Who we are
Medical and Dental Limited(“we”, “us”) is the data controller for the personal information we collect about you. We are registered with the Information Commissioner’s Office (ICO) under registration number TBC. Our registered office is 20 Old Brompton Road, South Kensington, London, SW7 3DL.
For privacy queries please call us on 020 3745 7520or write to the registered office above, marked “Data Protection”.
The information we collect
- Identity & contact data: name, date of birth, address, email, phone number.
- Clinical records (special-category health data): medical history, dental records, X-rays, intra-oral scans, photographs, treatment plans, clinical correspondence and consent forms.
- Financial data: payment information, finance applications where introduced.
- Website & communications: form submissions, emails, phone calls (which may be recorded for training and quality), cookies and similar technologies (see our Cookies Policy).
Why we use it and our lawful bases
- Direct care — to assess, plan and deliver dental treatment. Lawful basis: Article 6(1)(b) contract and Article 9(2)(h) provision of health care.
- Compliance — to meet our regulatory duties under the GDC, CQC, Health and Social Care Act 2008 and HMRC. Lawful basis: Article 6(1)(c) legal obligation and Article 9(2)(h)/(i).
- Communications — to confirm appointments, provide aftercare and respond to enquiries. Lawful basis: contract or legitimate interests.
- Marketing — only where you have given consent. You can withdraw consent at any time.
Who we share it with
We share information only when necessary, with: your other healthcare providers and referrals (with your consent); dental laboratories and radiography providers under contract; our regulator (CQC), professional indemnifier, and the GDC if required; finance providers where you apply for treatment finance; HMRC and other lawful authorities. We never sell your data.
How long we keep it
Adult dental records are retained for a minimum of 11 years after the date of the last treatment. Records for patients under 18 are kept until the patient’s 25th birthday, in line with recognised dental records retention guidance and our regulatory duties.
International transfers
Where we use software providers based outside the UK, we rely on the UK International Data Transfer Agreement and equivalent safeguards approved by the ICO.
Your rights
- Access a copy of your records (subject access request).
- Request correction of inaccurate information.
- Request erasure where there is no overriding legal or clinical reason to retain the data.
- Restrict or object to certain processing.
- Withdraw any consent you have previously given.
- Complain to the ICO at ico.org.uk or call 0303 123 1113.
Security
Your records are stored on access-controlled UK or EU clinical systems with encryption in transit and at rest. Access is restricted to authorised clinical and administrative staff bound by confidentiality agreements.
Updates
We may update this policy as our processes change. The date at the top of this page tells you when it was last reviewed.