Your privacy matters.

The practice aims to meet the requirements of the Data Protection Act 2018, the UK General Data Protection Regulation (UK GDPR), the guidance of the Information Commissioner’s Office, and our professional guidelines and requirements.

The data controller is Aatif Siddique and the Information Governance Lead is Farisa Siddique, who is also the Data Protection Officer. This notice is available on this website, at reception, by email from team@brookwooddentalstudios.co.uk or by calling 01483 370002.

Why we process your data

You will be asked to provide personal information when joining the practice. The purpose of processing your personal data is to provide you with optimum dental health care and prevention.

The data we process

• Personal data for the provision of dental health care.
• Personal data for treatment plans, recall appointments, reminders and estimates.
• Details of family members for the care of children, or as emergency contacts.
• Personal data of employed and self-employed team members for their employment and engagement.
• Contact details to tell you, by post, email or text, about important announcements or new treatments and services, where you have agreed to this.
• Special category data, including health records, to deliver health care and meet our legal obligations.
• Special category data to meet the requirements of the Equality Act 2010.
• Details of criminal record checks for employees and contracted team members.

This can include your name, address, gender, date of birth, NHS number, medical history, dental history, family medical history, family contact details, marital status, financial details for processing payment, your doctor’s details and details of treatment at the practice. We may process more sensitive special category data, including ethnicity, race, religion or sexual orientation, to meet our obligations under the Equality Act 2010, or, for example, to adapt treatment to suit your religion.

Where your data comes from

We obtain your personal details when you enquire about our care and service, when you join the practice, when you subscribe to our newsletter or register online, when you complete a registration or medical history form, and when another practitioner refers you for treatment at our practice. Occasionally patients are referred to us from other official sources such as NHS clinics or hospitals.

Our lawful bases

For personal data:

• The legitimate interests of the dental practice.
• Processing is necessary for the performance of a contract with you, or to take steps to enter into one.
• Your consent.
• To comply with our legal obligations.

For special category data:

• Processing is necessary for health care purposes.
• Processing is necessary to identify or keep under review equality of opportunity or treatment between groups of people, so that such equality can be promoted or maintained.
• We obtain your consent to process criminal record checks.

How we use your data

• To keep accurate, up-to-date clinical records.
• To provide dental treatment, prevention and oral health advice.
• To carry out financial transactions with you.
• To manage NHS dental care treatment.
• To send your personal data to the General Dental Council or another authority where the law requires it.
• To contact you about appointments, treatment plans, estimates and other matters about your treatment or the practice.
• To contact your next of kin in an emergency.
• If you are a parent or carer, to contact you about the person you care for.
• To refer you to other dentists, doctors and health professionals as required.
• To obtain criminal record disclosures for team members.
• For debt recovery.
• To keep improving the care and service you receive from us.

Sharing your data

We never sell your personal data. We only pass it to a third party when we have a contract for them to process it on our behalf, and they must keep it confidential and secure. If we intend to refer you to another practitioner or to secondary care such as a hospital, we will ask your permission before the referral is made and your data is shared. Your data will be shared with the NHS in England, Scotland and Wales or the HSC in Northern Ireland if you are having NHS or HSC treatment.

Where a provider stores or processes data outside the UK, we only use providers covered by UK adequacy regulations or by the safeguards UK data protection law requires, such as the International Data Transfer Agreement. For full details of where your data is stored, please ask to see our Information Governance Procedures.

How long we keep it

We keep only the data we need, and no longer than necessary. Patient records are kept for a minimum of 10 years, and may be kept longer for complex records or to meet legal requirements. Staff records are kept for 6 years. Other personal data is kept for 2 years after it was last used. Details are in our Record Retention procedure.

Keeping it safe

Access to personal data is limited to team members and contracted processors who need it, and we protect it with technical and organisational security measures. We have carried out a Privacy Impact Assessment, and our Security Risk Assessment and Information Governance Procedures set out how personal data is kept secure. You can request copies using the contact details below.

Your rights

• The right to be informed about the collection and use of your personal data.
• The right of access: a free copy of the data we hold about you, normally within one month.
• The right to rectification: to correct data that is inaccurate or incomplete.
• The right to erasure of your personal data. Clinical records must be kept for a set period.
• The right to restrict processing of your personal data.
• The right to data portability: to have your data transferred to someone else.
• The right to object to the processing of your personal data.
• Rights in relation to automated decision making and profiling.

You can withdraw consent for notifications, newsletters, surveys or marketing at any time, and choose which ways we contact you, such as telephone, email or text. If you are not a patient of the practice, you can also ask us to delete the data we hold about you.

This website

This website is hosted by Vercel. Its content, saved chat conversations and callback requests are stored with Amazon Web Services in London. Both act only on our instructions.

The chat assistant on this website is automated. When you send it a message, the text of your conversation is sent to OpenAI, a US-based provider, to generate a reply. Under OpenAI’s API terms, messages are not used to train its models and may be kept for up to 30 days for abuse monitoring before deletion. The practice saves each conversation for 90 days after the last message, with the device type and country but not your IP address, so the team can review questions and improve the answers. This includes any message the assistant declined to answer. It is then deleted. If your browser sends a Do Not Track or Global Privacy Control signal, your conversation is not saved. Please don’t share medical details in the chat. To discuss your care, call or email the practice instead.

If you request a callback, the name, phone number and preferred time you enter are saved with the conversation for 90 days and emailed to the practice inbox so the team can call you. They are used only to return your call.

To prevent misuse, the website keeps short-lived counters of how often the chat, callback form and statistics are used from each connection. These hold a scrambled code made from your IP address, not the address itself, and are deleted within two days.

To understand how the website is used, it counts page visits and clicks on things like Book, Call, Email and Directions. This works without cookies and without storing your IP address. Visitors are counted using a code that changes every day and cannot identify you. Individual clicks are kept for 30 days and daily totals after that. If your browser sends a Do Not Track or Global Privacy Control signal, nothing is counted.

The map on this website is provided by Google and only loads when you scroll to it. Google may set its own cookies when it loads, under Google’s privacy policy.

Comments, suggestions and complaints

Please contact the Information Governance Lead, Farisa Siddique, with any comment, suggestion, request or complaint about how we handle your data: email team@brookwooddentalstudios.co.uk, call 01483 370002, or write to or visit Brookwood Dental Studios, Inside Sainsbury’s, Redding Way, Knaphill, GU21 2QT. We take complaints very seriously.

If you are unhappy with our response, or need advice, you can contact the Information Commissioner’s Office on 0303 123 1113. The ICO can investigate your concern and take action against anyone who has misused personal data. Make a complaint to the ICO

Related practice procedures

You can use the same contact details to request copies of our Data Protection and Information Security Policy, Consent Policy, Privacy Impact Assessment, Information Governance Procedures and Record Retention procedure.

We may update this notice from time to time. The current version is always on this page.