Last updated: 18 October 2026

1. Who we are

Teeth & Face aims to meet the requirements of the Data Protection Act 2018, the UK General Data Protection Regulation (UK GDPR), the Privacy and Electronic Communications Regulations (PECR), the guidance on the Information Commissioner’s website, and our professional guidelines and requirements.

The data controller is Teeth & Face Ltd, registered with the Information Commissioner’s Office under registration number ZB114284. Our Information Governance Lead is Sonya Latif, Practice Manager.

This privacy notice is available on our website at www.teethface.co.uk, at reception, or by email if you contact hello@teethface.co.uk.

2. The data we process

You will be asked to provide personal information when joining the practice. The purpose of processing your personal data is to provide you with the best possible dental and facial aesthetic care.

The categories of data we process are:

• Personal data for the provision of dental and aesthetic health care
• Personal data for providing treatment plans, recall appointments, reminders and estimates
• Personal data such as details of family members, for the care of children or for emergency contact
• Personal data used, with your consent, to send you news about treatments and services by email and text message
• Website usage data, such as IP address and cookie data (see section 6)
• Special category data, including health records, for the delivery of health care and to meet our legal obligations

The personal data we process includes your name, address, gender, date of birth, medical history, dental history, family medical history, family contact details, marital status, financial details for processing payment, your doctor’s details and details of treatment at the practice. If you choose to tell us about your religion or beliefs so we can adapt your care, we will record this only with your agreement.

We obtain your personal details when you enquire about our care and services, including through our website forms, when you join the practice, when you subscribe to our newsletter or register online, when you complete a registration or medical history form, and when another practitioner refers you to us.

We minimise the data we keep, and do not keep it for longer than necessary.

3. Sharing and storage

We never pass your personal details to a third party unless we have a contract for them to process data on our behalf, and we otherwise keep your information confidential. If we intend to refer you to another practitioner or to secondary care, such as a hospital, we will ask your permission before the referral is made and your data is shared.

The organisations that process data on our behalf include Dentally (practice management software), Dengro (enquiry management), Tabeo (treatment finance), Google (website analytics, only with your consent), Trustindex (display of Google reviews), our email provider and our website host.

• Personal data is stored in the UK and the European Economic Area (EEA), in digital or hard copy format.
• Some of our suppliers may store personal data outside the UK in digital format, only where suitable safeguards are in place, such as UK adequacy regulations or the International Data Transfer Agreement.

For full details of where your data is stored, please ask to see our Information Governance Procedures.

4. Why we process your data and our lawful basis

Why we process your data	Lawful basis	Special category condition
To maintain your contemporaneous clinical records	Legal obligation	Health care purposes
To provide you with treatment, prevention and oral health advice	Contract	Health care purposes
To refer you to other dentists, doctors and health professionals	Contract	Health care purposes
To carry out financial transactions with you, including finance applications	Contract	Not applicable
To communicate with you about appointments, treatment plans and estimates	Contract	Not applicable
To contact your next of kin in an emergency	Vital interests	Vital interests
To communicate with a parent or carer about the person they care for	Legitimate interests	Health care purposes
To send your data to the General Dental Council or another authority as required by law	Legal obligation	Health care purposes
To send you marketing, newsletters or news about treatments	Consent	Not applicable
To respond to enquiries made through our website	Legitimate interests	Not applicable
To improve our website using analytics cookies	Consent	Not applicable
For debt recovery	Legitimate interests	Not applicable
To continually improve the care and service you receive from us	Legitimate interests	Not applicable

5. How long we keep your data

We keep patient records for at least 11 years after your last treatment if you are an adult. For children, records are kept until their 25th birthday or for 11 years after their last treatment, whichever is longer. Records may be kept longer for complex cases or to meet our legal requirements.

Other personal data is kept for 2 years after it was last processed. Full details are in our Record Retention procedure, available from the practice.

6. Our website, forms and cookies

Enquiry and booking forms. When you contact us through our website, we collect the details you enter, such as your name, email address, phone number and the treatment you are interested in. We use this to respond to your enquiry, and it is managed through our enquiry system, Dengro.

Finance applications. If you apply for treatment finance, your application is handled by our finance provider, Tabeo Finance Limited, which acts as a joint controller with us for that application. Tabeo’s own privacy policy explains how it uses your data.

Embedded content. Some pages include YouTube videos and Google reviews displayed through Trustindex. These services may collect data about your visit, and we only load them once you have given consent.

Cookies. We use strictly necessary cookies to make our website work. We only use analytics or marketing cookies if you agree to them through our cookie banner. You can change your choices at any time using the Cookie Settings link on our Cookie Policy page, which also gives full details of the cookies we us. Full details are in our Cookie Policy.

7. Your rights

You have the following rights over your personal data:

• The right to be informed about the collection and use of your personal data
• The right of access, to have a copy of the data we hold about you. Generally, we will not charge for this
• The right to rectification, to correct data that is inaccurate or incomplete
• The right to erasure of your personal data (clinical records must be kept for a set period)
• The right to restrict processing of your personal data
• The right to data portability, to have your data transferred to someone else
• The right to object to the processing of your personal data
• Rights in relation to automated decision making and profiling
• The right to withdraw consent at any time, where we rely on consent

Some practical examples:

• If you are a patient, you can withdraw consent for newsletters, surveys or marketing at any time. You can ask us to correct errors in your details, or to stop contacting you by phone, email or text for these purposes. You can obtain a free copy of your patient records within one month.
• If you are not a patient, you can withdraw consent for us to process your data, obtain a free copy of it within one month, ask us to correct it or ask us to delete it.

Further details of these rights are in our Information Governance Procedures and on the Information Commissioner’s website.

We have carried out a Data Protection Impact Assessment, recorded in our Sensitive Information Map, DPIA and Risk Assessment, and you can request a copy using the details below. Details of how we keep your data secure are in our Security Risk Assessment and Information Governance Procedures.

8. Comments, suggestions and complaints

Please contact our Information Governance Lead with any comment, suggestion or complaint about how we process your data, by emailing hello@teethface.co.uk, or by writing to or visiting the practice at 3 Legge Lane, Birmingham, B1 3LD. We take complaints very seriously.

If you are unhappy with our response, or need advice, you can contact the Information Commissioner’s Office (ICO) on 0303 123 1113 or at ico.org.uk, where you can also chat online with an advisor. The ICO can investigate your complaint and take action against anyone who has misused personal data.

9. Related practice procedures

You can use the contact details below to request copies of:

• Data Protection and Information Security Policy
• Sensitive Information Map, DPIA and Risk Assessment
• Information Governance Procedures
• Record Retention

For any enquiry or request, please contact our Information Governance Lead, Sonya Latif.

Teeth & Face Ltd
3 Legge Lane, Birmingham, B1 3LD
Email: hello@teethface.co.uk

10. National data opt-out

The national data opt-out lets you choose whether your confidential patient information is used for research and planning beyond your individual care. You can find out more, or register your choice, at nhs.uk/your-nhs-data-matters.

We only use your health data to provide your individual care and do not disclose it for any other purpose. This means the national data opt-out does not currently apply to how we use your data. If this changes, we will apply your choice.

Your data is never shared with insurance companies or used for marketing purposes without your specific agreement.

11. Staff and job applicants

This section explains how Teeth & Face processes the information of team members and applicants for roles at the practice.

What data do we hold?

So that we can provide a safe and professional service, we keep certain records about our team members, including:

• Basic details and contact information, such as name, address, date of birth, National Insurance number and next of kin
• Financial details, so that we can pay you, plus insurance, pension and tax details
• Training records

We also record the following special category data:

• Health data, including physical and mental health, only where we need it as your employer, such as fit notes or claims for statutory maternity or paternity pay
• With your permission, data about your race, ethnic origin, sexual orientation or religion, for equal opportunities monitoring

You may be required to undergo a criminal record check. This information is kept no longer than necessary, usually not more than 6 months after the recruitment decision, unless a dispute is raised or in exceptional circumstances.

Why do we hold this data?

We need this data so that we can contact you, pay you, and make sure you receive the training and support you need. We process your data because:

• We have a legal obligation under UK employment law
• We have a legitimate interest, for example in administering training, emergency planning, and managing operational, HR and recruitment matters
• We are required to provide data to our regulator, the CQC, as part of our legal obligations
• We need to process special category data to handle sick pay or maternity pay
• Where we request criminal records data, it is because the law requires it for the type of work you do, as set out in the Data Protection Act 2018 and the Rehabilitation of Offenders Act 1974 (Exceptions) Order 1975
• Where we rely on your consent, we will offer you a clear choice, explain what the data is for, and tell you how to withdraw consent

Where do we collect your data from?

We collect data from you or your legal representatives, and from third parties such as references from previous employers. We do this face to face, by phone, by email, through our website, by post and through application forms.

Who do we share your data with?

• HMRC
• Our pension and healthcare schemes
• Our external payroll provider
• Organisations we have a legal obligation to share with, such as for safeguarding or the CQC
• The police or other law enforcement agencies, where required by law or court order

How long do we keep your data?

Staff records are kept for 6 years, although some information may lawfully be kept longer. Our Record Retention procedure explains how we keep and dispose of staff data. Application forms and interview notes for unsuccessful candidates are kept for one year.

Your rights

You have rights over how we process your personal data, including the right to complain to the Information Commissioner’s Office. You can request a copy of your personal file from our Information Governance Lead, Sonya Latif.