GDPR Compliance Notice

Last Updated: January 2025

Introduction

This notice explains how York House Dental Practice complies with the General Data Protection Regulation (GDPR) and UK data protection laws when processing personal data of EU and UK residents.

Data Controller

York House Dental Practice
Lavender Park Road
West Byfleet, Surrey KT14 6ND
Registration Number: [ICO Registration Number]

Data Protection Officer

Contact: privacy@yorkhousedentalpractice.co.uk
Tel: 01932 344244

Lawful Basis for Processing

We process personal data under the following lawful bases:

• Consent: For marketing and optional services
• Contract: To provide dental services
• Legal Obligation: To maintain medical records as required by law
• Vital Interests: In medical emergencies
• Legitimate Interests: For practice administration
• Public Task: For public health purposes

Your Rights Under GDPR

Right to Access You can request a copy of your personal data we hold.

Right to Rectification You can request correction of inaccurate or incomplete data.

Right to Erasure (‘Right to be Forgotten’) You can request deletion of your data in certain circumstances.

Right to Restrict Processing You can request we limit how we use your data.

Right to Data Portability You can request your data in a machine-readable format.

Right to Object You can object to certain types of processing, including direct marketing.

Rights Related to Automated Decision Making You have rights regarding automated decision-making and profiling.

Data Retention

We retain personal data in accordance with:

• NHS requirements for medical records
• Legal and regulatory obligations
• Professional indemnity requirements
• Tax and accounting regulations

International Transfers

We do not routinely transfer personal data outside the UK/EEA. If such transfer becomes necessary, we will ensure appropriate safeguards are in place.

Data Breach Procedures

We have procedures to detect, report, and investigate personal data breaches. We will notify the ICO within 72 hours of becoming aware of a qualifying breach and inform affected individuals where required.

Children’s Data

We process children’s data only with parental consent or as permitted by law for healthcare provision. Special protections are in place for data of those under 16.

Third-Party Processors

We only work with processors who provide sufficient guarantees of GDPR compliance and have appropriate data processing agreements in place.

Cookies and Tracking

Please see our separate Cookie Policy for information about online tracking technologies.

Marketing Communications

We will only send marketing communications with your explicit consent. You can opt-out at any time by:

• Clicking unsubscribe links in emails
• Contacting us directly
• Updating your preferences in your patient portal

How to Exercise Your Rights

To exercise any of your rights, please contact:

Data Protection Officer

York House Dental Practice
Lavender Park Road
West Byfleet, Surrey KT14 6ND
Tel: 01932348864

Email : yorkhousedental@gmail.com

We will respond within one month of receipt of your request.

Complaints

If you’re dissatisfied with our handling of your personal data, you have the right to lodge a complaint with:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Tel: 0303 123 1113
Web: www.ico.org.uk

Updates to This Notice

We review this notice regularly and will notify you of any significant changes.