Privacy Policy
1. About this policy
128 Dental Care (“we”, “us”, “our”) is committed to protecting your privacy and keeping your personal information safe. This policy explains what personal information we collect through our website at https://128dental.co.uk and through our dental practice, why we collect it, how we use it, who we share it with, and what rights you have over it.
We handle your information in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the common law duty of confidentiality, and the professional standards set by the General Dental Council and the Care Quality Commission.
2. Who we are
Nadeem Mohammad and Afaq Mahmood, trading as 128 Dental, are the data controllers responsible for your personal information.
Practice address: 128 Mile End Lane, Stockport, [insert full postcode] Telephone: 0161 483 2823 Email: info@128dental.co.uk ICO registration number: [insert your ICO registration number]
If you have any questions about this policy or about how we handle your information, please contact our Data Protection Lead using the details above.
3. Information we collect
3.1 Information you give us through this website
When you complete our contact form, our callback request form, or our newsletter signup form, we collect:
- your first name and last name
- your email address
- your telephone number
- how you found us, for example Google, Facebook, Instagram, referral, or word of mouth
- any message or enquiry you choose to send us
Please do not include detailed information about your health or medical history in a website form. Our website forms are for general enquiries and appointment requests only. If you need to discuss a clinical matter, please telephone the practice or speak to us in person.
3.2 Information we collect automatically when you visit the website
- your IP address and approximate location
- your browser type and version, device type, and operating system
- the pages you view, the time and date of your visit, and how long you spend on each page
- the website or search term that referred you to us
This information is collected through cookies and similar technologies. Please see our Cookies Policy for full details of the cookies we use and how you can control them.
3.3 Information we collect as your dental practice
If you register with us as a patient, we collect and hold a dental care record. This includes:
- your full name, date of birth, address, telephone number, and email address
- your NHS number where applicable
- the name and contact details of your GP and your next of kin or emergency contact
- your medical history, current medication, allergies, and any relevant health conditions
- details of your dental examinations, diagnoses, treatment plans, treatments provided, and clinical notes
- clinical photographs, radiographs (x rays), intraoral scans, and study models
- appointment history, including missed and cancelled appointments
- payment and billing records, dental plan or insurance details, and finance application details
- any correspondence between you and the practice, and any complaints or feedback
3.4 Information we collect from other people
We may receive information about you from your previous dentist, your GP, a hospital or specialist, the NHS, your dental insurer or payment plan provider, or a person acting on your behalf such as a parent, carer, or person with power of attorney.
4. Special category data
Information about your health is classed as special category data under the UK GDPR and is given extra protection. We only process it where we have a lawful basis to do so and where it is necessary for your care, or where we have another legal obligation or your explicit consent.
5. Why we use your information and our lawful basis
| What we use it for | Our lawful basis |
|---|---|
| Responding to your enquiry or callback request | Our legitimate interests in dealing with enquiries about our services, or taking steps at your request before entering into a contract |
| Providing dental examination, treatment, and ongoing care | Article 6(1)(b) contract, and Article 9(2)(h) provision of health care and treatment |
| Keeping accurate clinical records as required by professional and regulatory standards | Article 6(1)(c) legal obligation, and Article 9(2)(h) |
| Managing appointments and sending appointment reminders | Article 6(1)(b) contract, and our legitimate interests in running the practice efficiently |
| Taking payment, processing dental plan claims, and referring finance applications | Article 6(1)(b) contract, and Article 6(1)(c) legal obligation for accounting records |
| Sending you our newsletter and marketing about our services | Your consent, or our legitimate interests where you are an existing patient and we are telling you about similar services |
| Handling complaints, insurance claims, and legal matters | Article 6(1)(f) legitimate interests, Article 6(1)(c) legal obligation, and Article 9(2)(f) legal claims |
| Meeting our safeguarding and public health duties | Article 6(1)(c) legal obligation, and Article 9(2)(b) or 9(2)(i) |
| Improving our website and understanding how visitors use it | Your consent for non essential cookies, and our legitimate interests in improving our service |
| Auditing and improving the quality of the care we provide | Article 6(1)(f) legitimate interests, and Article 9(2)(h) |
| Recruitment, where you apply for a role with us | Taking steps before entering into a contract, and our legitimate interests |
Where we rely on legitimate interests, we have considered whether our interests are outweighed by your rights and freedoms, and we have concluded that they are not. You have the right to object to this processing at any time. See section 11.
6. Marketing
If you subscribe to our newsletter or ask us to keep you informed about our services, we will send you occasional emails about treatments, offers, and practice news.
Every marketing email we send contains an unsubscribe link. You can also withdraw your consent at any time by emailing info@128dental.co.uk or by telephoning the practice. Withdrawing consent will not affect any marketing we sent before you withdrew it, and it will not affect the appointment reminders or clinical correspondence we need to send you as our patient.
We do not sell, rent, or trade your personal information to any third party for their own marketing purposes.
7. Cookies and analytics
Our website uses cookies and similar technologies. Some are strictly necessary for the site to function. Others help us understand how visitors use the site, and some support advertising and social media features.
We use Google Analytics and Google Site Kit to gather anonymous statistics about website usage, such as the number of visitors and which pages are most popular. We may also use tracking technologies provided by Google, Meta (Facebook and Instagram), and similar platforms.
Non essential cookies are only set where you have given your consent through our cookie banner. You can change or withdraw your cookie preferences at any time. Full details are set out in our Cookies Policy at https://128dental.co.uk/cookies-policy/
8. Who we share your information with
We only share your information where it is necessary and lawful to do so. We may share it with:
- other dental and healthcare professionals involved in your care, including specialists, orthodontists, oral surgeons, hospitals, and your GP
- dental laboratories that make crowns, bridges, dentures, aligners, and other appliances for you
- NHS bodies, including NHS England and the NHS Business Services Authority, where your treatment is provided under the NHS
- dental plan providers, insurers, and payment plan administrators where you use one
- Chrysalis Finance Limited and other finance providers, where you apply to spread the cost of treatment. We are an Appointed Representative of Chrysalis Finance Limited and act as a credit broker, not a lender
- our IT, website, hosting, email, telephone, patient management, and appointment reminder suppliers, who act as our data processors
- our payment processors and our accountants
- regulators and public bodies where the law requires it, including the Care Quality Commission, the General Dental Council, HM Revenue and Customs, and the Information Commissioner’s Office
- our professional advisers, including our lawyers, insurers, and indemnity providers
- the police, social services, or other agencies where we have a safeguarding duty or a legal obligation to disclose
Where we use a supplier to process personal information on our behalf, we have a written contract in place that requires them to keep your information secure and to use it only for the purposes we have specified.
9. Transfers outside the United Kingdom
We aim to keep your personal information within the United Kingdom and the European Economic Area. Some of our suppliers, particularly technology and analytics providers, may process information outside the UK. Where that happens, we make sure an appropriate safeguard is in place, such as UK adequacy regulations, the International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses.
10. How long we keep your information
We keep your information only for as long as we need it.
- Adult dental records: normally retained for at least 11 years from the date of your last treatment, in line with NHS records management guidance.
- Children’s dental records: retained until the patient’s 25th birthday, or their 26th birthday if the last entry was made when they were 17, or for 11 years from the last entry, whichever is longer.
- Website enquiries that do not lead to registration: normally deleted within 24 months.
- Newsletter subscriptions: kept until you unsubscribe.
- Financial and accounting records: kept for at least 6 years as required by HM Revenue and Customs.
- CCTV footage, if in use at the practice: normally retained for no more than 31 days.
- Unsuccessful job applications: normally kept for 6 months.
When information is no longer needed, we securely delete it or destroy it.
11. Your rights
Under data protection law you have the right to:
- Be informed about how we use your personal information, which is the purpose of this policy.
- Access a copy of the personal information we hold about you, including your dental records. This is known as a subject access request.
- Rectification of information that is inaccurate or incomplete. Please note that we cannot delete a clinical opinion simply because you disagree with it, but we can add a note recording your view.
- Erasure of your information in certain circumstances. This right is limited where we have a legal or professional duty to retain your dental records.
- Restrict processing of your information in certain circumstances.
- Data portability, meaning you can ask us to transfer certain information to you or to another provider in a machine readable format.
- Object to processing that we carry out on the basis of legitimate interests, and to object to direct marketing at any time.
- Withdraw consent at any time where we rely on your consent.
- Not be subject to solely automated decision making that has a significant effect on you. We do not carry out any such decision making.
To exercise any of these rights, please contact us at info@128dental.co.uk or write to us at the practice address. We will respond within one month. This may be extended by up to two further months for complex requests, and we will tell you if that applies. We do not normally charge a fee, although we may charge a reasonable fee for manifestly unfounded or excessive requests. We may ask you for proof of identity before releasing information.
12. Keeping your information secure
We take the security of your information seriously. Our measures include secure and access controlled patient management systems, encryption, password protection, locked storage for any paper records, staff training on confidentiality and data protection, restricted access on a need to know basis, regular backups, and secure disposal of records.
No transmission of information over the internet can be guaranteed to be completely secure. Any information you send to us through the website is sent at your own risk, and we ask you not to send clinical details through website forms.
13. Children
Where we treat a child, we hold a dental record for them in the same way as for an adult. A person with parental responsibility can usually access that record on the child’s behalf, unless the child is competent to make their own decisions and does not consent to that access.
Our website is not aimed at children, and we do not knowingly collect information from children through it.
14. Links to other websites
Our website contains links to other websites, including Google, Facebook, and Instagram. This policy does not apply to those websites. We are not responsible for their content or their privacy practices, and we recommend you read their own privacy policies.
15. Changes to this policy
We may update this policy from time to time to reflect changes in the law or in the way we work. The date at the top of this page shows when it was last updated. Please check back from time to time.
16. How to complain
If you are unhappy with how we have handled your personal information, please contact us first at info@128dental.co.uk or on 0161 483 2823 so that we have the chance to put things right.
You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority for data protection:
Information Commissioner’s Office Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF Telephone: 0303 123 1113 Website: https://ico.org.uk
