Privacy Policy

This notice explains how Station House Dental Care ("we", "us", "the practice") collects and uses your personal information, and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We are committed to protecting your privacy and handling your data lawfully, fairly and securely.

1. Who we are (the data controller)

Questions about this notice or your data should be sent to our Data Protection Lead at the email above.

2. The information we collect

• Contact & enquiry details you give us via the website enquiry/booking form, phone, email or in person — name, phone, email, preferred contact method and the treatment or concern you tell us about.
• Health information — your medical and dental history, clinical records, X-rays, photographs and treatment notes. If you describe symptoms or a dental problem in an enquiry, that is also health information.
• Payment information — processed securely by our payment provider; we do not store full card details.
• Website data — we do not use advertising or analytics cookies. Only essential cookies needed for the site to function are used (see our Cookie Policy).

3. Why we use it and our lawful basis

Under the UK GDPR we rely on the following lawful bases:

• Article 6(1)(b) — to take steps at your request and to provide the dental care and services you ask for.
• Article 6(1)(c) — to comply with our legal and regulatory obligations (for example clinical record-keeping and NHS requirements).
• Article 6(1)(f) — our legitimate interest in responding to enquiries and running the practice, balanced against your rights.

Because your medical/dental information is special-category data, we additionally rely on:

• Article 9(2)(h) — the provision of health care and treatment by a dental professional under a duty of confidentiality, together with the condition in Schedule 1, Part 1 of the Data Protection Act 2018.

We do not use your information for marketing without your consent, and we never sell your data.

4. NHS care and information governance

Station House Dental Care holds an NHS dental contract (we are not currently accepting new NHS patients). Where we provide NHS-funded care we handle your information in line with NHS requirements. We meet the NHS Data Security and Protection Toolkit (DSPT) standards and follow the Caldicott Principles for the confidential handling of health and care information. For NHS care, information may be shared with NHS bodies (such as NHS England / the NHS Business Services Authority and the local Integrated Care Board) where required for the administration and payment of NHS services.

5. Who we share it with

We only share your information where necessary and lawful. This may include:

• Other health professionals involved in your care (e.g. referrals to specialists, your GP), with your knowledge.
• NHS bodies, for NHS-funded treatment (section 4).
• Data processors who act on our instructions:
  • Web3Forms — processes website enquiry-form submissions to deliver them to us by email.
  • Stripe — processes consultation/booking payments securely.
  • Our email and IT service providers — for secure communication and record storage.
  We have appropriate agreements in place with our processors. Some providers may process data outside the UK; where they do, appropriate safeguards (such as UK adequacy regulations or Standard Contractual Clauses / an International Data Transfer Agreement) are in place.

We do not sell your personal data to anyone.

6. How long we keep it

We keep clinical records in line with GDC and NHS retention guidance — generally for adults at least 11 years after the date of the last entry, and for children until their 25th birthday (or 11 years, whichever is longer). Website enquiry information from people who do not become patients is kept only as long as needed to deal with the enquiry and is then securely deleted.

7. Your rights

Under UK data protection law you have the right to: be informed; access a copy of your data; have inaccurate data corrected; have data erased (where applicable — clinical records have legal retention requirements); restrict or object to processing; and data portability. To exercise any right, contact our Data Protection Lead using the details in section 1.

8. Complaints

If you have a concern about how we handle your data, please contact us first. You also have the right to complain to the ICO:

Last reviewed: August 2026. We may update this notice from time to time; the current version is always available on this page.