Website & Patient Privacy Notice

Website & Patient Privacy Notice

Last updated: May 2026

We take the privacy and security of your personal data extremely seriously. This Privacy Notice explains how Chess House Dental Practice collects, uses, stores, and protects your personal information when you use our website or receive dental care at our practice. Please read this notice carefully — it contains important information about your rights and how to contact us.

This notice covers both our website privacy practices and the handling of patient data in connection with the dental services we provide.

‍

‍

Who We Are

Chess House Dental Practice is the Data Controller responsible for your personal data.
‍
‍Practice name: Chess House Dental Practice

Address: 105 High Street, Chesham, Buckinghamshire, HP5 1DE
‍
‍Telephone: 01494 977 140
‍
‍Email: info@chesshousedental.com
‍
‍Website: www.chesshousedental.com

‍

Our practice is registered with the Information Commissioner's Office (ICO) as a Data Controller. Our practice is also registered with the Care Quality Commission (CQC); details of our registration can be found at www.cqc.org.uk.

‍

‍

The Personal Data We Collect

‍

Website enquiries and contact forms

When you contact us through our website, we may collect the following:
‍

• Your name
• Email address
• Telephone number
• The content of your message or enquiry

‍

Patient records

When you register with or receive treatment from our practice, we collect and process a wider range of information necessary to provide safe, effective dental care. This may include:
‍

• Full name, date of birth, and contact details (address, telephone number, email address)
• Medical and dental history, including current medications, allergies, and pre-existing conditions
• Dental examination findings, treatment records, and clinical notes
• Radiographic images (X-rays) and other clinical images
• NHS or private treatment records and associated charges
• Referral correspondence with specialists or other healthcare providers
• Details of your next of kin or emergency contact
• Financial information relevant to billing and payment plans (not including full card or bank details, which are handled directly by our payment processor)

‍

How We Collect Your Data

We collect personal data in the following ways:
‍

• Directly from you when you complete a contact or enquiry form on our website
• Directly from you when you register as a patient, complete medical history forms, or attend appointments
• From other healthcare professionals, such as GPs or specialist clinicians, when they refer you to us or share relevant medical information
• Automatically through your use of our website, via cookies and similar tracking technologies (see the Cookies section below)

‍

How We Use Your Personal Data

We use your personal data for the following purposes:
‍

• To respond to your enquiries and provide information about our services
• To register you as a patient and manage your dental care
• To carry out dental examinations, create treatment plans, and provide clinical treatment
• To maintain accurate and up-to-date patient records as required by law and professional standards
• To communicate appointment reminders, recalls, and relevant clinical information
• To process payments for treatment
• To make referrals to specialists or other healthcare providers where clinically necessary
• To comply with our legal, regulatory, and professional obligations, including those set by the General Dental Council (GDC), CQC, and NHS where applicable
• To improve our website and the quality of our services
• To send you marketing communications about our services and promotions, where you have consented to receive these

‍

Our Legal Basis for Processing Your Data

Under the UK General Data Protection Regulation (UK GDPR), we are required to have a lawful basis for processing your personal data. The bases we rely on are as follows:

‍

Contract: Processing your data is necessary to fulfil our contract with you to provide dental services.

Legal obligation: We are required to process certain data to comply with our legal duties, including those under CQC regulations, NHS requirements, and professional obligations set by the GDC.

Legitimate interests: We process some data where it is in our legitimate interests to do so, such as improving our services, responding to enquiries, and managing the business of the practice, provided this does not override your rights.

Consent: Where we rely on your consent, for example, to send you marketing communications, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

‍

Special Category Data (Health Information)

Your dental and medical records constitute special category data under Article 9 of the UK GDPR. We process this information under Article 9(2)(h), which permits processing for the purposes of preventive or occupational medicine, the provision of health or social care, and the management of health or social care systems. This processing is carried out under the supervision of a registered healthcare professional bound by professional obligations of confidentiality.

‍

Who We Share Your Data With

We will never sell your personal data. We share it only in limited and necessary circumstances, as described below:

‍

Clinical referrals: We may share relevant clinical information with specialist dentists, oral surgeons, orthodontists, and other healthcare professionals when necessary for your care.

NHS and regulatory bodies: We share data with the NHS Business Services Authority and CQC where required for NHS treatment processing, inspection, and compliance.

GDC and professional bodies: Where required for regulatory or complaints purposes, we may share data with the General Dental Council or relevant professional indemnity bodies.

Technology and data processors: We use the following third-party services to operate our website and manage data, all of whom are contractually bound to process your data only on our instructions and in compliance with applicable data protection law:
‍

• Webflow Inc — website hosting and content management platform
• Formspark — GDPR-compliant form data processing and storage, used to receive and store website enquiries
• Cloudflare — website security and spam protection (including Turnstile, a privacy-preserving CAPTCHA alternative)
• Google Analytics — anonymised website usage analytics (you may opt out via the Google Analytics Opt-out Browser Add-on)

‍

Legal and safeguarding obligations: We may disclose personal data to law enforcement authorities, regulatory bodies, or safeguarding agencies where we are required to do so by law, or where we have a duty to act to protect the safety of a patient or member of the public.

‍

How Long We Keep Your Data

We retain personal data only for as long as is necessary for the purpose for which it was collected, and in accordance with applicable legal and professional guidance. Our retention periods are as follows:

‍

Adult dental records: A minimum of 11 years from the date of the last entry, in accordance with NHS and GDC guidance.

Children's dental records: Until the patient's 25th birthday, or 11 years from the date of last treatment if that is later, in line with NHS guidance.

Radiographic images (X-rays): Retained for the same period as the associated dental records.

Website enquiry data: Retained for no longer than is necessary to respond to the enquiry and for a reasonable period thereafter for audit and compliance purposes.

Financial records: Six years from the end of the relevant financial year, in accordance with HMRC requirements.

‍

After the applicable retention period, data is securely deleted or anonymised.

‍

Cookies and Similar Technologies

Our website uses cookies — small text files placed on your device when you visit — to enable core functionality, understand how visitors use our site, and support security features.

‍

Strictly necessary cookies: Required for the website to function. These cannot be disabled.

Analytics cookies: We use Google Analytics to collect anonymised information about how visitors use our website, including pages visited, time spent on the site, and traffic sources. This helps us improve our content and user experience. No personally identifiable information is collected by Google Analytics.

Security cookies: Cloudflare Turnstile may set a cookie to distinguish human visitors from automated bots, protecting our contact forms from spam. This service is designed to be privacy-preserving and does not track users across websites.

‍

You can control cookies through your browser settings. Disabling certain cookies may affect the functionality of our website. For more information on managing cookies, visit www.aboutcookies.org or www.allaboutcookies.org.

‍

Marketing Communications

From time to time, we may contact you with information about our services, promotions, and dental health tips that may be of interest to you. We will only do this where we have your explicit consent or where we have a legitimate interest in doing so.

You can unsubscribe from marketing communications at any time by contacting us using the details at the top of this notice, by using the unsubscribe link in any email we send you, or by replying STOP to any text message.

‍

Your Rights

Under the UK GDPR, you have the following rights in relation to your personal data. We are committed to upholding these rights and will respond to any request within one calendar month (which may be extended by up to a further two months in complex cases).

‍

Right to be informed: You have the right to receive clear and transparent information about how we use your data. This Privacy Notice fulfils that obligation.

Right of access: You have the right to request a copy of the personal data we hold about you (a Subject Access Request or SAR). This is provided free of charge.

Right to rectification: You have the right to ask us to correct inaccurate or incomplete data we hold about you.

Right to erasure: In certain circumstances, you have the right to ask us to delete your personal data. Please note that we may not always be able to comply with this request where we have a legal obligation to retain the data — for example, in relation to clinical records.

Right to restrict processing: You have the right to ask us to restrict the processing of your data in certain circumstances, for example while the accuracy of the data is being contested.

Right to data portability: Where processing is based on your consent or a contract and is carried out by automated means, you have the right to receive your data in a structured, commonly used, machine-readable format.

Right to object: You have the right to object to processing carried out on the basis of our legitimate interests or for direct marketing purposes.

Rights relating to automated decision-making: You have the right not to be subject to decisions made solely by automated means that produce significant effects concerning you. We do not carry out such processing.

‍

To exercise any of these rights, please contact us using the details provided at the top of this notice. We may need to verify your identity before processing your request.

‍

How to Make a Complaint

If you are not satisfied with how we have handled your personal data, you have the right to make a complaint to the Information Commissioner's Office (ICO), the UK's independent supervisory authority for data protection matters.

‍

ICO website: www.ico.org.uk

ICO helpline: 0303 123 1113

‍

We would, however, appreciate the opportunity to address your concern directly before you contact the ICO. Please contact us in the first instance using the details at the top of this notice.

‍

Data Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, disclosure, or destruction. These measures include secure website hosting through Webflow, encrypted data transmission (HTTPS), spam and bot protection via Cloudflare, and restricted access to patient records within the practice.

While we take every reasonable precaution, no method of electronic transmission or storage is entirely secure, and we cannot guarantee absolute security. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and will inform affected individuals where required.

‍

Third-Party Links

Our website may contain links to third-party websites. This Privacy Notice applies only to our website and practice. We have no control over third-party websites and are not responsible for their privacy practices. We encourage you to read the privacy notices of any websites you visit via links on our site.

‍

Changes to This Privacy Notice

We may update this Privacy Notice from time to time to reflect changes in our practices, legal requirements, or the services we offer. The date at the top of this document indicates when it was last revised. Where changes are significant, we will notify patients directly or prominently on our website.

‍

Contact Us

If you have any questions about this Privacy Notice or how we handle your personal data, please contact us:

‍

Post: Chess House Dental Practice, 105 High Street, Chesham, Buckinghamshire, HP5 1DE

Telephone: 01494 977 140

Email: info@chesshousedental.com

‍

If you require this notice in an alternative format (such as large print or audio), please contact us using the details above.

‍