How Elite Smiles handles personal data.

Privacy Notice

The practice aims to meet the requirements of the Data Protection Act 2018, the United Kingdom General Data Protection Regulation (UK GDPR), the guidelines on the Information Commissioner's Office (ICO) website, as well as our professional guidelines and requirements.

The data controller is Elite Smiles Dental and Beauty Limited. The Information Governance Lead is Hayley Hutton.

This Privacy Notice is available on the practice website at www.elitesmiles.co.uk, at reception, by email if you contact info@elitesmiles.co.uk, or by calling 01923 946966.

You will be asked to provide personal information when joining the practice. The purpose of processing your personal data is to provide you with optimum dental health care and prevention.

Categories and examples of data we process

• Personal data for the provision of dental health care.
• Personal data for treatment plans, recall appointments, reminders or estimates.
• Personal data such as details of family members for child health care or emergency contact details.
• Personal data for employed and self-employed team member employment and engagement.
• Personal data for direct mail, email or text about important announcements, new treatments or services.
• Personal data such as IP addresses so that we can understand our patients better, inform marketing and improve the website experience.
• Special category data including health records for health care delivery and meeting legal obligations.
• Special category data to meet the requirements of the Equality Act 2010.
• Special category data including criminal record check details for employees and contracted team members.

We minimise the data that we keep and do not keep it for longer than necessary. We never pass your personal details to a third party unless we have a contract for them to process data on our behalf and will otherwise keep it confidential. If we intend to refer a patient to another practitioner or to secondary care such as a hospital, we will gain the individual's permission before the referral is made and the personal data is shared.

• Personal data is stored in the UK or EU whether in digital or hard copy format.
• Personal data is stored outside of the UK and/or EU in digital format when suitable safeguards have been put in place to allow personal data to be transferred.
• Personal data is obtained when a patient joins the practice, when a patient is referred to the practice and when a patient subscribes to an email list.

For full details of where your data is stored, please ask to see Information Governance Procedures (M 217C).

Lawful bases for processing your data

Our lawful bases for processing personal data are:

• The legitimate interests of the dental practice.
• Processing is necessary for the performance of a contract with the data subject or to take steps to enter into a contract.
• Consent of the data subject.
• Compliance with our legal obligations.

Our Article 9 conditions for processing special category data are:

• Processing is necessary for health care purposes.
• Processing is necessary for identifying or keeping under review the existence or absence of equality of opportunity or treatment between groups of people, with a view to enabling such equality to be promoted or maintained.
• We obtain consent of the data subject to process criminal record checks.

Reasons we process data

• To maintain your contemporaneous clinical records.
• To provide you with dental treatment, prevention and oral health advice.
• To carry out financial transactions with you.
• To send your personal data to the General Dental Council or another authority as required by law.
• To communicate with you as required, including appointment reminders, treatment plans, estimates and other communications about your treatment or the practice.
• To communicate with your next of kin in an emergency.
• If you are a parent or carer, to communicate with you about the person you parent or care for.
• To refer you to other dentists, doctors and health professionals as required.
• To obtain criminal record disclosures for team members.
• For debt recovery.
• To continually improve the care and service you receive from us.

Personal data we process

The personal data we process includes your name, address, gender, date of birth, NHS number, medical history, dental history, family medical history, family contact details, marital status, financial details for processing payment, your doctor's details and details of treatment at the practice.

We may process more sensitive special category data including ethnicity, race, religion or sexual orientation so that we can meet our obligations under the Equality Act 2010, or for example to modify treatment to suit your religion.

The retention period for special data in patient records is a minimum of 11 years and may be longer for complex records or to meet our legal requirements. The retention period for other personal data is two years after it was last processed. Details of retention periods are available in the Record Retention (M 215) procedure available from the practice.

We obtain your personal details when you enquire about our care and service, when you join the practice, when you subscribe to our newsletter or register online, when you complete a registration or medical history form and when another practitioner refers you for treatment at our practice. Occasionally, patients are referred to us from other official sources such as NHS clinics or hospitals.

Your personal data rights

• The right to be informed about the collection and use of your personal data.
• The right of access: to have a copy of the data we hold about you. Generally, we will not charge for this service.
• The right to rectification: to correct the data we have if it is inaccurate or incomplete.
• The right to deletion of your personal data, although clinical records must be retained for a certain time period.
• The right to restrict processing of your personal data.
• The right to data portability: to have your data transferred to someone else.
• The right to object to the processing of your personal data.
• Rights in relation to automated decision making and profiling.

Further details of these rights can be seen in our Information Governance Procedures (M 217C) or at the Information Commissioner's website.

Practical examples of your rights

• If you are a patient of the practice, you have the right to withdraw consent for important notifications, newsletters, surveys or marketing. You can ask us to correct errors in your personal details or withdraw consent from communication methods such as telephone, email or text. You have the right to obtain a free copy of your patient records within one month.
• If you are not a patient of the practice, you have the right to withdraw consent for processing personal data, to have a free copy of it within one month, to correct errors in it or to ask us to delete it. You can also withdraw consent from communication methods such as telephone, email or text.

We have carried out a Privacy Impact Assessment in Sensitive Information Map, PIA and Risk Assessment (M 217Q), and you can request a copy using the details below. The details of how we ensure security of personal data are in our Security Risk Assessment (M 217M) and Information Governance Procedures (M 217C).

Comments, suggestions and complaints

Please contact the Information Governance Lead at the practice for a comment, suggestion or complaint about your data processing at info@elitesmiles.co.uk, by calling 01923 946966, or by writing to or visiting the practice.

If you are unhappy with our response, or if you need advice, you should contact the Information Commissioner's Office. Their telephone number is 0303 123 1113. You can also chat online with an adviser. The ICO can investigate your claim and take action against anyone who has misused personal data. You can also visit their website for information on how to make a data protection complaint.

Related practice procedures

You can use these contact details to request copies of the following practice policies or procedures:

• Data Protection and Information Security Policy (M 233-DPT) and Consent Policy (M 233-CNS).
• Sensitive Information Map, PIA and Risk Assessment (M 217Q), Information Governance Procedures (M 217C) and Record Retention (M 215).

Information Governance Lead

Processing of Staff and Candidates' Information

This section explains how Elite Smiles Dental and Beauty processes the information of staff and applicants for job roles within the practice.

What data do we have?

So that we can provide a safe and professional service, we need to keep certain records about our team members. We may record the following types of data:

• Your basic details and contact information, such as your name, address, date of birth, National Insurance number and next of kin.
• Your financial details, such as details so that we can pay you, insurance, pension and tax details.
• Your training records.

We also record the following data, which is classified as special category data:

• Health and social care data about you, which might include your physical and mental health data. We will only collect this if it is necessary for us to know as your employer, such as fit notes or information needed for statutory maternity or paternity pay.
• With your permission, we may record data about your race, ethnic origin, sexual orientation or religion.

As part of your engagement with the practice, you may be required to undergo a criminal record check. This information is not kept for longer than necessary, usually not more than six months following the recruitment decision unless a dispute is raised or in exceptional circumstances.

Why do we have this data?

We require this data so that we can contact you, pay you and make sure you receive the training and support you need to perform your job. By law, we need to have a lawful basis for processing your personal data.

We process your data because:

• We have a legal obligation under UK employment law.
• We have a legitimate interest in processing your data for administration of training, learning courses, emergency planning, operational administration, HR, recruitment and managing the employment relationship.
• We are required to provide data to our regulator, CQC, as part of our public interest obligations.
• We are required to do so in our performance of another public task.
• We process your special category data because it is necessary for us to process requests for sick pay or maternity pay.
• If we request criminal records data, it is because we have a legal obligation to do this due to the type of work you do. This is set out in the Data Protection Act 2018 and the Rehabilitation of Offenders Act 1974 (Exceptions) Order 1975.
• We may also process your data with your consent. If we need to ask for your permission, we will offer a clear choice, ask you to confirm consent, explain what we need the data for and explain how you can withdraw consent.

Where do we collect your data from?

As your employer, we need to receive specific data about you. This is collected from or shared with:

• You or your legal representative.
• Third parties, such as references from your previous job.

We do this face to face, by phone, email, website, post, application forms and apps.

How do we share your data?

Third parties are organisations we have a legal reason to share your data with. These include:

• HMRC.
• Our pension and healthcare schemes.
• External payroll providers.
• Organisations we have a legal obligation to share information with, such as for safeguarding or the CQC.
• The police or other law enforcement agencies if we have to by law or court order.

How long do we hold your data?

The retention period for staff records is six years. Certain information relating to team members may lawfully be kept for longer. Team members should refer to Record Retention (M 215) for further details on how this practice keeps and disposes of staff data. Application forms and interview notes for unsuccessful candidates are kept for one year.

Your rights

As an individual you have certain rights regarding our processing of your personal data, including a right to lodge a complaint with the Information Commissioner's Office as the relevant supervisory authority. For more information on your personal data rights, you can access information and advice on the ICO's website. You can request a copy of your personal file by contacting the Information Governance Lead.