Data Protection

Parmar Dental – Data Protection and Privacy Policy (2025 Update)

Version: 1.0
Issue Date: October 2025
Next Review: October 2026

1. Introduction

Parmar Dental is committed to protecting your personal data and ensuring your privacy. This policy explains how we collect, use, store, and share your information in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

We process personal and special category (health) data as part of providing dental care and related administrative services. This includes patient records, contact details, appointment history, clinical notes, and correspondence.

2. Data Controller

Data Controller: Parmar Dental
Address: 667 – 673 Southchurch Road, Southend on sea SS1 2PW
Email: dental.practice7360@nhs.net
Telephone: 01702 467133

Contact for Data Protection Matters: Practice Manager

Parmar Dental does not have a formally appointed Data Protection Officer (DPO). Data protection matters are overseen by the Practice Principal.

3. Types of Data We Hold

We hold personal data that may include:

• Name, address, date of birth, telephone number, and email address.
• Medical history and details of your general practitioner.
• Dental and clinical records, including radiographs, photographs, and digital scans.
• Information about treatment plans, appointments, and payments.
• Correspondence between you and the practice.

4. Purpose and Lawful Basis for Processing

We process your data for the following purposes:

• Providing safe, effective dental care.
• Complying with our legal and professional obligations (GDC, CQC, NHS, HMRC).
• Managing appointments, billing, and administration.
• Communicating with you about your care and practice updates.

Lawful Bases (Article 6, UK GDPR):

• (c) Legal obligation.
• (d) Vital interests.
• (e) Public task (for NHS treatment).
• (f) Legitimate interests (for private care and administrative purposes).

Special Category Data (Article 9, UK GDPR):
Processing is necessary for the provision of healthcare and treatment by a health professional bound by confidentiality.

5. Data Sharing

We share information only when necessary and on a need-to-know basis:

• With your consent, to your GP, hospital, or other healthcare providers.
• With laboratories and dental specialists involved in your care.
• With insurers, NHS authorities, or regulators (e.g., GDC, CQC, NHS England) where required by law.

All third-party processors (e.g., IT and cloud providers) are bound by confidentiality and data protection agreements.

6. How We Protect Your Data

We use appropriate technical and organisational measures to keep your data secure. This includes:

• Encrypted clinical systems and secure backups.
• NHSmail for secure communication of personal data.
• Password-protected attachments or verified in-person handover for Subject Access Requests (SARs).
• Restricted staff access and regular data protection training.

7. Data Retention

We retain your records for as long as required by law:

• Adult dental records: minimum 11 years after last attendance.
• Children’s records: until the patient reaches age 25.
• Financial records: 6 years for accounting compliance.

After these periods, data is securely destroyed or anonymised.

8. Your Rights

Under the UK GDPR, you have the following rights:

• Access – to request a copy of your records.
• Rectification – to correct inaccurate or incomplete data.
• Erasure – to request deletion where legally permissible.
• Restriction – to limit how we process your data.
• Data Portability – to receive your data in a transferable format.
• Objection – to certain processing activities.
• Complaint – to the Information Commissioner’s Office (ICO) if you are unhappy with our handling of your data.

Requests should be made in writing to the Practice Manager via post or email. Identification will be required. We will respond within one month.

9. Subject Access Requests (SARs)

Copies of your records are provided free of charge unless the request is manifestly unfounded or excessive, in which case a reasonable fee may apply. Records will be provided via secure electronic methods or in person after ID verification.

10. Website and Online Forms

When using our website or online forms, basic contact details are transmitted securely. Cookies are used only for site functionality and analytics. We do not sell or share web visitor data with third parties.

11. Policy Review and Updates

This policy is reviewed annually or sooner if regulations change. Updated versions will be published on our website and available at reception.

Reviewed by: Dr Nilesh Parmar
Date: October 2025