Privacy Notice for CONFIDENTAL CARE
Last Updated: [Date, e.g., 19TH September 2026]
At ConfiDental Care we take your privacy and the security of your personal data extremely seriously. This Privacy Notice explains how we collect, use, store, and protect your personal information when you visit our website, register as a patient, or receive NHS or private dental treatment from us.
This document has been fully updated to accurately reflect our use of Carestream R4+ clinical software and our partnership with Tabeo Broker Limited for patient finance.
➡️ 1. About Us (CONFIDENTAL CARE)
Dr Khalid Faiz is the lead Dentist and the Data Controller responsible for your personal data.
• Practice Address: 207 Southborough lane Bromley BR2 8AR
• Telephone Number: 0202 289 3388 / 07344 714 752 (WhatsApp).
• Email Address: info@confidentalcare.co.uk
• Data Protection Officer (DPO): Ms Anne-Marie Miller
• DPO Email/Contact : annmarie.miller293@gmail.com
• Information Commissioner’s Office (ICO) Registration Number: ZB876690
➡️ 2. The Personal Data We Collect
We collect and process a variety of information to ensure you receive the safest, most appropriate dental care and to facilitate payment options. This includes:
📋 General Personal Data:
• Identifiers: Your name, date of birth, title, gender, and NHS number.
• Contact Details: Your home address, email address, and mobile/telephone numbers.
• Financial Details: Payment card details, private dental plan memberships, bank details, and NHS exemption statuses or claim histories.
• Finance Application Data: Information required for credit assessments if you choose to apply for finance (e.g., employment status, income details, and residency history).
⚠️ Special Category (Sensitive) Data:
• Clinical Records: Complete clinical histories, dental charting, dental radiographs (X-rays), photographs, clinical notes, and treatment plans managed securely within our Carestream R4+ system.
• Medical Histories: Details of your general health, underlying conditions, current medications, allergies, and lifestyle factors (such as smoking) that impact dental health.
• Referral Information: Correspondence from other healthcare providers or specialists.
📊 Automatically Collected Website Data:
• When you browse our website, we automatically collect technical details via cookies, including your IP address, browser type, operating system, and data showing how you interact with our pages.
➡️ 3. Why We Process Your Data (Lawful Bases)
Under the UK GDPR, we must establish valid legal grounds to process your information. We rely on the following lawful bases:
Category of Data Purpose of Processing Lawful Basis (UK GDPR Article 6) Special Category Condition (UK GDPR Article 9)
Clinical & Medical Data To provide safe, effective NHS or Private dental care and maintain records in Carestream R4+. Article 6(1)(b): Necessary for the performance of a contract (Private care) OR Article 6(1)(e): Public task (NHS care). Article 9(2)(h): Necessary for the purposes of preventative or occupational medicine and the provision of health or social care.
Contact & Personal Data Appointment reminders (SMS/Email), processing payments, and booking management. Article 6(1)(b): Necessary for the performance of a contract. Not applicable.
Finance Application Data Introduction and processing of 12-month interest-free credit applications via Tabeo. Article 6(1)(b): Necessary to take steps at your request prior to entering into a finance contract. Not applicable.
Legal Compliance Retaining clinical records under statutory health regulations or defending legal claims. Article 6(1)(c): Necessary for compliance with a legal obligation. Article 9(2)(f): Establishing, exercising, or defending legal claims.
Marketing Sending updates, newsletters, or information about cosmetic treatments. Article 6(1)(a): Freely given, explicit Consent (which you can withdraw at any time). Not applicable.
➡️ 4. How We Share Your Information
We will never sell or rent your data to third parties. We only share patient data when legally permitted or clinically/operationally necessary, including with:
• Healthcare Professionals: Referral clinics, dental hospitals, specialists, or your General Practitioner (GP).
• NHS Bodies: The NHS Business Services Authority (NHSBSA) for processing NHS claims and payment auditing.
• Regulators: The Care Quality Commission (CQC) and the General Dental Council (GDC) during statutory audits.
• Tabeo Broker Limited: If you opt to apply for our 12-month interest-free finance, we act as a credit broker and will securely transmit your personal, contact, and treatment cost details to Tabeo to facilitate your loan application. Tabeo acts as an independent Data Controller for the purposes of assessing your creditworthiness.
• Carestream R4+ Software Support: Our practice management software providers may have supervised, contractual access to our systems strictly for technical support, maintenance, and database security.
• Dental Laboratories: To fabricate custom dental appliances (e.g., crowns, bridges, or aligners).
➡️ 5. Data Security & International Transfers
We implement robust physical, technical, and administrative security measures (including encryption, password protection, and restricted staff access) to protect your Carestream R4+ database and finance documentation from unauthorized access.
Your personal data is predominantly stored within the UK or the European Economic Area (EEA). If any of our technical sub-processors transfer data outside the UK, we ensure strict legal frameworks (such as International Data Transfer Agreements) are in place to preserve your statutory data rights.
➡️ 6. How Long We Keep Your Records
We retain dental records in accordance with the Records Management Code of Practice for Health and Social Care, legal requirements, and defence union recommendations:
• Adult Records: Retained for a minimum of 11 years after the completion of their last treatment, or until the patient reaches age 26 (whichever is longer).
• Children's Records: Retained until the patient reaches age 26, or for 11 years after the last entry (whichever is longer).
➡️ 7. Your Statutory Legal Rights
Under the UK GDPR, you have the following rights regarding your personal information:
• Right of Access: You can request copies of your dental and medical records (Subject Access Request). We must provide this free of charge within one calendar month.
• Right to Rectification: You can request that we correct inaccurate or incomplete information.
• Right to Erasure ("Right to be Forgotten"): You can ask us to delete data. Note: This does not apply to clinical records that we are legally required to retain for public health and liability purposes.
• Right to Restrict or Object to Processing: You can object to us processing your data for specific tasks, such as direct marketing.
• Right to Withdraw Consent: Where processing is based entirely on consent, you may withdraw it at any moment.
To exercise any of these rights, please contact our Data Protection Officer using the details provided in Section 1.
➡️ 8. The National Data Opt-Out (NHS Patients Only)
[Practice Name] reviews patient data processing protocols against the National Data Opt-Out policy guidelines.
At present, our practice does not share any of your confidential patient data with external organizations for research or planning purposes. We only use your information to support your direct clinical care and to file NHS billing claims. Because of this, the National Data Opt-Out does not apply to the data processing we perform. If our procedures change, we will update this policy accordingly and honor any opt-outs submitted through the NHS system.
➡️ 9. Cookies and Web Analytics
Our website uses cookies to enhance user experience and analyze traffic patterns using tools like Google Analytics. Cookies register non-personal technical browsing information (such as your browser type, length of visit, and pages viewed).
You can configure your internet browser to refuse all or some cookies. If you disable cookies, please note that certain interactive features of our website may become inaccessible.
➡️ 10. How to Complain
If you are unhappy with how we handle your personal data, please contact our Data Protection Officer directly so we can resolve the issue.
You also retain the legal right to lodge a formal complaint at any time with the UK’s supervisory authority for data protection:
• Information Commissioner’s Office (ICO)
• Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
• Helpline: 0303 123 1113 / Website: www.ico.org.uk
💡 Medical & Regulatory Disclaimer: This privacy notice template provides general guidance reflecting UK GDPR, DPA 2018, and standard NHS/Private dental compliance policies current as of September 2026. It does not constitute tailored legal advice. You must customize this text to accurately represent your practice details and internal workflows before publishing.
Updated 19/09/26
