Tillie Street Dental Practice ("we", "us", "our", "the Practice") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, store and protect your personal information, including special category health data, when you visit our website, contact us, or receive dental and pharmaceutical care from us at 7 And 8 Tillie Street, Callington, Cornwall.
We are registered with the General Dental Council (GDC) and regulated by the Care Quality Commission (CQC). We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Where relevant, we also follow guidance issued by NHS Digital regarding the handling of patient health records.
By using our website or engaging our services, you acknowledge that you have read and understood this policy. If you do not agree with any part of it, please contact us before providing any personal information.
We collect and process a variety of personal data in order to provide safe, effective dental and pharmaceutical care and to operate our website. The categories of information we collect include:
Where you contact us on behalf of a child or dependent, we may also collect the personal and health data of that individual, in accordance with the safeguarding provisions described in Section 10.
We use your personal information to provide, manage and improve the clinical and administrative services offered by the Practice. Specific purposes include:
Under UK GDPR, we rely on the following legal bases to process your personal data. For the provision of dental and pharmaceutical treatment, we process clinical and health data under Article 9(2)(h), for the provision of health or social care, supplemented by our duty of confidentiality as regulated healthcare professionals. General contact and administrative data is processed under Article 6(1)(b), for the performance of a contract for services, and Article 6(1)(c), to comply with our legal obligations, including record-keeping requirements imposed by the GDC and CQC.
Where we send you marketing communications, we rely on your explicit consent under Article 6(1)(a), which you may withdraw at any time by contacting us or using the unsubscribe link provided. Certain limited processing, such as fraud prevention and website security, is carried out under our legitimate interests pursuant to Article 6(1)(f), balanced against your rights and freedoms.
We do not sell your personal information. We may share your data with trusted third parties strictly where necessary to deliver your care or operate our business, including:
All third-party processors are contractually bound to handle your data in accordance with UK GDPR and to implement appropriate technical and organisational security measures. We do not transfer personal data outside the UK or European Economic Area unless adequate safeguards, such as Standard Contractual Clauses, are in place.
We retain personal and clinical data only for as long as necessary to fulfil the purposes for which it was collected, and in accordance with professional and regulatory retention guidance. In line with NHS guidance and GDC recommendations, adult dental records are typically retained for 11 years from the date of last treatment or discharge. Records relating to children and young people are retained until the patient's 25th birthday, or for 11 years from the date of last treatment if that is longer.
Financial records are retained for a minimum of six years to comply with HMRC requirements. Website enquiry and marketing data is retained only for as long as necessary to respond to your enquiry or for as long as you remain subscribed to our communications, after which it is securely deleted or anonymised.
Where records are subject to an ongoing complaint, claim or regulatory investigation, we may retain relevant data for longer, as required to resolve the matter and comply with our legal obligations.
As a data subject, you have a number of rights in relation to your personal information under UK GDPR. These include the right to:
To exercise any of these rights, please contact our Data Protection contact using the details in Section 12. We will respond to all requests within one calendar month, as required by law. Please note that certain clinical records must be retained for the statutory periods described in Section 6, regardless of an erasure request, in order to comply with our regulatory obligations.
Our website uses cookies and similar technologies to ensure core functionality, remember your language and display preferences, and to analyse how visitors use our site so that we can continually improve it. Cookies do not give us access to your device or any information other than the data you choose to share with us.
When you first visit our website, you will be presented with a cookie banner allowing you to accept or decline non-essential cookies, including analytics cookies. You can change your preferences at any time by clearing your browser's stored data, which will cause the cookie banner to reappear on your next visit. Essential cookies required for the website to function correctly are not subject to this consent mechanism.
We take the security of your personal and clinical data extremely seriously. We maintain appropriate technical and organisational measures to protect your information against unauthorised access, alteration, disclosure or destruction, including encrypted storage of clinical records, access-controlled practice management systems, staff confidentiality training and regular security audits.
All members of staff who handle patient data are bound by professional confidentiality obligations under GDC standards and our internal data protection policies. In the unlikely event of a data breach that poses a risk to your rights and freedoms, we will notify the ICO and affected patients without undue delay, in accordance with our obligations under UK GDPR.
We provide dental care to patients of all ages, including children, and recognise our enhanced responsibility to protect the personal and health data of young patients. Where a patient is under 16, we generally obtain consent from a parent or legal guardian before collecting or processing their personal data, except where the child is assessed as having sufficient understanding to consent independently (Gillick competence).
Children's dental records are retained until their 25th birthday, or for 11 years from the date of last treatment if that is longer, in line with NHS and professional retention guidance. We do not knowingly collect personal data from children through our website without appropriate parental involvement, and our marketing communications are not directed at children.
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal or regulatory requirements. Any changes will be posted on this page with an updated "Last updated" date. We encourage you to review this policy periodically to stay informed about how we protect your personal information.
Where changes are significant, particularly in relation to how we use your health data, we will take reasonable steps to notify registered patients directly, such as by email or notice at the Practice.
If you have any questions about this Privacy Policy, wish to exercise any of your data protection rights, or would like to raise a concern about how we handle your personal information, please contact our Data Protection contact:
If you remain unsatisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.