Westleigh Dental Care is committed to protecting your privacy and ensuring that your personal information is handled securely, fairly and transparently.

We are a Data Controller and process personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Data (Use and Access) Act 2025, and other applicable data protection legislation.

This Privacy Notice explains what information we collect, why we use it, how we protect it, who we may share it with, how long we keep it and your rights in relation to your personal information.

Who we are

Westleigh Dental Care is responsible for the personal information that we hold about our patients.

Our Data Protection Lead is Rhodri Davies.

If you have any questions or concerns about how we use your personal information, please contact the practice and ask to speak to our Data Protection Lead.

What personal information do we collect?

To provide safe and appropriate dental care, we may collect and hold information including:

  • Your name, address, telephone number, email address and other contact details.
  • Your date of birth and other information used to identify you.
  • Your medical and dental history.
  • Information about medication, allergies and medical conditions.
  • Clinical notes, diagnoses and treatment records.
  • Dental charts, radiographs, photographs and other clinical images.
  • Treatment plans, consent records and estimates.
  • Appointment and attendance history.
  • Correspondence between you and the practice.
  • Correspondence with other healthcare professionals involved in your care.
  • Information relating to referrals.
  • Payment, account and direct debit information.
  • Details relating to any dental care plan or membership arrangement you have with us.
  • Information relating to complaints, concerns or feedback.
  • Other information that is reasonably necessary for us to provide your dental care or operate the practice.

Health information is classed as special category personal data and receives additional protection under data protection law.

We may also hold personal information relating to employees, self-employed clinicians, contractors, suppliers and other individuals with whom the practice has a professional relationship.

Where do we obtain your information?

Most of the information we hold is provided directly by you.

We may also receive information from other sources where appropriate, including:

  • Your previous dental practice.
  • Dentists, specialists and other healthcare professionals involved in your care.
  • Dental laboratories.
  • Hospitals and other healthcare providers.
  • A parent, guardian, carer or other person authorised to act on your behalf.
  • Dental plan or payment providers.
  • Other organisations where there is a lawful reason for information to be provided to us.

Why do we use your personal information?

We use personal information where necessary to:

  • Provide safe, appropriate and effective dental care and treatment.
  • Maintain accurate clinical records.
  • Assess and monitor your oral health.
  • Arrange appointments and communicate with you about your care.
  • Send appropriate recalls and reminders.
  • Make and manage referrals.
  • Obtain laboratory work required for your treatment.
  • Manage treatment plans and dental care plans.
  • Process payments and administer patient accounts.
  • Respond to enquiries, complaints and concerns.
  • Meet our professional, regulatory and legal obligations.
  • Protect patients, staff and the practice where necessary.
  • Maintain the security and effective administration of the practice.

We will not use your personal information for purposes that are incompatible with the reason it was collected unless permitted or required by law.

 

Our lawful basis for processing your information

Data protection law requires us to have a lawful basis for processing personal information.

Depending on the circumstances, we may process your personal information because:

  • It is necessary to provide dental care or services requested by you.
  • It is necessary for the performance of a contract or to take steps before entering into a contract.
  • We have a legal or regulatory obligation to process or retain the information.
  • It is necessary for our legitimate interests in operating a safe, effective and properly administered dental practice, provided those interests do not override your rights and freedoms.
  • It is necessary to protect someone’s vital interests in exceptional circumstances.
  • You have provided consent where consent is the appropriate lawful basis.

Because dental records contain information about your health, we must also have an appropriate condition for processing special category data.

Where applicable, health information is processed because it is necessary for the provision and management of health care in accordance with Article 9(2)(h) of the UK GDPR and associated UK data protection legislation.

We do not rely on your consent as the general basis for maintaining your dental records. This means that withdrawing consent does not normally require us to delete information that we are legally or professionally required to retain.

Who may we share your information with?

We will only share personal information where there is an appropriate reason to do so and will take reasonable steps to ensure that information is shared securely.

Depending on your care and circumstances, information may be shared with:

  • Dentists, hygienists and other healthcare professionals involved in your care.
  • Dental specialists and referral centres.
  • Dental laboratories.
  • Hospitals, GPs and other healthcare providers where appropriate.
  • Dental plan and payment providers where necessary to administer your plan.
  • Payment processing and direct debit providers.
  • Providers of dental practice management, imaging, IT, communications, data storage, backup and other systems used by the practice.
  • Professional advisers, insurers and indemnity providers where necessary.
  • Regulatory, safeguarding, law enforcement or other public authorities where we are legally required or permitted to disclose information.
  • Legal advisers, courts or debt recovery services where necessary and lawful.

Where another organisation processes information on our behalf, we require appropriate arrangements to protect your information.

We will not sell your personal information.

Keeping your information secure

We take appropriate technical and organisational measures to protect personal information against unauthorised access, accidental loss, disclosure, alteration or destruction.

Access to patient information is restricted to individuals who require it for their role, and electronic information is protected through appropriate security measures, access controls, backup arrangements and practice procedures.

Staff and clinicians are required to maintain confidentiality.

Information processed outside the UK

Some organisations providing services to the practice may use systems or infrastructure located outside the United Kingdom.

Where personal information is transferred internationally, we take appropriate steps to ensure that the transfer complies with UK data protection law and that appropriate safeguards are in place.

How long do we keep your information?

We retain information only for as long as there is a clinical, legal, regulatory or legitimate reason to do so.

As a general rule, patient dental records are retained for at least 10 years after the patient’s last attendance at the practice or, for children and young people, until at least their 25th birthday, whichever provides the longer retention period, unless there is a reason for them to be retained for longer.

Other information is retained in accordance with applicable legal, regulatory, financial and professional requirements and the practice’s retention arrangements.

When information is no longer required, it will be securely deleted or destroyed where appropriate.

Your rights

Data protection law gives you a number of rights in relation to your personal information.

Depending on the circumstances and the lawful basis on which we process your information, these may include the right to:

  • Be informed about how your personal information is used.
  • Access the personal information we hold about you.
  • Rectification of information that is inaccurate or incomplete.
  • Erasure of your personal information in certain circumstances.
  • Restriction of the way your information is processed in certain circumstances.
  • Object to certain types of processing.
  • Data portability in certain circumstances.
  • Withdraw consent where processing is based specifically upon your consent.

These rights are not absolute and do not always apply to dental or clinical records. For example, we may be required to retain information even where you ask us to delete it.

If you wish to exercise any of your data protection rights, please contact the practice.

We will respond to requests within the timescales required by data protection law.

Marketing communications

We do not send any direct marketing communications.

Appointment reminders, recalls and communications that are necessary in connection with your dental care or the administration of services you receive from us are not marketing communications.

Data protection concerns and complaints

If you have any questions or concerns about the way we collect, use or protect your personal information, or believe that your data protection rights have not been respected, please contact us in the first instance.

Please address data protection concerns or complaints to:

Rhodri Davies
Data Protection Lead
Westleigh Dental Care

We will acknowledge a data protection complaint within the period required by law and will take appropriate steps to investigate it, keep you informed where necessary and communicate the outcome.

If you remain dissatisfied with the way we have handled your personal information or your complaint, you have the right to raise your concern with the Information Commissioner’s Office (ICO).

The ICO can be contacted through its website or by telephone on 0303 123 1113.

Changes to this Privacy Notice

We review this Privacy Notice regularly and may update it where our services, systems, legal obligations or the way we use personal information change.

Where there is a significant change affecting how we use your personal information, we will take appropriate steps to bring this to your attention.

Last reviewed: September 2026
Next review: September 2027