Privacy Policy

1. PURPOSE

Watercress House Dental & Implant Clinic aims to meet the requirements of the Data Protection Act 2018, the United Kingdom General Data Protection Regulation (UK GDPR), the guidelines on the Information Commissioner’s (ICO) website, and our professional guidelines and requirements. This privacy notice describes the type of personal information we hold, why we keep it, and what we do with it.

2. REGISTERED NAME

The data controller is Watercress Dental Ltd.

3. CONTACT DETAILS

If you have an enquiry or request, please contact Ellen White

Watercress House Dental & Implant Clinic

1 The Windmills, St Mary’s Close, Alton, East Hampshire, GU34 1EF

Email: info@watercressdental.co.uk

Phone: 01420 544408

Our Data Protection Officer (DPO) can be contacted using the details above.

This privacy notice is also available on the practice website at https://watercressdental.co.uk/, or a hard copy can be requested from the Practice by emailing or calling directly.

4. WHAT INFORMATION WE COLLECT, USE AND WHY

The personal data we process includes:

Name, address, contact details, gender, pronoun preferences, date of birth, nationality, NHS number, medical history, dental history, family medical history, family contact details, emergency contact details, marital status, information about care needs, financial details, doctor’s details, treatment plans, consent, X-rays, clinical photographs, digital scans, study models, appointment dates, details of complaints, call recordings.

We may also process more sensitive special category data, including:

Ethnicity, race, religion, health records, sex life information, or sexual orientation.

The reasons we process the data include:

• To fulfil our contract with you
• To maintain a contemporaneous clinical record
• To discuss treatment options
• To provide dental prevention and oral health advice
• To ensure any medication we prescribe is suitable
• To modify treatments based on individual needs
• To meet our obligations under the Equality Act 2010
• To carry out financial transactions
• To manage appointments, recall arrangements and send reminders
• To communicate with your next of kin in an emergency
• To communicate with parents or carers about the person being cared for
• To refer to other dentists, doctors and health professionals as required
• For debt recovery
• To continually improve the care and service you receive from us
• To assist with safeguarding or public protection concerns
• To assist with dealing with queries, complaints or claims

5. LAWFUL BASIS (PERSONAL DATA)

Our lawful bases for processing personal data:

• A legitimate interest to provide evidence-based dental care to patients safely and effectively
• Consent of the data subject
• To comply with our legal obligations

6. LAWFUL BASIS (SPECIAL CATEGORY DATA)

Our Article 9 conditions for processing special category data:

• Processing is necessary for ethical and professional health care purposes
• Processing is necessary to monitor and assess the quality of opportunity or treatment between different groups
• Consent of the data subject

7. DATA PROTECTION RIGHTS

You have the following personal data rights:

• The right of access – you can ask for a copy of the data we hold about you. We do not usually charge you for copies of your information; if we charge you, we will explain why
• The right to rectification – you can ask us to correct or delete information if it is inaccurate or incomplete. If we have disclosed that information to a third party, we will let them know about the change
• The right to erasure – you can ask us to delete your personal data. For legal reasons, we may be unable to erase certain information (for example, information about your dental treatment). However, we can, if you ask us to, delete some contact details and other non-clinical information
• The right to restrict processing – you can ask us to limit how we use your personal data. For example, stop sending you appointment reminders or information about our service
• The right to data portability – you can ask us to transfer your personal data to someone else. For example, supplying your information electronically to another dentist
• The right to withdraw consent – you can withdraw your consent to the processing of your personal data at any time. For example, even if you have given us consent to send you marketing information, you may withdraw that consent

8. WHERE WE GET PERSONAL INFORMATION FROM

We obtain your details when you enquire about our care and service, when you join the practice, when you subscribe to our newsletter or register online, when you complete a registration or medical history form, from family members or carers, and when another healthcare provider refers you for treatment at our practice.

We will be using CCTV to:

• Protect the practice premises and property
• Increase the safety of patients, staff and visitors
• Deter criminal activity and anti-social behaviour
• Assist in the apprehension, identification and prosecution of offenders (if required)
• Provide evidence to a court or tribunal (if required)

9. HOW LONG WE KEEP INFORMATION

We minimise the data that we keep, and do not keep it for longer than necessary.

We keep your records for 11 years after the date of your last visit to the Practice or until you reach the age of 25, whichever is longer. At your request, we will delete non-essential information (for example, some contact details) before the end of this period.

Images captured with CCTV will be kept and destroyed securely after 3 months unless they are needed for longer due to ongoing investigation, legal proceedings, or regulatory compliance.

10. HOW WE STORE INFORMATION

We store your personal information securely on our practice computer system and in a manual filing system. Only those working at the practice have access to your information. They understand their legal responsibility to maintain confidentiality and follow practice procedures to ensure this.

We take precautions to ensure the security of the practice premises, the practice filing systems and computers.

We use high-quality specialist dental software to record and use your personal information safely and effectively. Our computer system has a secure audit trail, and we back up information routinely.

11. SHARING INFORMATION

To provide you with appropriate care, we might need to share personal data with the following;

however, only the minimum information required will be shared:

• Another dentist or other health professional who is caring for you
• Your GP, consultant, or Occupational Health Professional
• A laboratory
• The Inland Revenue
• A private dental scheme, if you are a member
• Safeguarding organisations

12. SHARING CCTV RECORDINGS

When using or processing CCTV recordings, we will respect the legal rights of the individuals shown in them. We will not share images or recordings except in the following circumstances:

• If requested by the local authority, police or courts for the investigation, prevention or prosecution of anti-social behaviour or criminal activity
• For bringing or defending a legal claim
• To comply with a police warrant or an order given by a court or tribunal

13. DUTY OF CONFIDENTIALITY

Exceptional circumstances might override the duty to maintain confidentiality. We will inform you of requests to share personal information where possible. The decision to disclose information will only be taken by senior staff. Examples include:

• Situations where there is a serious public health risk or risk of harm to other individuals
• When information is required by the police to prevent or detect crime or to apprehend or prosecute offenders (if not providing the information would prejudice these purposes)
• In response to a court order
• To enable a dentist to pursue a legal claim against a patient

14. HOW TO COMPLAIN

Contact us using the contact details at the top of this privacy notice.

If you remain unhappy with our response or feel unable to discuss it with the Practice, you can contact the Information Commissioner’s Office (ICO) on 0303 123 1113 or by visiting

https://www.ico.org.uk/make-a-complaint.

15. REVIEW AND REVISION

This privacy notice is reviewed annually and updated to ensure its effectiveness and compliance with current regulations, guidance, and standards.

Last modified: 10 Aug 2026

1. PURPOSE

Watercress House Dental & Implant Clinic aims to meet the requirements of the Data  Protection Act 2018, the United Kingdom General Data Protection Regulation (UK GDPR), the guidelines on the Information Commissioner’s (ICO) website, and our professional guidelines.

This privacy notice explains how we process the information of our staff. It covers:

Applicants, employees, and workers, including agency, casual and contracted staff, volunteers, trainees, apprentices, and work experience placements.

2. REGISTERED NAME

The data controller is Watercress Dental Ltd.

3. CONTACT DETAILS

If you have an enquiry or request, please contact Ellen White:

Email: info@watercressdental.co.uk

Phone: 01420 544408

Our Data Protection Officer (DPO) can be contacted using the details above.

This privacy notice is also available on the practice website at https://watercressdental.co.uk/, or a hard copy can be requested from the Practice by emailing or calling directly.

4. WHAT INFORMATION WE COLLECT, USE, AND WHY

The personal data we process includes:

Name, address (including proof of address), contact details, gender, pronoun preferences, date of birth, National Insurance number, employment history, education history, right to work information, employment contract, next of kin, emergency contact details, marital status, financial details, expenses, overtime, leave, pension details, training records, performance records, training history, occupational health records, fit notes, accident records, access  needs, photo ID.

We may also process more sensitive special category data, including:

Ethnicity, race, religion, health records, disabilities, criminal convictions (DBS checks), or sexual orientation.

The reasons we process the data include:

1. Staff recruitment and selection
2. Obtaining criminal record disclosures in line with our legal obligations
3. Fulfilling our contract with you
4. Ensuring we can contact you
5. Maintaining staff records, including payroll, benefits, etc.
6. Managing salaries and pensions
7. Managing health and wellbeing
8. Processing requests for sick pay
9. Processing requests for statutory maternity/paternity leave
10. Monitoring equal opportunities
11. Providing facilities and access to IT systems
12. Providing the training and support you need to perform your job
13. Communicating about the Practice, including news and events
14. Managing HR processes like absence, parental leave, and workforce planning
15. Providing data to our regulator, CQC, as part of our public interest obligations
16. Assisting with dealing with queries, complaints or claims
    
    

5. LAWFUL BASIS

Our lawful bases for processing data:

1. A legitimate interest to provide training, learning, emergency planning, etc.
2. Consent of the data subject
3. To comply with our legal obligations under UK employment law
   
   

6. DATA PROTECTION RIGHTS

You have the following personal data rights:

1. The right of access – you can ask for a copy of the data we hold about you
2. The right to rectification – you can ask us to correct or delete information if it is inaccurate or incomplete
3. The right to erasure – you can ask us to delete your personal data where there is no need for us to continue processing it and when the retention period has lapsed
4. The right to restrict processing – you can ask us to limit how we use your personal data based on personal circumstances
5. The right to data portability – you can ask us to transfer your personal data to someone else
6. The right to object – you can object to how your information is used
7. The right to withdraw consent – you can withdraw your consent to the processing of your personal data at any time
8. The right to challenge any automated decision-making
   
   

7. WHERE WE GET PERSONAL INFORMATION FROM

We obtain your details from you directly, your legal representatives, and third parties, such as referees, employment agencies, occupational health providers, pension administrators, government departments (e.g. HMRC, DWP), and public sources (e.g. LinkedIn).

We do not currently use CCTV. However will be implementing this to:

1. Protect the practice premises and property
2. Increase the safety of patients, staff and visitors
3. Deter criminal activity and anti-social behaviour
4. Assist in the apprehension, identification and prosecution of offenders (if required)
5. Provide evidence to a court or tribunal (if required)
   
   

8. HOW LONG WE KEEP INFORMATION

We minimise the data that we keep, and do not keep it for longer than necessary.

Criminal record check information is not kept for longer than is necessary—usually not more than 6 months following the recruitment decision, unless a dispute is raised or, in exceptional circumstances.

The retention period for staff records is 6 years; however, certain information relating to team members may lawfully be kept for longer. Team members should refer to the Record Retention Schedule (M 215A) for further details. Application forms and interview notes for unsuccessful candidates are kept for one year.

Images captured with CCTV will be kept and destroyed securely after 3 months unless they are needed for longer due to ongoing investigation, legal proceedings, or regulatory compliance.

9. HOW WE STORE INFORMATION

We maintain electronic and paper records related to your recruitment and employment. The practice holds this information with your line manager. All paper files are securely stored, and only relevant staff can access them.

10. SHARING INFORMATION

For legal reasons, we might need to share your data with the following; however, only the minimum information required will be shared:

1. HMRC
2. Our pension and healthcare schemes
3. Our payroll provider
4. Training providers
5. Internal and external auditors
6. Professional regulatory bodies such as the CQC
7. The police or other law enforcement agencies, if requested by law or court order
8. Relatives or guardians of an employee
   
   

11. SHARING CCTV RECORDINGS

When using or processing CCTV recordings, we will respect the legal rights of the individuals shown in them. We will not share images or recordings except in the following circumstances:

1. If requested by the local authority, police or courts for the investigation, prevention or prosecution of anti-social behaviour or criminal activity
2. For bringing or defending a legal claim
3. To comply with a police warrant or an order given by a court or tribunal
   
   

12. HOW TO COMPLAIN

If you have any comments, suggestions, or complaints about how we use your data, you can contact us using the contact details at the top of this privacy notice.

If you remain unhappy with our response or feel unable to discuss it with the Practice, you can contact the Information Commissioner’s Office (ICO) on 0303 123 1113 or by visiting

https://www.ico.org.uk/make-a-complaint.

13. REVIEW AND REVISION

This privacy notice is reviewed annually and updated to ensure its effectiveness and compliance with current regulations, guidance, and standards. It’s also important that the personal information we hold about you is accurate and up to date. Please let us know if your information changes during your working relationship with us.

1. INTRODUCTION

This privacy notice provides you with details of how we collect and process your personal data through your use of our site www.watercressdental.co.uk

By providing us with your data, you warrant to us that you are over 13 years of age.
Watercress Dental House LTD are the data controller and we are responsible for your personal data (referred to as “we”, “us” or “our” in this privacy notice).

Contact Details

Our full details are:

Full name of legal entity: Watercress Dental House Ltd

Email address: info@watercressdental.co.uk

Postal address: Watercress House, 1 St Mary’s Close, Alton, GU34 1EF

[Telephone number:] 01420 544408

It is very important that the information we hold about you is accurate and up to date. Please let us know if at any time your personal information changes by emailing us at info@watercressdental.co.uk.

2. WHAT DATA DO WE COLLECT ABOUT YOU, FOR WHAT PURPOSE AND ON WHAT GROUND WE PROCESS IT
Personal data means any information capable of identifying an individual. It does not include anonymised data.

We may process the following categories of personal data about you:

• Communication Data that includes any communication that you send to us whether that be through the contact form on our website, through email, text, social media messaging, social media posting or any other communication that you send us. We process this data for the purposes of communicating with you, for record keeping and for the establishment, pursuance or defence of legal claims. Our lawful ground for this processing is our legitimate interests which in this case are to reply to communications sent to us, to keep records and to establish, pursue or defend legal claims.
• Customer Data that includes data relating to any purchases of goods and/or services such as your name, title, billing address, delivery address email address, phone number, contact details, purchase details and your card details. We process this data to supply the goods and/or services you have purchased and to keep records of such transactions. Our lawful ground for this processing is the performance of a contract between you and us and/or taking steps at your request to enter into such a contract.
• User Data that includes data about how you use our website and any online services together with any data that you post for publication on our website or through other online services. We process this data to operate our website and ensure relevant content is provided to you, to ensure the security of our website, to maintain back- ups of our website and/or databases and to enable publication and administration of our website, other online services and business. Our lawful ground for this processing is our legitimate interests which in this case are to enable us to properly administer our website and our business.
• Technical Data that includes data about your use of our website and online services such as your IP address, your login data, details about your browser, length of visit to pages on our website, page views and navigation paths, details about the number of times you use our website, time zone settings and other technology on the devices you use to access our website. The source of this data is from our analytics tracking system. We process this data to analyse your use of our website and other online services, to administer and protect our business and website, to deliver relevant website content and advertisements to you and to understand the effectiveness of our advertising.  Our lawful ground for this processing is our legitimate interests which in this case are to enable us to properly administer our website and our business and to grow our business and to decide our marketing strategy.
• Marketing Data that includes data about your preferences in receiving marketing from us and our third parties and your communication preferences. We process this data to enable you to partake in our promotions such as competitions, prize draws and free give-aways, to deliver relevant website content and advertisements to you and measure or understand the effectiveness of this advertising.  Our lawful ground for this processing is our legitimate interests which in this case are to study how customers use our products/services, to develop them, to grow our business and to decide our marketing strategy.
• We may use Customer Data, User Data, Technical Data and Marketing Data to deliver relevant website content and advertisements to you (including Facebook adverts or other display advertisements) and to measure or understand the effectiveness of the advertising we serve you. Our lawful ground for this processing is legitimate interests which is to grow our business. We may also use such data to send other marketing communications to you. Our lawful ground for this processing is either consent or legitimate interests (namely to grow our business). [NOTE SEE SECTION 4 BELOW]

Sensitive Data

We need to collect the following sensitive data about you in order to deliver appropriate dental services according to your personal medical needs:

Medical history

Where we are required to collect personal data by law, or under the terms of the contract between us and you do not provide us with that data when requested, we may not be able to perform the contract (for example, to deliver goods or services to you). If you don’t provide us with the requested data, we may have to cancel a product or service you have booked but if we do, we will notify you at the time.

We will only use your personal data for a purpose it was collected for or a reasonably compatible purpose if necessary. For more information on this please email us at info@watercressdental.co.uk. In case we need to use your details for an unrelated new purpose we will let you know and explain the legal grounds for processing.

We may process your personal data without your knowledge or consent where this is required or permitted by law.

We do not carry out automated decision making or any type of automated profiling.

3. HOW WE COLLECT YOUR PERSONAL DATA

We may collect data about you by you providing the data directly to us (for example by filling in forms on our site or by sending us emails). We may automatically collect certain data from you as you use our website by using cookies and similar technologies. Please see our cookie policy for more details about this www.watercressdental.co.uk/cookiepolicy

We may receive data from third parties such as analytics providers such as Google based outside the EU, advertising networks such as Facebook based outside the EU, such as search information providers such as Google based outside the EU, providers of technical, payment and delivery services, such as data brokers or aggregators.

4. MARKETING COMMUNICATIONS

Our lawful ground of processing your personal data to send you marketing communications is either your consent or our legitimate interests (namely to grow our business).

[Under the Privacy and Electronic Communications Regulations, we may send you marketing communications from us if (i) you made a purchase or asked for information from us about our goods or services or (ii) you agreed to receive marketing communications and in each case you have not opted out of receiving such communications since. Under these regulations, if you are a limited company, we may send you marketing emails without your consent. However you can still opt out of receiving marketing emails from us at any time.]

We do not share your personal data with any third party for their own marketing purposes.

You can ask us to stop sending you marketing messages at any time by following the opt-out links on any marketing message sent to you or OR by emailing us at info@watercressdental.co.uk at any time.

If you opt out of receiving marketing communications this opt-out does not apply to personal data provided as a result of other transactions, such as purchases, warranty registrations etc.

5. DISCLOSURES OF YOUR PERSONAL DATA

We may have to share your personal data with the parties set out below:

• Service providers who provide IT and system administration services.
• Professional advisers including lawyers, bankers, auditors and insurers
• Government bodies that require us to report processing activities.
• Third parties to whom we sell, transfer, or merge parts of our business or our assets.

We require all third parties to whom we transfer your data to respect the security of your personal data and to treat it in accordance with the law. We only allow such third parties to process your personal data for specified purposes and in accordance with our instructions.

6. INTERNATIONAL TRANSFERS

We are subject to the provisions of the General Data Protection Regulations that protect your personal data. Where we transfer your data to third parties outside of the EEA, we will ensure that certain safeguards are in place to ensure a similar degree of security for your personal data. As such:

• We may transfer your personal data to countries that the European Commission have approved as providing an adequate level of protection for personal data by; or
• If we use US-based providers that are part of EU-US Privacy Shield, we may transfer data to them, as they have equivalent safeguards in place; or
• Where we use certain service providers who are established outside of the EEA, we may use specific contracts or codes of conduct or certification mechanisms approved by the European Commission which give personal data the same protection it has in Europe.

If none of the above safeguards is available, we may request your explicit consent to the specific transfer. You will have the right to withdraw this consent at any time.

7. DATA SECURITY

We have put in place security measures to prevent your personal data from being accidentally lost, used, altered, disclosed, or accessed without authorisation. We also allow access to your personal data only to those employees and partners who have a business need to know such data. They will only process your personal data on our instructions and they must keep it confidential.

We have procedures in place to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach if we are legally required to.

 8. DATA RETENTION

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

When deciding what the correct time is to keep the data for we look at its amount, nature and sensitivity, potential risk of harm from unauthorised use or disclosure, the processing purposes, if these can be achieved by other means and legal requirements.

For tax purposes the law requires us to keep basic information about our customers (including Contact, Identity, Financial and Transaction Data) for six years after they stop being customers.

In some circumstances we may anonymise your personal data for research or statistical purposes in which case we may use this information indefinitely without further notice to you.

9. YOUR LEGAL RIGHTS

Under data protection laws you have rights in relation to your personal data that include the right to request access, correction, erasure, restriction, transfer, to object to processing, to portability of data and (where the lawful ground of processing is consent) to withdraw consent.

You can see more about these rights at:
https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/
If you wish to exercise any of the rights set out above, please email us at info@watercressdental.co.uk.
You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive or refuse to comply with your request in these circumstances.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you.

If you are not happy with any aspect of how we collect and use your data, you have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). We should be grateful if you would contact us first if you do have a complaint so that we can try to resolve it for you.

 10. THIRD-PARTY LINKS

This website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy notice of every website you visit.

11. COOKIES

You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of this website may become inaccessible or not function properly. For more information about the cookies we use, please see watercressdental.co.uk/cookie-policy