Data Protection Code of Practice Information for Patients (Privacy Notice)
Cleveland Orthodontics is committed to keeping the personal information of our patients safe and secure. This leaflet explains how we achieve this and when any disclosure of patient information may be necessary.
Our policies and procedures are informed by the General Data Protection Regulation (2018). Our practice has put the following in place to support our commitment to data security:
In order to provide you with a high standard of dental care and attention, we need to hold personal information about you. This personal information comprises:
We need to keep comprehensive and accurate personal information about our patients in order to provide them with safe and appropriate dental care.
We also need to process personal information about you in order to provide care under NHS arrangements and to ensure the proper management and administration of the NHS.
We will process personal information that we hold about you in the following way:
We will retain your dental records while you are a practice patient and after you cease to be a patient, for at least eleven years or for children until age 25, whichever is the longer.
Security of information
Personal information about you is held in the practice’s computer system and in a manual filing system. The information is not accessible to the public and only authorised members of staff have access to it. Our computer system has secure audit trails and we back up information routinely.
Use of video and photographic images
Clinical photographs before and after treatment are routinely taken as part of our standard record taking procedure. Your consent for taking photographs will be asked for.
Video and photographic images may be requested for use on the practice website or other promotional material. Your consent will be asked for this also. No personal details will be disclosed if you allow us to use your images.
Disclosure of information
In order to provide proper and safe dental care, we may need to disclose personal information about you to:
Disclosure will take place on a ‘need-to-know’ basis so that only those individuals or organisations who need to know (to provide care to you and for the proper administration of Government) will be given the information. Only that information that the recipient needs to know will be disclosed.
In very limited circumstances or when required by law or a court order, personal information may have to be disclosed to a third party not connected with your health care. In all other situations, disclosure that is not covered by this code of Practice will only occur when we have your specific consent. Where possible, you will be informed of these requests for disclosure.
You have the right of access to the information that we hold about you and to receive a copy. Access may be obtained by making a request in writing. We will provide a copy of the record within a month of receipt of the request and an explanation of your record should you require it.
If you do not wish personal information that we hold about you to be disclosed or used in the way that is described in this Code of Practice, please discuss the matter with your orthodontist. You have the right to object, but this may affect our ability to provide you with dental care.
Under GDPR (2018), all our patients have the following individual rights:
Right to be informed
We will tell you how we use your data.
Right of access
You can request access to your data.
Right to rectification
We will correct your data if it is wrong.
Right to erasure
We will remove your data is it is no longer required for treatment (excluding clinical records – see Retaining Information section)
Right to restrict processing
If your data cannot be erased, we will restrict how it is used.
Right to Portability
We will enable you to use/transfer your data across different services, where appropriate.
Right to object
If you feel your data has been used for marketing, you have the right to object.
Right to automated decision-making and profiling
Automated decision-making is not used in our practice.
N. Huntley, Information Governance Lead (Caldicott Guardian)
Our practice is compliant with the national data opt-out policy. This gives patients choice on how their data is used for research and planning.
For more information, ask a member of our team for a detailed advice sheet.
Or visit: www.nhs.uk/your-nhs-data-matters