who are we?
Hydean Dental Practice (“we”, “us”, “our”) is the data controller for the personal information we hold about our patients, website visitors and enquirers.
Address: 1 Hyde Green S, Shephall, Stevenage SG2 9XU, United Kingdom
Telephone: 01438 351548
Email: info@hydeandental.com
ICO registration number: ZB388473
Our appointed Data Protection Officer is: Ametros Group Ltd
Lakeside Offices, Thorn Business Park, Rotherwas Industrial Estate
Hereford, Herefordshire, HR2 6JT
Telephone: 0330 223 2246
Email: dpo@ametrosgroup.com
Website: www.ametrosgroup.com
Our Information Governance Lead is Kishan Lakhani, who can be contacted using the practice details above.
what this policy covers
Last updated: 10 July 2026
This policy explains how we collect, use, store, and protect personal data when you visit our website, contact us online, or become a patient of the practice. It is written to meet the requirements of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
The information we collect
Depending on how you interact with us, we may collect:
Website and Enquiry Data
Name, email address, phone number and any message details you submit through a contact or enquiry form; technical data such as IP address and browsing behaviour, collected via cookies (see our Cookie Policy).
Booking Data
When you book an appointment through our online booking system, your name, contact details and appointment preferences are collected and processed by our booking provider on our behalf.
Patient Data
Name, address, date of birth, gender, NHS number, medical and dental history, family/emergency contact details, GP details, treatment plans and clinical notes, radiographs, photographs and study models, and financial details for payment and NHS exemption purposes.
Special category (health) Data
Your dental and medical history, and where relevant, information about ethnicity, religion or disability that helps us provide appropriate care or meet our obligations under the Equality Act 2010.
How we use your information and our lawful basis
We only use personal data where we have a lawful basis to do so under UK GDPR:
- Consent — for example, when you opt in to marketing communications or complete an online enquiry form.
- Performance of a contract — to provide the dental treatment and care you have agreed to.
- Legal obligation — for example, sharing information with the General Dental Council, HMRC or the NHS where required by law.
- Legitimate interests — to run and improve the practice, including appointment reminders, service improvement and understanding how our website is used.
Special category health data is processed on the basis that it is necessary for the provision of health care, or to meet our obligations under the Equality Act 2010. Where we rely on consent for special category data (such as before/after photographs used in marketing), we will always ask you separately, and you may withdraw consent at any time.
We use your data to: provide dental treatment and advice; manage appointments, reminders and recalls; process payments and NHS claims; communicate with you about your care; refer you to other clinicians when needed; meet our legal and regulatory obligations to the GDC, CQC and NHS; and, where you have agreed, send you practice news or marketing.
Who we share your information with
We do not sell your personal data. We may share it with:
- Other healthcare professionals involved in your care (e.g., your GP, a hospital, or a specialist we refer you to), with your permission where required.
- NHS England, HMRC and the NHS Business Services Authority, for NHS treatment and payment administration.
- The Care Quality Commission (CQC), which has legal powers to access records to carry out its regulatory functions.
- Our appointment booking provider and IT/software suppliers, including AI-powered booking and communication tools, who process data on our behalf under contract (see “Use of AI and automated tools” below).
- The General Dental Council or other regulators, where required by law.
Personal data is stored within the UK/EU. Where a supplier stores data outside the UK/EU, we only use providers with appropriate safeguards in place (such as UK adequacy regulations or standard contractual clauses).
Use of AI and other automated tools
We use third-party software, including AI-powered tools, to help manage appointment bookings and patient communications — for example, an AI chat or phone assistant that can check availability and book, confirm or reschedule appointments on your behalf. These tools connect securely to our practice management system (Dentally) to access the patient information needed to carry out these tasks.
The companies providing these tools act as data processors: they only use your data to carry out the services we’ve instructed them to provide, under a data processing agreement with us, and they are not permitted to use it for their own purposes.
Some routine actions, such as booking, confirming or rescheduling a straightforward appointment through a chat or phone assistant, may be completed by the automated system without a staff member being involved at that exact moment. However, a member of our team checks all appointments made this way. We do not use AI to make decisions about your care, treatment or eligibility for services without a member of our clinical or administrative team being involved.
If you would like more information about how a particular automated tool uses your data, or you would like a member of our team to review a decision made using one of these tools, please contact us using the details above.
How long do we keep your information
Record type | Retention period |
|---|---|
Adult patient clinical records | Minimum 10 years from last treatment (longer for complex cases) |
Children’s clinical records | Until the patient’s 25th birthday, or 26th if aged 17 at the conclusion of treatment |
Complaints records | 11 years |
Staff employment records | 6 years after employment ends |
General enquiry/website contact data | 2 years from last contact, unless you become a patient |
Full details of our retention schedule are set out in our internal Record Retention Policy, a copy of which is available on request.
Keeping your data secure
We protect personal data using password-protected and encrypted computer systems, secure off-site backups, lockable and fireproof storage for paper records, restricted “need to know” access, CCTV and intruder alarms at our premises, and staff training on confidentiality. Any suspected data breach is investigated and reported in line with our legal obligations.
Your rights
Under UK GDPR, you have the right to:
- Be informed about how your data is used;
- Access a copy of the data we hold about you;
- Have inaccurate data corrected;
- Request deletion of your data (subject to our legal obligation to retain clinical records);
- Restrict or object to certain processing, including direct marketing;
- Request that your data be transferred to another provider (data portability).
To exercise any of these rights, contact us at info@hydeandental.com or 01438 351548. We will normally respond within one month.
Complaints about how we handle your data
If you are unhappy with how we have used your personal data, please contact our Information Governance Lead in the first instance using the details above. If you remain dissatisfied, you can contact the Information Commissioner’s Office (ICO):
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Telephone: 0303 123 1113
Website: ico.org.uk
Changes to this policy
We may update this policy from time to time. The “last updated” date at the top of this page shows when it was last revised. Please check back periodically. If you have any questions about our use of cookies, contact us at info@hydeandental.com or 01438 351548.
