Privacy & Cookie Policy

Last updated: September 2026

Welcome to the Castle Street Dental Practice privacy policy.

Castle Street Dental Practice respects your privacy and is committed to protecting your personal data. This privacy notice will inform you as to how we look after your personal data when you visit our website (regardless of where you visit it from) and tell you about your privacy rights and how the law protects you.

This privacy notice is provided in a layered format, so you can click through to the specific areas set out below.

Contents

1. Who are we?
2. Controller
3. Contact details
4. What this policy covers
5. The information we collect
6. How we use your information and our lawful basis
7. Who we share your information with
8. How long we keep your information
9. Use of AI and other automated tools
10. Third-party links
11. National data opt-out
12. Keeping your data secure
13. Your rights
14. Complaints about how we handle your data
15. Changes to this policy
16. Cookies notice

1. Who are we?

Castle Street Dental Limited is an independent dental practice providing a range of dental treatments on both an NHS and private basis. Our practice team, which consists of employed and self-employed individuals, work together to ensure our patients’ data is protected.

1.2 Controller

Castle Street Dental Limited (“we”, “us”, “our”) is the data controller for the personal information we hold about our patients, website visitors and enquirers.

1.3 Contact details

Address: 21 Castle Street, High Wycombe, HP13 6RU

Telephone: 01494 527 971

Email: info@castlestreetdentalpractice.co.uk

ICO registration number: ZA069367

Our Data Protection Officers are Dr Kishan Lakhani and Dr Nikhil Patel, who can be contacted using the practice details above.

1.4 What this policy covers

This policy explains how we collect, use, store, and protect personal data when you visit our website, contact us online, or become a patient of the practice. It is written to meet the requirements of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. The information we collect

Depending on how you interact with us, we may collect:

Website and Enquiry Data: Name, email address, phone number and any message details you submit through a contact or enquiry form; technical data such as IP address and browsing behaviour, collected via cookies (see our Cookies Policy).

Booking Data: When you book an appointment through our online booking system, your name, contact details and appointment preferences are collected and processed by our booking provider on our behalf.

Patient Data: Name, address, date of birth, gender, NHS number, medical and dental history, family and emergency contact details, GP details, treatment plans and clinical notes, radiographs, photographs and study models, and financial details for payment and NHS exemption purposes.

Special Category (Health) Data: Your dental and medical history, and where relevant, information about ethnicity, religion or disability that helps us provide appropriate care or meet our obligations under the Equality Act 2010.

2.2 How we use your information and our lawful basis

We only use personal data where we have a lawful basis to do so under UK GDPR:

• Consent: For example, when you opt in to marketing communications or complete an online enquiry form.
• Performance of a contract: To provide the dental treatment and care you have agreed to.
• Legal obligation: For example, sharing information with the General Dental Council, HMRC or the NHS where required by law.
• Legitimate interests: To run and improve the practice, including appointment reminders, service improvement and understanding how our website is used.
• Public task: Where we hold and process data in connection with NHS care and treatment as required by law.

Special category health data is processed on the basis that it is necessary for the provision of health care, or to meet our obligations under the Equality Act 2010. Where we rely on consent for special category data (such as before and after photographs used in marketing), we will always ask you separately, and you may withdraw consent at any time.

We use your data to: provide dental treatment and advice; manage appointments, reminders and recalls; process payments and NHS claims; communicate with you about your care; refer you to other clinicians when needed; meet our legal and regulatory obligations to the GDC, CQC and NHS; and, where you have agreed, send you practice news or marketing.

3. Who we share your information with

We do not sell your personal data. We may share it with:

• Other healthcare professionals involved in your care (for example, your GP, a hospital, a specialist we refer you to, or a dental laboratory undertaking work on your behalf), with your permission where required.
• NHS England, HMRC and the NHS Business Services Authority, for treatment and payment administration.
• The Care Quality Commission (CQC), which has legal powers to access records to carry out its regulatory functions.
• Our appointment booking provider and IT and software suppliers, including AI-powered booking and communication tools, who process data on our behalf under contract (see “Use of AI and other automated tools” below).
• The General Dental Council or other regulators, where required by law.

Personal data is stored within the UK and EU. Where a supplier stores data outside the UK or EU, we only use providers with appropriate safeguards in place (such as UK adequacy regulations or standard contractual clauses).

3.2 How long we keep your information

Full details of our retention schedule are set out in our internal Record Retention Policy, a copy of which is available on request.

4. Use of AI and other automated tools

We use third-party software, including AI-powered tools, to help manage appointment bookings and patient communications. For example, an AI chat or phone assistant that can check availability and book, confirm or reschedule appointments on your behalf. These tools connect securely to our practice management system to access the patient information needed to carry out these tasks.

The companies providing these tools act as data processors: they only use your data to carry out the services we have instructed them to provide, under a data processing agreement with us, and they are not permitted to use it for their own purposes.

Some routine actions, such as booking, confirming or rescheduling a straightforward appointment through a chat or phone assistant, may be completed by the automated system without a staff member being involved at that exact moment. However, a member of our team checks all appointments made this way. We do not use AI to make decisions about your care, treatment or eligibility for services without a member of our clinical or administrative team being involved.

If you would like more information about how a particular automated tool uses your data, or you would like a member of our team to review a decision made using one of these tools, please contact us using the details above.

4.2 Third-party links

The Castle Street Dental Practice website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy notice of every website you visit.

5. National data opt-out

At this time, we do not share any data for planning or research purposes for which the national data opt-out would apply. We review all of the confidential patient information we process on an annual basis to see if this is used for research and planning purposes. If it is, individuals can decide to stop their information being shared for this purpose. You can find out more at www\.nhs.uk/your-nhs-data-matters.

6. Keeping your data secure

We protect personal data using password-protected and encrypted computer systems, secure off-site backups, lockable and fireproof storage for paper records, restricted “need to know” access, CCTV and intruder alarms at our premises, and staff training on confidentiality. Any suspected data breach is investigated and reported in line with our legal obligations.

7. Your rights

Under UK GDPR, you have the right to:

• Be informed about how your data is used.
• Access a copy of the data we hold about you.
• Have inaccurate data corrected.
• Request deletion of your data (subject to our legal obligation to retain clinical records).
• Restrict or object to certain processing, including direct marketing.
• Request that your data be transferred to another provider (data portability).

To exercise any of these rights, contact us at info@castlestreetdentalpractice.co.uk or 01494 527 971. We will normally respond within one month.

8. Complaints about how we handle your data

If you are unhappy with how we have used your personal data, please contact our Data Protection Officers in the first instance using the practice details above. If you remain dissatisfied, you can contact the Information Commissioner’s Office (ICO):

Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

Telephone: 03031 231 113

Website: ico.org.uk

9. Changes to this policy

We may update this policy from time to time. The “last updated” date at the top of this page shows when it was last revised. Please check back periodically. If you have any questions about our use of your data, contact us at info@castlestreetdentalpractice.co.uk or 01494 527 971.

10. Cookies notice

Cookies are small text files that are placed on your device when you visit a website. We use cookies to make our website work properly, to understand how visitors use it and to measure the effectiveness of our advertising. Full details of the cookies we use, why we use them and how you can control them are set out in our Cookies Policy.