We may process personal information, including information concerning your health and dental treatment, when it is necessary to investigate, respond to or manage a complaint, concern, incident, potential claim or other matter relating to the care or services provided by the practice.

Where appropriate, we may seek advice or assistance from our professional indemnity provider, insurer, solicitor, barrister, regulatory adviser or other appropriately authorised professional adviser.

For these purposes, we may disclose relevant personal information, including relevant clinical records, radiographs, photographs, correspondence, treatment information and other information necessary for the adviser to understand and advise upon the matter.

Such disclosures will be limited to information that is adequate, relevant and necessary for the particular purpose. We will not disclose information merely because it is available to us.

Where appropriate, processing may be undertaken for the purposes of establishing, exercising or defending legal rights or claims, including obtaining legal advice or advice concerning actual or prospective claims.

Where health information or other special category personal data is processed for these purposes, we will identify and rely upon an applicable condition under Article 9 of the UK GDPR, in addition to an applicable lawful basis under Article 6.

Depending on the circumstances, the applicable lawful basis may include processing necessary for the purposes of legitimate interests, compliance with a legal obligation, performance of a contract, provision of health or social care, or establishment, exercise or defence of legal claims.

The fact that information is shared with a professional indemnity provider, insurer or legal adviser does not mean that the recipient is entitled to unrestricted access to your information. Information will be shared only to the extent reasonably necessary for the relevant purpose and subject to appropriate confidentiality and security arrangements.

Where a third party receives information in connection with a complaint, potential claim or legal matter, that organisation may process the information in accordance with its own legal and regulatory obligations and privacy information.

Data Protection Principles

We process personal information in accordance with the applicable data protection legislation and the data protection principles.

In particular:

Lawfulness, fairness and transparency: We will process personal information lawfully, fairly and transparently and will provide information about how and why your information is used.

Purpose limitation: We will collect and use information for specified, explicit and legitimate purposes and will not use it for unrelated purposes in a manner that is incompatible with those purposes.

Data minimisation: We will seek to ensure that personal information is adequate, relevant and limited to what is necessary for the purpose for which it is being processed.

Accuracy: We will take reasonable steps to ensure that information we hold is accurate and, where necessary, kept up to date. Clinical records may contain historical information, professional opinions and records of events as they occurred at the time; correcting an inaccurate factual entry does not necessarily mean that a historical clinical opinion or record will be removed.

Storage limitation: We will retain personal information only for as long as necessary for the relevant purposes, subject to applicable legal, regulatory, professional, clinical, accounting, insurance and claims-related requirements.

Integrity and confidentiality: We will use appropriate technical and organisational measures to protect personal information against unauthorised or unlawful processing and against accidental loss, destruction or damage.

Accountability: We are responsible for demonstrating compliance with applicable data protection requirements and may maintain appropriate records of our processing activities, lawful bases, information-sharing decisions and data protection procedures.

Disclosure to Professional Advisers and Indemnity Providers

The practice may need to obtain specialist advice when dealing with complaints, clinical incidents, potential claims, regulatory matters or other circumstances involving professional responsibilities.

Accordingly, relevant information may be shared with our professional indemnity provider, insurer, solicitor, barrister or other professional adviser where this is necessary and lawful.

We may need to provide sufficient information for the adviser to understand the circumstances, assess the issues raised, advise the practice and, where applicable, assist with the investigation, response or defence of a complaint or claim.

We will apply the principles of necessity, proportionality, purpose limitation, data minimisation and confidentiality when making such disclosures.

Patient consent is not necessarily required for every disclosure of information to a professional adviser. Depending on the circumstances, another lawful basis may apply. Where special category health information is involved, an appropriate Article 9 condition will also be identified.

Information Sharing and Third Parties

We may share information with third parties where this is necessary for the provision and administration of dental care, the operation of the practice, compliance with legal or regulatory requirements, investigation of complaints or incidents, obtaining professional advice, or establishing, exercising or defending legal rights or claims.

Categories of recipients may include healthcare professionals, dental laboratories, NHS organisations, professional indemnity providers, insurers, solicitors, barristers, regulatory bodies, statutory authorities, professional advisers, IT and software providers, payment providers and other organisations providing services to or on behalf of the practice.

We will consider the purpose of each disclosure and will seek to ensure that information shared is relevant and proportionate.

Where information is processed by another organisation on our behalf, appropriate contractual and data protection arrangements will be maintained where required.

Special Category Data

Information concerning your health and dental treatment constitutes special category personal data under the UK GDPR and is subject to additional protection.

We will process health information only where an applicable Article 9 condition permits us to do so, together with an applicable Article 6 lawful basis.

For the provision of dental and healthcare services, this may include processing necessary for the purposes of the provision of health or social care.

Where information is processed in connection with the establishment, exercise or defence of legal claims or rights, the relevant legal-claims condition may apply.

We will take particular care to apply appropriate security, confidentiality, data minimisation and access controls to health information.

Data Protection Requests and Legal Restrictions

You may have rights under applicable data protection legislation to request access to, correction of, restriction of or, in certain circumstances, deletion of your personal information, and to object to particular forms of processing.

These rights are subject to statutory exemptions and restrictions.

For example, information may need to be retained or processed where this is necessary to comply with a legal obligation or for the establishment, exercise or defence of legal claims.

A request for deletion does not necessarily require us to delete clinical records where there is a lawful reason for retaining them.

Similarly, an objection to processing based on legitimate interests does not necessarily require us to stop processing where compelling legitimate grounds apply or where processing is necessary for the establishment, exercise or defence of legal claims.

Security and Confidentiality

Because dental records contain sensitive health information, access is restricted to individuals who require access for legitimate professional or administrative purposes.

We will take appropriate technical and organisational measures having regard to the nature, sensitivity and risks associated with the information being processed.

Where information is transmitted to professional advisers, insurers, indemnity providers or other third parties, appropriate secure methods will be used where reasonably available and appropriate.

International Transfers

Where personal information is transferred outside the United Kingdom, we will comply with the applicable requirements governing restricted international transfers and will ensure that an appropriate transfer mechanism or safeguard is in place where required.

Further information concerning international transfers may be provided where applicable.

Transparency and Changes to Processing

We will seek to provide clear and accessible information about how personal information is collected and used.

Where our purposes, recipients or processing activities materially change, we may update this Privacy Notice and take any other transparency measures required by applicable data protection legislation.