Privacy Policy

This notice explains how Station House Dental Care ("we", "us", "the practice") collects and uses your personal information, and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We are committed to protecting your privacy and handling your data lawfully, fairly and securely.

1. Who we are (the data controller)

Questions about this notice or your data should be sent to our Data Protection Lead at the email above.

2. The information we collect

• Contact & enquiry details you give us via the website enquiry/booking form, phone, email or in person — name, phone, email, preferred contact method and the treatment or concern you tell us about.
• Health information — your medical and dental history, clinical records, X-rays, photographs and treatment notes. If you describe symptoms or a dental problem in an enquiry, that is also health information.
• Payment information — processed securely by our payment provider; we do not store full card details.
• Website data — we do not use advertising or analytics cookies. Only essential cookies needed for the site to function are used (see our Cookie Policy).

3. Why we use it and our lawful basis

Under the UK GDPR we rely on the following lawful bases:

• Article 6(1)(b) — to take steps at your request and to provide the dental care and services you ask for.
• Article 6(1)(c) — to comply with our legal and regulatory obligations (for example clinical record-keeping and NHS requirements).
• Article 6(1)(f) — our legitimate interest in responding to enquiries and running the practice, balanced against your rights.

Because your medical/dental information is special-category data, we additionally rely on:

• Article 9(2)(h) — the provision of health care and treatment by a dental professional under a duty of confidentiality, together with the condition in Schedule 1, Part 1 of the Data Protection Act 2018.

We do not use your information for marketing without your consent, and we never sell your data.

4. Our practice status

Station House Dental Care offers NHS and private dental care. We are not currently registering new NHS patients, but new patients are welcome privately. As we do not currently hold an NHS dental contract, NHS-specific information governance obligations (such as the NHS Data Security and Protection Toolkit) do not currently apply to us. We nonetheless follow the Caldicott Principles for the confidential handling of health and care information as a matter of good practice.

5. Who we share it with

We only share your information where necessary and lawful. This may include:

• Other health professionals involved in your care (e.g. referrals to specialists, your GP), with your knowledge.
• NHS bodies, for NHS-funded treatment — including the NHS Business Services Authority and NHS England, which receive the claim details (FP17 forms) required to process NHS treatment claims and administer NHS dental services (section 4).
• Data processors who act on our instructions:
  • Web3Forms — processes website enquiry-form submissions to deliver them to us by email.
  • Stripe — processes consultation/booking payments securely.
  • Our email and IT service providers — for secure communication and record storage.
  We have appropriate agreements in place with our processors. Some providers may process data outside the UK; where they do, appropriate safeguards (such as UK adequacy regulations or Standard Contractual Clauses / an International Data Transfer Agreement) are in place.

We do not sell your personal data to anyone.

6. How long we keep it

We keep clinical records in line with GDC and NHS retention guidance — generally for adults at least 11 years after the date of the last entry, and for children until their 25th birthday (or 11 years, whichever is longer). Website enquiry information from people who do not become patients is kept only as long as needed to deal with the enquiry and is then securely deleted.

7. Your rights

Under UK data protection law you have the right to: be informed; access a copy of your data; have inaccurate data corrected; have data erased (where applicable — clinical records have legal retention requirements); restrict or object to processing; and data portability. To exercise any right, contact our Data Protection Lead using the details in section 1.

8. Complaints

If you have a concern about how we handle your data, please contact us first. You also have the right to complain to the ICO:

Last reviewed: August 2026. We may update this notice from time to time; the current version is always available on this page.