Privacy Policy for Patient Data

Sprotbrough Dental Practice

Sprotbrough Dental Practice takes great care to protect the personal data we hold for our patients
in line with the requirements of the Data Protection Act 2018, which is the UK’s implementation
of the General Data Protection Regulation (UK GDPR).

The purpose of collecting and storing personal data is to ensure we can:

• Provide appropriate, safe and effective dental care, treatment and advice.
• Fulfil any contracts we hold in relation to patient care.
• Carry out business administration.

Personal Data We Hold

The personal data we process includes:

• Name, address, and date of birth
• Unique identification number
• Next of kin
• Email address
• Phone numbers
• GP contact details
• Occupation
• Medical history
• Dental care records
• Photographs
• Family group information
• Payment plan details
• Financial information
• Credit card receipts
• Correspondence
• Complaint records

A full inventory of personal data held is available to patients on request and is also included
in our Privacy Notice.

National Opt-out Policy

Sensitive personal information is only used to provide dental care and is not shared for research
or non-clinical purposes. For this reason, the National Opt-out Policy introduced in March 2020
is not currently applied.

If this changes, the policy will be introduced accordingly.

Disclosure to Third Parties

Personal data will not be disclosed to anyone who does not need access. We may share information
when required by law or to deliver services.

Third parties may include:

• Regulatory authorities (e.g. General Dental Council, Care Quality Commission)
• NHS Local Authorities
• Dental payment plan administrators
• Insurance companies
• Loss assessors
• Fraud prevention agencies
• Prospective buyers of the practice

Information may also be shared if it is in a patient’s best interest or if there is concern about
risk of harm or abuse.

Personal Privacy Rights

Under UK GDPR, individuals have the right to:

• Access their data
• Correct inaccuracies
• Request deletion
• Object to direct marketing
• Restrict processing
• Data portability

Requests to amend or delete information should be made to the treating dentist.

Legal Basis for Processing

The legal basis for processing patient data is detailed in our Privacy Notice and data inventory.

• Private patients: Legal obligation
• Payment plan patients: Contract
• NHS patients: Legal obligation

Automated Decision Making

Patients have the right to object to automated decision making. Any such processes require
explicit consent.

Consent

We obtain clear opt-in consent before sending direct marketing communications.

If consent is not given or is withdrawn, we assess whether processing is necessary and proportionate.

Withdrawal of Consent

Patients can withdraw consent at any time and are informed of this right in the Privacy Notice.

Retention Period

Records are retained while a patient remains registered and for at least 11 years afterwards,
or until age 25 for children, whichever is longer.

Complaints

Complaints regarding personal data should be made to Shaista Khan in person or in writing.

If unresolved, complaints can be escalated to the Information Commissioner’s Office (ICO).

Website: https://ico.org.uk/make-a-complaint
Phone: 0303 123 1113

International Data Transfers

Patient data is not transferred outside the EU.

Policy Review

This policy was implemented on 10/03/2026 and will be reviewed annually,
with the next review due on 10/03/2027.

Open PDF Version

You can open a PDF version of the Privacy Policy.