GDPR Compliance Notice

Introduction

This notice explains how York House Dental Practice complies with the General Data Protection Regulation (GDPR) and UK data protection laws when processing personal data of EU and UK residents.

Data Protection Officer

Lawful Basis for Processing

We process personal data under the following lawful bases:

• Consent: For marketing and optional services
• Contract: To provide dental services
• Legal Obligation: To maintain medical records as required by law
• Vital Interests: In medical emergencies
• Legitimate Interests: For practice administration
• Public Task: For public health purposes

Your Rights Under GDPR

• Right to Access: You can request a copy of your personal data we hold.
• Right to Rectification: You can request correction of inaccurate or incomplete data.
• Right to Erasure ('Right to be Forgotten'): You can request deletion of your data in certain circumstances.
• Right to Restrict Processing: You can request we limit how we use your data.
• Right to Data Portability: You can request your data in a machine-readable format.
• Right to Object: You can object to certain types of processing, including direct marketing.
• Rights Related to Automated Decision Making: You have rights regarding automated decision-making and profiling.

Data Retention

We retain personal data in accordance with:

• NHS requirements for medical records
• Legal and regulatory obligations
• Professional indemnity requirements
• Tax and accounting regulations

International Transfers

We do not routinely transfer personal data outside the UK/EEA. If such transfer becomes necessary, we will ensure appropriate safeguards are in place.

Data Breach Procedures

We have procedures to detect, report, and investigate personal data breaches. We will notify the ICO within 72 hours of becoming aware of a qualifying breach and inform affected individuals where required.

Children's Data

We process children's data only with parental consent or as permitted by law for healthcare provision. Special protections are in place for data of those under 16.

Third-Party Processors

We only work with processors who provide sufficient guarantees of GDPR compliance and have appropriate data processing agreements in place.

Cookies and Tracking

Please see our separate Cookie Policy for information about online tracking technologies.

Marketing Communications

We will only send marketing communications with your explicit consent. You can opt-out at any time by:

• Clicking unsubscribe links in emails
• Contacting us directly
• Updating your preferences in your patient portal

Updates to This Notice

We review this notice regularly and will notify you of any significant changes.