Website & Patient Privacy Notice

Website & Patient Privacy Notice

Last updated: September 2026

This notice explains how we collect, use, share, store and protect personal information when you use our website or receive dental care from us. It also explains your rights under UK data protection law.

‍

‍

Who We Are

Data controller: Bridge Dental Surgeries Limited

Trading as: Bridge Dental Marlow
‍
Company number: 07894190
‍
Practice address: 32 Station Road, Marlow, Buckinghamshire, SL7 1NE

Registered address: 7-9 The Avenue, Eastbourne, BN21 3YA
‍
‍Telephone: 01628 474 044
‍
‍Email: info@bridgedentalmarlow.co.uk
‍
‍Website: www.bridgedentalmarlow.co.uk
‍

‍

You can contact our Data Protection Officer using the email above, and please address your enquiry to the Data Protection Officer.

‍

‍

How We Collect Personal Information

‍
‍
‍

We usually collect personal information directly from you, for example when you contact us, register as a patient, complete forms or a medical history, use our patient portal, make a payment, attend an appointment, or communicate with us.

We may also receive information from:

‍

‍

• other dentists, doctors, hospitals and healthcare professionals involved in your care
• a parent, guardian, carer, family member or representative where appropriate
• the NHS and other health bodies
• dental plan providers and insurers
• referrers, laboratories and specialist providers
• regulators, public authorities, courts or law-enforcement bodies where permitted or required by law
• your solicitor or another authorised representative
• website, communications and technology providers, where relevant to the services you use

‍

The Personal Information We Use and Why

The table below summarises the main categories of information we process, why we use them, and the principal lawful bases we rely on. For treatment and care, our principal Article 6 bases are contract under Article 6(1)(b) for private dental care and public task under Article 6(1)(e) for NHS dental care. Where special-category information is involved, such as health, ethnicity or religious information, we also identify the relevant Article 9 condition.
‍

Identity and contact information

‍
Examples: Name, address, email, telephone number, date of birth, patient number, signatures and identity details.
Why we use it: Register and identify you; manage appointments and treatment; communicate with you; maintain accurate records.
Lawful basis: Article 6(1)(b) for private dental care under our contract with you; Article 6(1)(e) for NHS dental care carried out as a public task; Article 6(1)(c) where required by law; and Article 6(1)(f) for proportionate practice administration.
‍

‍

‍

‍

‍

‍

Clinical and health information

‍
Examples: Medical and dental history, medications, allergies, diagnoses, treatment plans, clinical notes, radiographs, scans, clinical photographs, referrals and correspondence.
Why we use it: Assess your health; plan and provide safe dental care; maintain clinical records; referrals; safeguarding; clinical audit; respond to complaints, claims and regulatory enquiries.
Lawful basis: Article 6(1)(b) for private dental care under our contract with you, or Article 6(1)(e) for NHS dental care carried out as a public task. Article 9(2)(h) applies to health or social care. Article 6(1)(c) may apply where required by law, and Article 9(2)(f) where processing is necessary for legal claims.
‍

Family, carers and representatives

‍
Examples: Next of kin, parents, guardians, carers, attorneys and authorised representatives.
Why we use it: Emergency contact; support communication and care; verify authority to act for you.
Lawful basis: Article 6(1)(b) for private dental care; Article 6(1)(e) for NHS dental care as a public task; Article 6(1)(c) where required by law; or Article 6(1)(f) for proportionate administration. Consent may be used for discretionary disclosures where appropriate.
‍

Financial and payment information

‍
Examples: Payment records, invoices, treatment-plan payments, dental plan details and relevant NHS exemption information.
Why we use it: Take payments; administer plans; recover debts; process NHS claims; meet accounting and tax obligations.
Lawful basis: Article 6(1)(b) contract; Article 6(1)(c) legal obligation; Article 6(1)(e) public task for relevant NHS processing; Article 6(1)(f) legitimate interests for proportionate debt recovery.
‍

Communications

‍
Examples: Emails, letters, messages, call notes and, where used, call recordings or transcriptions.
Why we use it: Manage enquiries, appointments, complaints and feedback; maintain records; defend legal claims or respond to regulators.
Lawful basis: Article 6(1)(b) for private dental care; Article 6(1)(e) for NHS dental care as a public task; Article 6(1)(c) for legal or regulatory requirements; or Article 6(1)(f) for administration and claims. Article 9(2)(h) applies to care and Article 9(2)(f) may apply to legal claims.
‍

Website and technical information

‍
Examples: IP address, device/browser information, cookie identifiers, website usage, portal logs and security logs.
Why we use it: Operate and secure our website and systems; prevent misuse; understand website performance; provide online services.
Lawful basis: Article 6(1)(f) legitimate interests, and consent where required for non-essential cookies or similar technologies.
‍

CCTV and security information
‍

Examples: Images captured by CCTV where CCTV is in use.
Why we use it: Protect patients, staff, visitors and property; prevent and investigate crime or incidents.
Lawful basis: Article 6(1)(f) legitimate interests, subject to appropriate necessity and proportionality.
‍

Marketing preferences and non-clinical media
‍

Examples: Marketing preferences, testimonial content, and non-clinical photographs or videos used for promotional purposes.
Why we use it: Send permitted marketing; publish testimonials or promotional content where agreed.
Lawful basis: Article 6(1)(a) consent where consent is used. Electronic marketing is also handled in accordance with PECR. Legitimate interests may apply to limited business communications where legally permitted.

‍

‍

Ethnicity, language, religion or belief where relevant
‍

Examples: Information you provide about ethnicity, language, religion or beliefs where it is relevant to your care or legal obligations.
Why we use it: Provide safe, appropriate and accessible care; meet equality obligations where applicable.
Lawful basis: Article 6(1)(b) for private dental care, or Article 6(1)(e) for NHS dental care as a public task. Article 9(2)(h) applies where the information is needed for healthcare. Article 9(2)(g), with the relevant Data Protection Act 2018 condition, may apply where processing is in the substantial public interest.
‍

‍
‍

Where we rely on consent

‍
We use consent only where consent is the appropriate lawful basis, for example for certain marketing communications or the promotional use of non-clinical photographs, videos or testimonials. You can withdraw consent at any time. Withdrawal does not affect processing that took place before consent was withdrawn, and it does not affect processing that we need to carry out under another lawful basis.

‍

‍

‍

‍

‍

‍
‍

‍

Information needed for treatment
‍

To provide safe dental care, we need certain information about you, including relevant medical and dental history. If you do not provide information that is necessary for safe treatment, we may be unable to provide some or all of the care requested.

‍
Who We Share Your Information With

‍

We only share personal information where there is a lawful reason to do so and only to the extent necessary. Depending on your circumstances, recipients may include:

‍

• healthcare professionals involved in your care, including dentists, doctors, hospitals, specialists, laboratories and referral providers
• NHS bodies and commissioners where relevant to NHS care, claims, audit or administration
• regulators and professional bodies such as the Care Quality Commission and General Dental Council, where required or appropriate
• social services, safeguarding bodies, law-enforcement agencies, courts, tribunals or coroners where permitted or required by law
• insurers, dental plan providers, solicitors and professional advisers where relevant and lawful
• accountants, auditors and other professional service providers
• IT, cybersecurity, communications and cloud service providers that process information on our behalf
• dental practice management and patient portal providers, including CareStack UK, which processes patient information on our behalf
• potential purchasers and their professional advisers if the ownership of the practice is being considered or changed, subject to appropriate
• confidentiality and data-protection safeguards
  ‍

Where a supplier acts as our processor, we require an appropriate written contract and expect the supplier to provide sufficient guarantees that personal information will be protected in accordance with UK data protection law.

‍

CareStack and patient portal services
‍

We use CareStack UK as a dental practice management and patient portal provider. Information entered into the CareStack service, including information you submit through the patient portal, is processed on our behalf for purposes connected with the administration and delivery of your dental care. The main patient data environment used for our service is hosted in the United Kingdom.

‍

‍

‍

‍

International Access and Transfers

‍

Some of our suppliers operate internationally. In limited circumstances, authorised support personnel located outside the UK may remotely access information held within UK-hosted systems in order to provide technical support.
‍
Remote access from another country can constitute a restricted international transfer even where the information remains stored on servers in the UK.

Where UK data protection law requires safeguards for such access or transfers, the relevant organisation is required to use an appropriate transfer mechanism and to complete any applicable data protection assessment. Depending on the circumstances, safeguards may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, binding corporate rules, or another mechanism permitted by law.
‍
You may contact us if you would like further information about the safeguards relevant to a particular international transfer involving your personal information.

‍

‍

‍

‍

How Long We Keep Your Information

‍
‍

We keep personal information only for as long as necessary for the purposes for which it was collected and to meet clinical, legal, regulatory, tax, insurance and professional requirements. Different categories of information are retained for different periods.

• Clinical dental records are retained in accordance with applicable NHS, professional, medico-legal and record-management requirements.
• Financial and accounting records are retained for the periods required by tax and accounting law.
• CCTV, website logs, enquiries, recordings and marketing information are retained for shorter periods determined by necessity, risk and the purpose for which they were collected.
• Where a complaint, claim, investigation or legal hold applies, relevant information may be kept for longer where this is necessary and lawful.

You can ask us for further information about the retention period that applies to a particular category of your information.

‍

‍

‍

How We Protect Your Information

We use technical and organisational measures designed to protect personal information against accidental or unlawful loss, alteration, disclosure or access. These measures include access controls, role-based permissions, security monitoring, staff confidentiality obligations, secure systems and appropriate supplier contracts. Access to patient information is limited to people who need it for their role.

‍

‍

Children and Young People

We process personal information about children and young people where they receive dental care from us. We take account of the child or young person's age, understanding and circumstances when communicating about privacy and when responding to requests about their information. A parent or person with parental responsibility may sometimes exercise rights on behalf of a child, but this is not automatic in every case. We will consider confidentiality, the young person's capacity and any safeguarding or legal requirements before disclosing information.

‍

‍

‍

Automated Decision-Making

We do not currently use personal information to make solely automated decisions that produce legal effects, or similarly significant effects, about patients.

‍

‍

‍

‍

Your Data Protection Rights

Depending on the circumstances and the lawful basis on which we process your information, you may have the right to:

• ask for access to your personal information and the supplementary information required by Article 15 UK GDPR
• ask us to correct inaccurate information or complete incomplete information
• ask us to erase information in certain circumstances
• ask us to restrict processing in certain circumstances
• object to processing in certain circumstances, including an absolute right to object to direct marketing
• receive certain information you provided to us in a portable format where the right to data portability applies
• withdraw consent at any time where we rely on consent
• complain to the Information Commissioner’s Office

These rights are not absolute. For example, we may be required to retain dental records even if you ask us to delete them. We will explain the position if an exemption or restriction applies.

‍

Your Right to Object

Where we rely on legitimate interests or, in some circumstances, public task, you may have the right to object to the processing. If you object, we will consider your circumstances and the legal requirements that apply. You have an absolute right to object to the use of your personal information for direct marketing.

‍

‍

‍

‍

Making a Data Protection Rights Request
‍

How long will you take to respond?
We normally respond without undue delay and within one month of receiving a valid request. The time limit is calculated in accordance with UK data protection law. If the deadline falls on a weekend or public holiday, it moves to the next working day. In limited cases involving complexity or multiple requests, the law allows the response period to be extended and we will tell you if this applies.
‍
Does my request have to be in writing?
No. You can make a request verbally or in writing. We may ask for information needed to identify you or understand the request, but you do not have to use a particular form.
‍
What if you need clarification?
If we genuinely need more information to identify the personal information you are asking for, we may ask you to clarify the request. We will explain what information we need and how this affects the response timetable.
‍
Will I be charged?
Rights requests are normally free of charge. In limited circumstances permitted by law, we may charge a reasonable fee or refuse to act if a request is manifestly unfounded or excessive.
‍
Can a request be refused or restricted?
Only where the law permits. If we refuse to act, rely on an exemption, or restrict the information provided, we will explain this unless the law prevents us from doing so. A request is not manifestly unfounded or excessive simply because it is broad or because you do not explain why you are making it.

Can someone make a request for me?
Yes. We may ask for evidence that the person is authorised to act for you. We will also consider confidentiality and may contact you directly where appropriate.

‍

‍

Website, Cookies and Online Services

Our website may use cookies and similar technologies. Where consent is required for non-essential cookies, we will ask for it through our cookie controls. More information about the technologies used on our website should be provided in our cookie notice or cookie settings. Links to third-party websites are governed by the privacy information of those third parties.

‍

‍

How Your Information May Be Used by the NHS

When you receive NHS-funded care, information may be used within the health and care system for purposes connected with your care and, where the law permits, for wider purposes such as service planning, improving standards, patient safety and research.
Where possible, anonymised information is used for purposes beyond your individual care. In some circumstances, confidential patient information may be used for research and planning where there is a lawful basis to do so.

‍

National Data Opt-Out

‍
The National Data Opt-Out allows you to choose whether your confidential patient information can be used for certain research and planning purposes beyond your individual care. It does not prevent information being used when necessary to provide your direct care, and it does not prevent us from maintaining your dental record or using systems needed to provide your treatment.
‍

If you are happy for your confidential patient information to be used for applicable research and planning purposes, you do not need to do anything. If you wish to opt out, you can record or change your choice through the NHS service at: www.nhs.uk/your-nhs-data-matters
‍

The National Data Opt-Out does not apply in every situation. There are circumstances where confidential patient information may still be used or disclosed because another legal requirement or exemption applies.
‍

You can change your choice at any time.

‍

‍

Changes to This Privacy Notice

We may update this notice from time to time to reflect changes in our services, suppliers, legal requirements or processing activities. The date at the top of this notice shows when it was last updated.

‍

Concerns and Complaints

If you have concerns about how we use your personal information, please contact us first so that we can try to resolve the issue.

‍

Post: Bridge Dental Marlow, 32 Station Road, Marlow, Buckinghamshire, SL7 1NE

Telephone: 01628 474 044

Email: info@bridgedentalmarlow.co.uk
‍

‍
‍

You also have the right to complain to the Information Commissioner’s Office (ICO). Information about making a complaint is available at ico.org.uk/make-a-complaint/.

‍