information.

Your right to rectification – You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.

Your right to erasure – You have the right to ask us to erase your personal information in certain circumstances.

Your right to restriction of processing – You have the right to ask us to restrict the processing of your personal information in certain circumstances.

Your right to object to processing – You have the right to object to the processing of your personal information in certain circumstances.

Your right to data portability – You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.

Depending on the nature of the request we may need to ask you to provide further information to verify your identity and/or better understand your request.

How To Complain

If you have any concerns about our use of your personal information, you can make a complaint to us using the contact details at the top of this notice.

If you are dissatisfied with our response or prefer to lodge your complaint with them directly you can do using the details below.

NHS Data Opt-out

We are one of several organisations aiming to enhance patient and public care in the health and care system. As such, we are required to inform you of how the NHS uses your data for additional purposes and how you can opt-out of this arrangement.

Important information about you is recorded in a patient record whenever you use a health or care service, such as visiting one of our dental or orthodontic practices. Gathering this information will assist you in receiving the best possible care and treatment.

The information acquired about you when you use these services can be used and shared with other organisations for purposes other than your personal care, such as to assist with:

• improving the quality and standards of care provided
• research into the development of new treatments
• preventing illness and diseases
• monitoring safety, and
• planning services.

This can only happen if there is a clear legal basis for using the data. All these applications contribute to your, your family’s, and future generations’ better health and care. Confidential patient information concerning your health and care is only used in this manner where permitted by law.

Typically, anonymised data is utilised for research and planning so that you cannot be identified, in which case your sensitive patient information is not required.

If you don’t want your sensitive patient information to be used in this way, you can opt out. You do not need to do anything if you are satisfied with this information use.

Visit www.nhs.uk/your-nhs-data-matters for additional information and to register your choice to opt out.