The practice aims to meet the requirements of the Data Protection Act 2018, the United Kingdom General Data Protection Regulation (UK GDPR), the guidelines on the Information Commissioner’s (ICO) website, as well as our professional guidelines and requirements.
The data controller is Ben Kemsley, and the Information Governance Lead is Gemma Funnell.
This Privacy Notice is available on our website at https://www.goldsworthroaddental.co.uk/privacy-policy/, at reception, by email if you contact manager.grdc@gmail.com, or by calling 01483 495303.
You will be asked to provide personal information when joining the practice. The purpose of processing your personal data is to provide you with optimum dental health care and prevention.
Categories and Examples of Data We Process
- Personal data for the provision of dental health care
- Personal data for the purposes of providing treatment plans, recall appointments, reminders, or estimates
- Personal data such as details of family members for the provision of health care to children or for emergency contact details
- Personal data for the purposes of employed and self-employed team members’ employment and engagement
- Personal data for the purposes of direct mail/email to inform you of important announcements or new treatments or services
- Personal data (IP addresses) so we can understand our patients better, inform our marketing approach, and improve the website experience
- Special category data including health records for the delivery of health care and to meet legal obligations
- Special category data to meet the requirements of the Equality Act 2010
- Special category data relating to criminal record checks for employees and contracted team members
We minimise the data we keep and do not retain it longer than necessary.
We never pass your personal details to a third party unless we have a contract for them to process data on our behalf, and we will otherwise keep it confidential. If we intend to refer a patient to another practitioner or secondary care such as a hospital, we will gain your permission before the referral and data sharing. Your data will be shared with the NHS if you are receiving NHS treatment.
- Personal data is stored in the UK or EU (digital or hard copy)
- Personal data is obtained when a patient joins the practice, is referred to the practice, or subscribes to an email list
For full details of where your data is stored, please ask to see our Information Governance Procedures (M 217C).
Lawful Bases for Processing Your Data
Our lawful bases for processing personal data:
- The legitimate interests of the dental practice
- Processing necessary for the performance of a contract with the data subject or to take steps to enter into a contract
- Consent of the data subject
- To comply with our legal obligations
Our Article 9 conditions for processing special category data:
- Processing necessary for health care purposes
- Processing necessary for reviewing equality of opportunity or treatment between groups to promote equality
- Consent to process criminal record checks
Reasons We Process Your Data
- To maintain your clinical records
- To provide you with dental treatment, prevention, and oral health advice
- To carry out financial transactions with you
- To send your data to the General Dental Council or other authority as required by law
- To communicate with you, including appointment reminders, treatment plans, estimates, and practice updates
- To communicate with your next of kin in an emergency
- To communicate with parents or carers about dependents
- To refer you to other health professionals as required
- To obtain criminal record disclosures for team members
- For debt recovery
- To continually improve our care and service
The Personal Data We Process Includes
Your name, address, gender, date of birth, NHS number, medical and dental history, family medical history, contact details, marital status, financial details for payments, your doctor’s details, and treatment records.
We may also process sensitive special category data including ethnicity, race, religion, or sexual orientation to meet obligations under the Equality Act 2010 or adjust treatment appropriately.
The retention period for special data in patient records is a minimum of 11 years, and may be longer for complex cases. Other personal data is retained for 2 years after last processing.
Details of retention periods are available in the Record Retention (M 215) procedure.
How We Obtain Your Data
We collect your personal details when you:
- Enquire about our services
- Join the practice
- Subscribe to our newsletter or register online
- Complete a registration or medical history form
- Are referred by another practitioner or official source (e.g. NHS clinic or hospital)
Your Personal Data Rights
You have the following rights:
- The right to be informed about the collection and use of your data
- The right of access (to receive a copy of your data)
- The right to rectification (to correct inaccurate or incomplete data)
- The right to deletion (subject to clinical record retention requirements)
- The right to restrict processing
- The right to data portability
- The right to object to processing
- Rights related to automated decision making and profiling
Further details are available in our Information Governance Procedures (M 217C) or from the Information Commissioner’s Office (ICO).
Examples of your rights:
- Patients may withdraw consent for marketing or notifications, correct errors, or request a free copy of records within one month
- Non-patients may withdraw consent for processing, request correction or deletion, and receive a free copy of their data within one month
We have carried out a Privacy Impact Assessment (M 217Q). You can request a copy via the contact details below.
Comments, Suggestions and Complaints
Please contact the Information Governance Lead at:
Goldsworth Road Dental Care
96 Goldsworth Road, Woking, Surrey, GU21 6LN
Email: manager.grdc@gmail.com
Phone: 01483 495303
If you are unhappy with our response, please contact the Information Commissioner’s Office (ICO) or call 0303 123 1113.
Related Practice Procedures
You can request copies of:
- Data Protection and Information Security Policy (M 233-DPT)
- Consent Policy (M 233-CNS)
- Sensitive Information Map, PIA and Risk Assessment (M 217Q)
- Information Governance Procedures (M 217C)
- Record Retention (M 215)
Data Opt-Out Policy (England)
How the NHS and care services use your information
GRDC Ltd is one of many organisations working within the health and care system to improve care for patients and the public. Whenever you use a health or care service (for example, A&E or community care), important information about you is collected in a patient record.
This information helps ensure you receive the best possible care. It may also be used for:
- Improving care quality and standards
- Research and treatment development
- Preventing illness
- Monitoring safety
- Planning services
Confidential patient information is only used where allowed by law. Most of the time, anonymised data is used so you cannot be identified.
You can choose whether your confidential patient information is used in this way. To learn more or opt out, visit www.nhs.uk/your-nhs-data-matters.
You can also learn more at:
You may change your mind about your choice at any time.
Our practice only uses your personal health data to provide care and does not disclose your data for any other purposes.
Processing of Staff and Candidates’ Information
This section explains how GRDC Ltd processes staff and job applicant information.
What data do we have?
We keep necessary records to provide a safe and professional service, including:
- Basic details and contact information
- Financial details (e.g. payroll, pensions, tax)
- Training records
Special category data includes:
- Health and social care data (e.g. fit notes, maternity pay)
- Data about race, ethnicity, sexual orientation, or religion (with permission)
- Criminal record checks (retained for up to 6 months after recruitment unless required longer)
Why do we have this data?
We process this data to contact, pay, and support team members. Lawful bases include:
- Legal obligations under UK employment law
- Legitimate interests for HR and operational purposes
- Public interest obligations (e.g. CQC compliance)
- Processing necessary for statutory pay and safeguarding requirements
- Consent where applicable (always requested clearly)
Where do we collect your data from?
- Directly from you or your legal representative
- From third parties such as previous employers or referees
How do we share your data?
With authorised third parties including:
- HMRC
- Pension and healthcare providers (Nest, AXA)
- Iris Payroll and Iris HR
- CQC, safeguarding bodies, or law enforcement if required
Retention period:
Staff records are held for 6 years, with some retained longer where lawful. Application forms and interview notes for unsuccessful candidates are kept for 1 year.
Your Rights
You have rights regarding how we process your personal data, including the right to lodge a complaint with the Information Commissioner’s Office (ICO).
You can request a copy of your personal file by contacting the Information Governance Lead.