Patient Privacy Notice

Last updated: 27 October 2026

This notice explains how Pennington Dental Care Ltd collects, uses, shares and protects personal information about our patients, the people who contact us or use our website, and visitors to our practices in Kenilworth and Stratford-upon-Avon. It also explains your rights. It is written to meet the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are and how to contact us

Pennington Dental Care Ltd (Company No. 07079845), trading as Pennington Dental, is the controller of your personal information. This means we decide how and why it is used.

• Kenilworth: 37 High Street, Kenilworth, CV8 1LY. Telephone 01926 863236.
• Stratford-upon-Avon: Suite A, Elta House, Birmingham Road, Stratford-upon-Avon, CV37 0AQ. Telephone 01789 205254.

We are registered with the Information Commissioner's Office (ICO). Our registration number is Z2738426.

Our data protection lead is Dr Fuz Jamall, Practice Owner. For any question about your information, or to use any of your rights, email kenilworth@penningtondental.co.uk, call either practice, or write to us at our Kenilworth address marked "Data Protection".

2. The information we hold

If you are a patient

• Your name, date of birth, address, telephone number and email address.
• Your medical history, medicines and dental history.
• Clinical notes, treatment plans, consent forms, referral letters and other correspondence about your care.
• X-rays, scans (including iTero 3D scans of your teeth) and clinical photographs.
• If you have NHS treatment: the details the NHS needs to process your treatment claim, such as whether you pay NHS charges or are exempt.
• Your appointments, the treatment you have had, what you have paid and any money owed.
• If you join our membership plan: your plan, its start date and your payment history. Your Direct Debit is collected by GoCardless. If someone else pays for your plan, we also hold their name, contact details and payment information.
• If you add the optional Accident & Emergency Dental Cover to your plan: the details needed to set up the cover.
• Any feedback or complaints you give us.

Information about your health is "special category" data. The law gives it extra protection, and we only use it as this notice describes.

If you contact us, book online or use our website

• The details you enter in our website forms (for example to book an appointment or a free consultation, make an enquiry, or ask for emergency help). These can include your name, email address, phone number, the treatment you are interested in, your preferred practice, whether you are a new or existing patient, how you would like us to contact you, a description of your symptoms or pain, and your message.
• The details you give if you use the chat window on our website, such as your name, contact details, the treatment you are interested in and your messages.
• If a dentist refers you to us through our dentist referrals page: the details they send, including your name, date of birth, contact details and the reason for the referral.
• Information about how you use our website, collected by cookies and similar technologies (see section 10).

If you visit our practices or phone us

• CCTV images (see section 9).
• Notes of telephone calls, for example to book or change an appointment.
• Recordings of telephone calls. We record calls to our practices for staff training and to help resolve disputes and complaints.

3. Where we get your information from

Most of the information we hold comes directly from you: when you register, fill in your medical history, attend appointments, contact us, or use our website. We may also receive information about you from:

• a parent or guardian, if you are a child;
• another dentist or health professional who refers you to us or is involved in your care;
• the NHS Business Services Authority (NHS BSA), for example when it checks an NHS claim or exemption;
• GoCardless, about the status of your Direct Debit payments;
• our CCTV system and our website (see sections 9 and 10).

4. How we use your information and our lawful basis

We must have a lawful basis under the UK GDPR for each use of your information. For your health information, we must also meet an extra condition.

• To provide your dental care, including examinations, treatment, referrals, laboratory work, and contacting you about your appointments and care. For private treatment, this is necessary to carry out our agreement with you (Article 6(1)(b)). For NHS treatment, it is necessary to provide NHS services under our NHS contract, a task in the public interest (Article 6(1)(e)). Your health information is used to provide health care (Article 9(2)(h) and the Data Protection Act 2018, Schedule 1, paragraph 2).
• To keep accurate clinical and financial records and meet our legal and regulatory duties, including NHS claims and record-keeping rules: this is necessary to comply with the law (Article 6(1)(c)), together with Article 9(2)(h).
• To take payment, run our membership plan and manage your account: this is necessary to carry out our agreement with you (Article 6(1)(b)).
• To answer your enquiries and handle bookings made through our website, by phone or by email: this is necessary to take the steps you ask for before becoming a patient (Article 6(1)(b)). Any health details you give us are used to provide health care (Article 9(2)(h)).
• To handle complaints and legal claims, and to share information with our insurers, indemnity providers and legal advisers where needed: this is necessary to comply with the law (Article 6(1)(c)) and for our legitimate interests in responding properly (Article 6(1)(f)). For health information, Article 9(2)(f) (legal claims) applies.
• To check and improve the quality of our care, for example clinical audits and patient feedback: this is in our legitimate interests (Article 6(1)(f)), together with Article 9(2)(h) for health information.
• To keep patients, staff and our premises safe and secure, including CCTV: this is in our legitimate interests (Article 6(1)(f)).
• To record telephone calls for staff training and to help resolve disputes and complaints: this is in our legitimate interests in training our team and in checking what was said if there is a disagreement (Article 6(1)(f)). If a call includes health information, Article 9(2)(h) applies, and Article 9(2)(f) applies if a recording is needed for a legal claim.
• To use analytics, advertising and other non-essential cookies on our website: only with your consent (Article 6(1)(a)).
• To send you marketing, such as news and offers about our treatments: only with your consent (Article 6(1)(a)).

Marketing

We will only send you marketing messages if you have agreed to receive them. You can change your mind at any time by using the unsubscribe link in an email, or by contacting us. Messages about your appointments, treatment, plan or payments are not marketing, and we will still send these.

5. NHS care

We are an NHS and private dental practice. Children can be seen on the NHS until they are 18. When you have NHS treatment, we must send details of your course of treatment (a claim form called an FP17) to the NHS Business Services Authority, which pays NHS dental claims on behalf of NHS England. The NHS BSA may contact you to ask about your treatment or to check an exemption from NHS charges. NHS England may also see your information when it manages our NHS contract or handles an NHS complaint.

6. Who we share your information with

We do not sell your information. We share it only when we need to, with:

• the NHS Business Services Authority and NHS England, for NHS treatment (see section 5);
• dentists, specialists, hospitals and other health professionals we refer you to, or who are involved in your care;
• dental laboratories, which receive only what they need to make your crowns, dentures, aligners or other appliances;
• our membership plan software provider, which holds your plan sign-up and membership records on our behalf and only on our instructions;
• GoCardless, which collects membership plan Direct Debits. GoCardless processes your bank details and payment history under its own terms and privacy notice;
• if you add the optional Accident & Emergency Dental Cover: Lloyd & Whyte Ltd, which administers the cover, and Hamilton Insurance DAC, the insurer, together with the partners named in the policy wording. They use your information to provide the cover and handle claims, under their own privacy notices;
• companies that provide our practice management software, IT, website, email and telephone systems. They act on our instructions under a contract and may not use your information for their own purposes;
• our insurers, indemnity providers and legal advisers, if there is a complaint or claim;
• a parent or guardian of a child patient, or someone you have asked us to deal with on your behalf;
• regulators such as the Care Quality Commission (CQC) and the General Dental Council (GDC), and the police, courts or safeguarding authorities, where the law requires or allows it.

7. Sending information outside the UK

Your patient records are held in the UK.

Some of the website tools described in section 10 are provided by companies based in the United States, including Google, Microsoft and Webflow, so the information they collect through our website may be processed outside the UK. UK law only allows this where the information is protected by an approved safeguard, such as UK adequacy regulations (including the UK extension to the EU–US Data Privacy Framework, known as the UK–US "data bridge", for US companies certified under it) or the ICO's International Data Transfer Agreement or Addendum.

8. How long we keep your information

We keep your information only for as long as we need it, and for at least the minimum periods below. We then delete or destroy it securely.

• Dental records, including x-rays, scans, photographs and NHS claim forms: at least 11 years after your care with us ends, as the NHS Records Management Code of Practice requires for all dental care settings.
• Children's dental records: at least 11 years after care ends, or until the patient's 25th birthday (26th if they were 17 when their treatment ended), whichever is longer.
• NHS finance-related dental records, such as patient declaration forms: at least 2 years, as the NHS Records Management Code of Practice requires.
• Payment, invoice and membership plan records: 6 years from the end of the financial year they relate to, as HMRC requires.
• CCTV footage: 30 days, after which it is automatically overwritten or deleted, unless we need it longer to investigate an incident or because the police ask for it.
• Recordings of telephone calls: 30 days, after which they are deleted, unless we need a recording longer to deal with a complaint, dispute or legal claim.
• Enquiries from people who do not become patients, including website, chat and telephone enquiries: enquiries are recorded in our practice management system, and are kept in line with our dental records retention periods above.

Lloyd & Whyte Ltd, Hamilton Insurance DAC and GoCardless keep the information they hold for the periods set out in their own privacy notices.

9. CCTV

We use CCTV at both our Kenilworth and Stratford-upon-Avon practices to protect the safety and security of our patients, staff and premises. Our lawful basis is our legitimate interests in keeping people and property safe (UK GDPR Article 6(1)(f)).

• CCTV signs are displayed at both practices.
• Footage can only be viewed by our Practice Manager, Sarah Cross. We will disclose it to the police or other authorities only where the law requires or allows it, for example to help prevent or investigate a crime.
• Footage is kept for 30 days and then automatically overwritten or deleted, unless we need it to investigate an incident.
• You have the right to ask for a copy of footage in which you appear. Please tell us the date, time and place so we can find it. We may need to blur or remove other people to protect their privacy.

10. Our website, forms and cookies

Our website is hosted by Webflow, and the forms on it send your details to us through Webflow. Google reCAPTCHA checks that our forms are being filled in by a person and not a computer program. The forms on our dentist referrals page are provided by our website developer, Xcelerator Dental, and by ActiveCampaign. The chat window and some enquiry forms on our website are provided by EnquiryBox (EnquiryBot).

Cookies are small files that a website stores on your device. Our website uses the following cookies and similar technologies:

• Strictly necessary: a cookie called pd_consent that remembers your cookie choices, and cookies needed for the website and its forms to work and to stay secure (including Google reCAPTCHA). These do not need your consent.
• Analytics: Google Analytics, which tells us how many people visit our website and which pages they use, and Microsoft Clarity, which records how visitors use our pages (for example clicks, scrolling and mouse movements) as session recordings and heatmaps, so that we can improve the website.
• Advertising: Google Ads, which measures whether our online adverts lead to bookings and may be used to show our adverts to people who have visited our website. A first-party cookie also records whether you arrived on our website from one of our adverts.
• Google Tag Manager, which we use to load the analytics and advertising tools above. It is only loaded after you agree to analytics or advertising cookies.
• Chat, reviews and content from other websites: the EnquiryBot chat window, YouTube videos, Google Maps, Matterport virtual tours of our practices, Google reviews shown through Elfsight, and the Reviewability review pop-up. These providers may set their own cookies or collect your IP address when the content loads. Our website also loads fonts and code libraries from Google and other content delivery networks, which receive your IP address.

When you first visit our website, a cookie banner lets you choose "Accept all", "Reject all" or "Manage choices". Only strictly necessary cookies are used until you make a choice, and we do not use analytics, advertising or other non-essential cookies unless you agree. You can change your mind at any time by clicking "Cookie settings" at the bottom of any page. You can also block or delete cookies in your browser settings. For more detail, see our cookie policy. Our website links to our pages on Facebook, Instagram, LinkedIn and X. Those websites have their own privacy notices.

11. Your rights

You have the right to:

• be told how we use your information (this notice);
• get a copy of the information we hold about you (a subject access request);
• ask us to correct information that is wrong or incomplete;
• ask us to delete your information. We usually cannot delete dental records before the end of the minimum retention period in section 8, because the law and NHS rules require us to keep them. Enquiries recorded in our practice management system are kept for the same periods, so we may not be able to delete them before those periods end;
• ask us to restrict how we use your information, for example while we check that it is correct;
• object to us using your information on the basis of our legitimate interests (for example call recording or CCTV), and object at any time to marketing;
• ask for information you gave us to be sent to you or another organisation in a commonly used electronic format, where we use it on the basis of your consent or our agreement with you;
• withdraw your consent at any time, where we rely on it. This does not affect anything we did before you withdrew it.

We do not make decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects on you.

To use any of these rights, contact us using the details in section 1. We may need to check your identity. We will reply within one month, and there is usually no charge. If your request is complex, we may extend this by up to two more months and will tell you why.

A parent or guardian can usually make a request on behalf of a child. If a child is mature enough to understand their rights, we may ask for their agreement first.

12. The national data opt-out

Your health information may be used for your individual care, and in some cases for research and planning. If you do not want your confidential patient information to be used for research and planning, you can register a national data opt-out at nhs.uk/your-nhs-data-matters or by calling 0300 303 5678. If we ever use or share your confidential patient information for purposes beyond your individual care, we will check and apply any national data opt-out you have registered. Your choice does not affect your care.

13. Keeping your information secure

We keep your information secure. Only staff who need it for their work can see it. All our clinical staff have a professional duty of confidentiality, and the companies that process information for us must keep it secure under their contracts with us.

14. Complaints

If you are unhappy with how we have used your information, please contact our data protection lead first using the details in section 1, so that we can try to put things right.

You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk, telephone 0303 123 1113.

15. Changes to this notice

We review this notice regularly and will update it if the way we use your information changes. The date at the top shows when it was last updated. This notice replaces our previous website privacy policy.