How we handle your personal and health information. This notice explains what data we collect, what we do with it, how we keep it safe, and your rights under UK GDPR and the Data Protection Act 2018.
Address: Malcolm Road, Tangmere, Chichester, West Sussex, PO20 2HS
We're a private dental practice registered with the Care Quality Commission (CQC) and regulated by the General Dental Council (GDC). All clinicians are GDC-registered.
For data protection questions, contact Tangmere Dental Care via the contact details above.
What Information We Collect
Personal Identification Data
Full name, title and date of birth
Address and contact details (phone, email)
NHS number (where applicable)
Emergency contact details
Photo ID and proof of address at registration
Health & Dental Data
Medical history including conditions, medications, allergies
Dental history including previous treatment, X-rays and records from previous dentists
Treatment records, clinical notes, charts and assessments
Photographs of teeth and mouth (clinical and, with consent, for case studies)
X-rays, scans and diagnostic images
Risk assessment outputs (periodontal scores)
Financial Data
Payment card details (handled by our card processor - not stored by us)
Direct Debit details for plan members (held by Simplyhealth Professionals/Denplan)
Invoice and payment history
Practice Interaction Data
Appointment history, including cancellations and reschedules
Correspondence (letters, emails, phone records)
Online form submissions
Website use data (see Cookie Policy)
Why We Collect Your Data
To Provide Dental Care
The primary reason. We can't safely treat you without knowing your medical history, dental history, current health, and what treatment you've consented to.
To Manage Appointments and Communications
Booking, reminding, rescheduling, and following up on treatment.
To Process Payments
Taking payment for treatment, plus managing Denplan direct debits.
To Meet Legal & Regulatory Requirements
Dental records have to be retained for specific minimum periods by law. CQC inspections, GDC standards, and HMRC tax records all require us to hold certain information.
To Communicate with You
Routine reminders, recall letters, treatment updates, and (only with your consent) marketing or newsletter communications.
For Practice Improvement
Anonymous and aggregated data may be used to assess and improve our services (e.g. waiting times, treatment outcomes, patient satisfaction).
The Legal Basis for Processing Your Data
Under UK GDPR, we need a legal basis for processing your data. The bases we rely on are:
Contract
We need to process your data to provide the dental care you've requested (Article 6(1)(b) GDPR).
Legal Obligation
We're required by law to keep certain records (Article 6(1)(c) GDPR). Dental records must be retained for at least 11 years for adults, or until age 25 for patients under 18 at time of treatment - whichever is longer.
Vital Interests
In a medical emergency, we may process data to protect your life (Article 6(1)(d) GDPR).
Consent
For specific uses including marketing communications, photography for case studies, and sharing your records with third parties (Article 6(1)(a) GDPR). You can withdraw consent at any time.
For special category data (health information), additional bases apply - typically Article 9(2)(h) (provision of health care) and Article 9(2)(c) (vital interests).
Who We Share Your Data With
We share your data only where necessary, with the following categories of recipient:
Your Care Providers
Other dentists or specialists if you're referred for specific treatment
Hospital consultants and physicians where relevant to your dental care
Your GP, where relevant and with your consent
Regulatory and Legal Bodies
Care Quality Commission (CQC) during inspections
General Dental Council (GDC) in the case of complaints or investigations
HMRC for tax purposes
Courts or police where legally compelled to do so
Our Suppliers and Processors
Software providers: Practice management software, X-ray imaging systems, recall systems. All bound by data processing agreements.
Dental laboratories: UK labs producing crowns, bridges, dentures. Receive minimal patient information needed to complete the work.
Simplyhealth Professionals (Denplan): For plan members - manage Direct Debit collection and supplementary insurance.
Hampshire Healthcare Partners: For Combined Medical Plan members only - if you've joined this plan.
Card payment processor: Handles card payments. We don't store full card details.
IT and cybersecurity providers: For secure data storage and system maintenance.
Accountancy and bookkeeping: For practice financial management, with minimal patient-identifying information.
Other Recipients
Insurers (yours, if you're claiming for treatment) - only with your specific consent
Solicitors if you're claiming for personal injury or similar - only with your specific consent
Researchers in fully anonymised form, only - we never share identifiable patient data for research without explicit consent
We never sell your data, share it with marketing companies, or use it for purposes you haven't agreed to.
International Data Transfers
Some of our software providers may store data on servers outside the UK (typically the EU). All such transfers are protected by appropriate safeguards under UK GDPR - either UK adequacy decisions, EU-UK data bridges, or Standard Contractual Clauses.
We do not transfer your data outside the UK or EEA without these safeguards in place.
How Long We Keep Your Data
Dental Records
Retained for a minimum of 11 years from the date of last treatment (adult patients), or until the patient is 25 years old for patients who were under 18 at the time of treatment - whichever is longer. This follows NHS Records Management Code of Practice and GDC standards.
Financial Records
Retained for 7 years following the end of the relevant tax year, in line with HMRC requirements.
Marketing Consents
Retained until withdrawn, plus a short audit period.
Website Form Submissions
Retained for 12 months unless required as part of an ongoing patient record.
CCTV
CCTV footage captured at the practice is retained for 30 days for security and safety purposes, after which it is automatically overwritten.
How We Keep Your Data Safe
Access control
Patient records are only accessible to authorised practice staff for legitimate clinical or administrative purposes
Encryption
Digital records are encrypted at rest and in transit
Secure storage
Paper records (where they exist) are stored in locked cabinets in secure areas
Backup
Regular encrypted backups to prevent data loss
Cybersecurity
Firewalls, antivirus, multi-factor authentication, and regular security reviews
Staff training
All team members receive data protection training, including specific dental data handling
Confidentiality agreements
All staff sign confidentiality agreements as part of their employment
Physical security
Practice premises are alarmed and access-controlled
If there is a data breach affecting your personal data, we'll notify the Information Commissioner's Office (ICO) within 72 hours where required, and notify you directly if the breach is likely to result in a high risk to your rights.
Your Rights
Under UK GDPR you have the following rights:
Right to Access (Subject Access Request)
You can request a copy of the personal data we hold about you. We'll respond within one month. Usually free unless the request is excessive.
Right to Rectification
You can ask us to correct any inaccurate or incomplete data.
Right to Erasure ("Right to Be Forgotten")
You can ask us to delete your data. Important: We can't always do this for dental records, because we're legally required to retain them for the minimum periods above. We can usually delete marketing data and non-essential records.
Right to Restriction of Processing
You can ask us to limit how we use your data in specific circumstances.
Right to Data Portability
You can ask for a copy of your data in a machine-readable format to transfer to another provider.
Right to Object
You can object to processing based on legitimate interests, and to direct marketing at any time.
Right to Withdraw Consent
Where we've relied on your consent, you can withdraw it at any time.
Rights Around Automated Decision-Making
We don't use automated decision-making or profiling that significantly affects you.
To exercise any of these rights, contact us using the details at the top of this page.
How to Make a Complaint
If you're unhappy with how we've handled your data, please contact us first - we'd like the chance to put things right. If you're still not satisfied, you can complain to:
Post: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Information Commissioner's Office (ICO)
Changes to This Policy
We may update this privacy policy from time to time. The "Last updated" date at the top reflects the most recent revision. Material changes will be brought to your attention - we won't change how we use your data without telling you.
Questions
If you have any questions about this privacy policy or how we handle your data, please contact us:
Tangmere Dental Care is a private dental practice combining advanced technology with prevention-led, holistic care. Our mission is to help patients across West Sussex maintain healthy, durable smiles for life.
We use cookies to ensure that we give you the best experience on our website. If you continue to use this site we will assume that you are happy with it.
