Privacy Policy
Smile Clinic Group
Website: www.smileclinicgroup.com
1. Introduction
Smile Clinic Group is committed to protecting your privacy and ensuring that your personal information is handled securely, responsibly and in accordance with applicable UK data protection legislation.
This Privacy Policy explains how we collect, use, store, protect and share personal information when you visit our website, contact our dental practices, make enquiries, book appointments or receive dental treatment.
We comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other relevant legislation governing patient confidentiality and information security.
This policy applies to Smile Clinic Group and its associated dental practices.
2. Who We Are
Smile Clinic Group is a group of dental practices providing NHS and private dental services across the United Kingdom.
Our practices may operate through separate legal entities. The legal entity responsible for providing your treatment will generally be the data controller for your clinical records.
Certain administrative, operational, marketing and support services may be managed centrally within Smile Clinic Group.
Each practice has a designated Clinic Lead who acts as the local point of contact for data protection and patient confidentiality enquiries.
For privacy-related enquiries, you can contact your local clinic or email:
Email: marketing@smileclinicgroup.com
Website: www.smileclinicgroup.com
You can request details of the specific legal entity responsible for your personal information by contacting your practice.
3. Information We Collect
We may collect and process the following information.
Personal Information
Name, address and contact details.
Date of birth and relevant identification information.
NHS number, where applicable.
Emergency contact details.
Appointment and registration information.
Medical and Dental Information
Medical and dental histories.
Current medications, allergies and relevant health conditions.
Clinical examination findings and diagnoses.
Dental treatment records and treatment plans.
Radiographs, digital scans, photographs and clinical images.
Referrals, prescriptions and clinical correspondence.
Consent forms and relevant patient communications.
Financial Information
Treatment fees and payment history.
Invoices, receipts and outstanding balances.
Information necessary to administer payment plans or treatment finance arrangements.
Where patients apply for treatment finance, relevant information may also be collected and processed directly by the finance provider.
Website and Communication Information
Online enquiry forms and appointment requests.
Email correspondence.
Telephone communications and call recordings, where applicable.
Website usage information.
IP addresses, cookies and analytics information.
We collect information directly from patients and website visitors and, where appropriate, from authorised representatives, referring clinicians, other healthcare professionals, NHS organisations and relevant service providers.
4. How We Use Your Information
We use personal information for legitimate clinical, administrative and operational purposes, including:
Providing safe and effective dental treatment.
Assessing oral health and planning treatment.
Maintaining accurate clinical records.
Booking, confirming and managing appointments.
Sending appointment reminders and important treatment communications.
Managing payments and treatment finance arrangements.
Responding to patient enquiries, feedback and complaints.
Meeting NHS, professional and regulatory obligations.
Maintaining clinical quality, patient safety and service standards.
Improving the efficiency and effectiveness of our services.
Communicating relevant offers and promotional information where legally permitted.
We only process personal information where an appropriate lawful basis exists.
5. Legal Basis for Processing Information
Under the UK GDPR, we may process personal information on the following lawful bases:
Contract: Where processing is necessary to provide dental treatment or another service you have requested.
Legal obligation: Where information must be processed to comply with applicable laws and regulatory requirements.
Legitimate interests: Where processing is necessary for appropriate business operations, patient administration, service improvement or security, provided those interests do not override individuals' rights.
Consent: Where consent is the appropriate lawful basis, including certain marketing and promotional activities.
Public task: Where applicable to the performance of an official or public-interest function supported by law.
Vital interests: Where processing is necessary to protect someone's life.
Medical and dental information is classified as special category personal data. Where appropriate, we process this information under Article 9(2)(h) of the UK GDPR for healthcare purposes, together with the relevant provisions of the Data Protection Act 2018.
Other legal conditions may apply in particular circumstances.
Consent to dental treatment is separate from consent relied upon for data protection purposes.
6. Patient Booking and Practice Management – CareStack
Smile Clinic Group uses CareStack as a patient booking and dental practice management system.
CareStack supports the administration of dental services, including:
Patient registration.
Appointment scheduling and reminders.
Clinical record management.
Treatment planning.
Patient communications.
Billing and payment administration.
Operational reporting and practice management.
Personal and clinical information may be processed through CareStack to support the delivery and administration of dental services.
Access is restricted to appropriately authorised personnel in accordance with their roles and responsibilities.
CareStack processes information on behalf of the relevant dental practice under applicable contractual and data protection arrangements.
7. Telephone Communications – VoiceStack
Smile Clinic Group uses VoiceStack to support telephone communications across its dental practices.
VoiceStack may be used for:
Managing incoming and outgoing telephone calls.
Handling appointment enquiries and patient communications.
Supporting administrative and reception services.
Maintaining call logs.
Recording telephone calls where applicable.
Monitoring and improving service quality.
Where telephone calls are recorded, callers will be informed as appropriate.
Call recordings and related information may be processed for legitimate purposes, including staff training, quality assurance, patient service, complaint investigation and the maintenance of accurate communication records.
Access to recordings is restricted to authorised personnel.
We maintain appropriate safeguards to protect the confidentiality of telephone communications.
8. Dental Finance and Payment Providers
Smile Clinic Group offers patients a range of payment options, including access to third-party finance providers.
Our finance partners include:
Where patients choose to apply for dental treatment finance, relevant personal and financial information may be shared with or collected directly by the selected finance provider.
Finance providers may independently process information to assess eligibility, undertake identity and credit checks, administer finance agreements and meet their legal and regulatory obligations.
Such processing is subject to the relevant provider's own privacy policy and applicable data protection legislation.
Smile Clinic Group does not control independent lending decisions made by finance providers.
Patients should review the relevant finance provider's terms and privacy information before submitting an application.
9. Sharing Your Personal Information
We treat all personal and clinical information as confidential.
We may share information with appropriate organisations and professionals where necessary, lawful and relevant to providing our services.
These may include:
Dentists, dental hygienists, therapists and other authorised clinical professionals.
Authorised staff within Smile Clinic Group.
NHS organisations and relevant commissioning bodies.
Dental laboratories and specialist referral providers.
CareStack and VoiceStack.
Chrysalis Finance and Tabeo.
Payment processing providers.
Secure IT, cloud hosting and communications providers.
Professional indemnity organisations and insurers.
Legal advisers, auditors and regulatory authorities.
Other healthcare providers involved in patient care.
Information is only shared where an appropriate lawful basis exists, and confidentiality safeguards are applied.
Where service providers process information on our behalf, we require appropriate contractual and organisational protections.
We do not sell patient personal information or clinical records to third parties.
10. Marketing Communications
Smile Clinic Group may communicate information about dental treatments, promotions, special offers, events and services.
Marketing communications may be sent by email, SMS, telephone or other appropriate channels, subject to applicable data protection and electronic marketing requirements.
Where required by law, we obtain consent before sending marketing communications.
Patients and website visitors may withdraw marketing consent or opt out of marketing communications at any time.
To opt out, you can use the unsubscribe instructions in our messages or contact:
marketing@smileclinicgroup.com
Opting out of marketing will not prevent us from sending important communications relating to appointments, ongoing treatment, patient safety or essential administrative matters.
We do not use confidential clinical information for unrelated marketing without an appropriate lawful basis and any additional consent required by law.
11. Clinical Photography and Social Media
Clinical photographs, videos, radiographs and digital scans may be collected as part of dental assessment, diagnosis, treatment planning and recordkeeping.
Where identifiable patient photographs, treatment outcomes, testimonials or videos are intended for marketing, social media, promotional materials or other non-clinical purposes, we will obtain appropriate permission where required.
Patients are not obliged to provide consent for promotional use.
Refusing promotional consent will not affect the standard of dental care provided.
Where promotional use relies on consent, patients can withdraw their consent at any time by contacting their practice.
Withdrawal will not affect processing already lawfully undertaken. We will take reasonable steps to stop future promotional use and remove relevant materials within our control where appropriate.
12. Website Cookies and Analytics
Our website may use cookies and similar technologies to improve website functionality, understand visitor behaviour and support our services.
These may include:
Essential cookies necessary for website operation.
Functional cookies that remember user preferences.
Analytics cookies to help understand website performance.
Advertising and marketing cookies, where applicable.
Non-essential cookies will only be used where valid consent has been obtained or where an applicable legal exemption exists.
Visitors can manage their cookie preferences through the controls provided on our website and through their browser settings.
Further information about cookies and their purposes may be available through our website's cookie settings or separate cookie notice.
13. Data Security
We take the protection of patient and personal information seriously.
Smile Clinic Group maintains appropriate technical and organisational safeguards designed to protect information against unauthorised access, misuse, accidental loss, alteration or disclosure.
These safeguards may include:
Secure practice management and communication systems.
Password protection and authentication controls.
Role-based access permissions.
Encryption and secure transmission methods.
Staff confidentiality obligations.
Appropriate data protection training.
Security and access reviews.
Secure information storage and disposal.
Data breach management procedures.
Access to confidential patient information is restricted to individuals with a legitimate professional or operational requirement.
Where a personal data breach meets the relevant statutory notification threshold, we will notify the Information Commissioner's Office and affected individuals as required by law.
14. How Long We Keep Your Information
We retain personal and clinical information in accordance with applicable legal, professional and regulatory requirements.
Dental clinical care records are generally retained for a minimum of 11 years, in accordance with the NHS Records Management Code of Practice, subject to applicable exceptions and longer retention requirements.
Different retention requirements may apply to specific records, including children's records, complaint documentation, ongoing legal matters and other information requiring extended retention.
Financial, administrative, recruitment, marketing and communications records are retained according to their respective legal requirements and legitimate operational purposes.
Once information is no longer required, it will be securely deleted, destroyed or anonymised as appropriate.
15. Your Data Protection Rights
Under the UK GDPR, you have certain rights regarding your personal information, subject to applicable legal conditions and exemptions.
These include:
Right of access: You may request a copy of personal information we hold about you.
Right to rectification: You may request correction of inaccurate or incomplete information.
Right to erasure: You may request deletion of personal information in certain circumstances. This does not automatically apply to clinical records that must be retained.
Right to restrict processing: You may request restrictions on certain uses of your information.
Right to data portability: In applicable circumstances, you may request eligible information in a structured, commonly used and machine-readable format.
Right to withdraw consent: Where processing relies on consent, you may withdraw it at any time.
Rights relating to automated decision-making: You have rights in relation to certain solely automated decisions that have legal or similarly significant effects.
Right to Object
You have the right to object to the processing of your personal information in certain circumstances, including an absolute right to object to processing for direct marketing purposes.
To exercise your rights, please contact your local Clinic Lead or email:
marketing@smileclinicgroup.com
We may request reasonable identification before disclosing confidential information.
We will normally respond to valid requests within one calendar month, subject to applicable legal provisions and permitted extensions.
16. Children's Information
Smile Clinic Group provides dental care to children and young people.
We recognise the importance of protecting children's privacy and maintaining appropriate confidentiality.
Where relevant, information may be obtained from or communicated to parents, guardians or individuals with parental responsibility.
Decisions regarding disclosure will take account of the child's age, capacity, understanding, confidentiality rights and relevant legal or safeguarding obligations.
17. International Data Transfers
Some authorised technology, cloud hosting, communications or administrative service providers may process personal information outside the United Kingdom.
Where international transfers occur, we will ensure that appropriate safeguards and legally recognised transfer mechanisms are in place in accordance with UK data protection legislation.
These may include UK adequacy regulations, approved contractual safeguards or other permitted arrangements.
Further information about applicable transfer arrangements may be requested using the contact details in this policy.
18. Recruitment and Employment Information
Where individuals apply for positions within Smile Clinic Group, we may collect and process information provided during recruitment.
This may include:
CVs and application details.
Qualifications and professional registration information.
Employment histories and references.
Relevant identity and right-to-work information.
Other information necessary for recruitment and employment administration.
Such information is processed for recruitment, contractual, regulatory and other lawful employment-related purposes.
Additional privacy information may be provided to applicants, employees and self-employed clinicians where appropriate.
19. Data Protection Responsibilities and Contact Details
Each Smile Clinic Group practice has a designated Clinic Lead responsible for coordinating local data protection and patient confidentiality enquiries.
Clinic Leads act as local points of contact for individuals seeking information about the handling of their personal data or wishing to raise a privacy concern.
Data protection matters may also be referred to the appropriate central team within Smile Clinic Group.
For all data protection enquiries, requests and concerns, please contact:
Smile Clinic Group
Email: marketing@smileclinicgroup.com
Website: www.smileclinicgroup.com
Alternatively, you may contact the Clinic Lead at your local Smile Clinic Group practice.
20. Complaints and the Information Commissioner's Office
If you have concerns about how your personal information has been handled, please contact us so that we can investigate and respond appropriately.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK's independent data protection regulator.
Information Commissioner's Office
Website: www.ico.org.uk
Telephone: 0303 123 1113
You may contact the ICO at any time, although it is generally helpful to raise your concerns with us first.
21. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in legislation, regulatory guidance, technology or the services we provide.
The latest version will be published on our website.
Where changes materially affect how your information is processed, we will provide additional information or notification where legally required.
Smile Clinic Group
www.smileclinicgroup.com
marketing@smileclinicgroup.com
Your privacy, confidentiality and trust are important to us.
