Privacy Notice for Patients

We are a Data Controller under the terms of the Data Protection Act 2018.  

We are registered with the Information Commissioner No: ZA756107 / ZB168983 

This Privacy Notice explains what patient Personal Information the practice holds, why we hold and process it, who we might share it with, and your rights and freedoms under the Law. 

Our Data Protection Officer: Person responsible for Data Protection queries is Stephanie Mackey 

What types of patients’ Personal Information do we hold? 

The practice holds patients’ Personal Information in the following categories: 

  • Name, identity, (e.g. date of birth) and contact details. 
  • Family details including anyone who may need to give consent for your care. 
  • Medical history, your GP’s details, [your NHS number] 
  • Dental history, records of treatment provided, x-rays and photographs. 
  •  Information from other providers involved in your care. 
  •  Dates of your appointments including any that are cancelled or that you have not attended. 
  •  Payment details and financial information in connection with your care. 
  •  Correspondence relating to your care with you or with other healthcare professionals. 
  • Details of any complaints that you have made and how we dealt with them. 

Why do we process patients’ Personal Information? (What is the “purpose”?) 

“Process” means we obtain, store, update and archive your Information. 

Patients’ Personal Information is held for the purpose of providing patients with appropriate, high quality, safe and effective dental care and treatment and the maintenance of accurate records. 

We will use your contact details to share information with you about the practice which we believe to be of legitimate interest relating to your care.  

We may use your contact details to inform you of broader promotional offers relating to the products and services available at the practice. We will ask for your consent to do so.  

We have CCTV at the practice for patient and staff safety. (Please see our CCTV Policy in the appendix) 

What is the Lawful Basis for processing your Personal Information? 

The Law says we must tell you this. 

We hold patients’ Personal Information because it is in our Legitimate Interest to do so. Without holding the Information, we cannot provide your care and treatment effectively. Also, we must hold information on NHS care and treatment as it is a Public Task required by law. 

What do we do with your Information? 

We will only share your information if it is done securely, and it is necessary for us to do so. 

  • Your personal information may be securely shared with other healthcare professionals who need to be involved in your care (for example if we refer you to a specialist, need laboratory work undertaken or need to consult with your doctor) 
  • There may be times when we are needed to disclose relevant information to third parties not involved in your care for example:
    • A debt collection agency (if fees owing remain unpaid) 
    • HMRC. 
    • Other Law enforcement or government agencies. 
  • We may also share your personal information securely with third parties where we are required by law or regulation to do so. This may include:
    • The General Dental Council. 
    • The Care Quality Commission [or relevant Regulatory body] 
    • Dental payment plans or insurers 
    • NHS Bodies if NHS dental care and treatment is provided 

How do we store your Information? 

Your Information is stored securely at the practice on protected cloud-based computer systems and in a small number of cases on paper.  

We will keep your Information for as long as you are having dental care and treatment from us or if you ask us to remind you or send you future appointments. Otherwise, we will archive it, that is, store your Information without processing it for no longer than is advised by the NHS or other trusted experts.  

What are your data protection rights? 

Under data protection law you have the right to: 

  • Be informed about the personal information we hold and why we hold it. 
  • Have a copy of your data that we hold by contacting us directly: we will acknowledge your request and supply a response within one month or sooner. 
  • Check the information we hold about you is correct and if not to make corrections. 
  • Have some of your data erased in certain circumstances. 
  • Transfer your information to someone else, if you tell us to do so and it is safe and legal to do so. 
  • Tell us not to actively process or update your information in certain circumstances. 

What if you are not happy or wish to raise a concern about our processing of your Information? 

You can complain in the first instance to our Practice Manager, Ingrid Hughes, who will do her best to resolve the matter.  

If this fails, you can complain to the Information Commissioner at: · www.ico.org.uk/concerns, by calling 0303 123 1113, or by writing to: The Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF 

If you do not agree to the use of your information as described, it may not be possible for us to continue to provide your dental care. 

Appendix: CCTV Policy 

Closed circuit television (CCTV) is installed in our practice for the purposes of patient, staff, and premise security. Cameras are located externally and internally of the buildings in public facing areas including reception areas and waiting rooms. 

At Duthie Dental and The Abbey by Duthie Dental the use of CCTV aims to comply with the Data Protection Act (1998) the ICO code of practice (2008) and the GDC Standards. 

To comply with the requirements of the 1998 act, data must be: 

· Lawfully and fairly processed 

· Processed for limited purpose and not in any manner incompatible with those purposes 

· Adequate, relevant, and not excessive 

· Accurate 

· Not kept for longer than is necessary 

· Processed in accordance with individual’s rights 

· Secure 

In summary 

1) CCTV has been installed solely for the safety and security of our patients, staff, and the premises. 

2) CCTV is in place in public facing areas of the premises both internally and externally. 

3) Images are captured 24 hours a day, seven days a week and are processed via our CCTV capturing devices. These devices are securely protected and only the owner of the practice and the data protection officer and software provider have access to the equipment. 

4) Regular checks are carried out to ensure that the CCTV devices are working as intended. 

5) CCTV only captures images and does not have an audio recording function. 

6) Visitors to the practice have the right to request to view images of themselves on CCTV as part of a Data Protection request. Like all Data Protection requests, this request must be made in writing and the same exceptions apply.  

7) We have followed the CCTV guidelines provided by the Information Commissioners’ https://ico.org.uk/for-organisations/guide-to-data-protection/ 

Access to images by third parties 

Disclosure of recorded images to third parties will only be made in exceptional circumstances. For example, in cases of the prevention and detection of crime, disclosure to third parties will be limited to the following: 

· Law enforcement agencies where the images recorded would assist in a specific criminal enquiry 

· Prosecution agencies 

· Relevant legal representatives 

· The Press/Media, where it is decided that the public’s assistance is needed to assist in the identification of victim, witness, or perpetrator in relation to a criminal incident. As part of that decision, the wishes of the victim of an incident will be considered. 

· People whose images have been recorded and retained (unless disclosure to the individual would prejudice criminal enquiries or criminal proceedings) 

What if you are not happy or wish to raise a concern about our processing of CCTV images? 

You can complain in the first instance to our Practice Manager, Ingrid Hughes, who will do her best to resolve the matter.  

If this fails, you can complain to the Information Commissioner at: · www.ico.org.uk/concerns, by calling 0303 123 1113, or by writing to: The Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF 

If you do not agree to the use of your information as described, it may not be possible for us to continue to provide your dental care.