Reception area at Heslington Dental Practice in Heslington village, York
Heslington Dental Practice reception, York

GDPR Policy

GDPR Policy

Last updated: April 2026

Introduction

Heslington Dental Practice is committed to protecting the personal data of our patients, staff and website visitors. This policy sets out how we comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

As a healthcare provider, we handle a significant amount of special category data — specifically health data — and we take our data protection responsibilities extremely seriously.

Data Controller

Heslington Dental Practice is the data controller for all personal data processed in connection with our dental services and this website.

Contact details:
11/12 Main Street, Heslington, York, YO10 5EA
info@heslingtondental.co.uk
01904 904 500

Key Principles

We process personal data in accordance with the six key principles of UK GDPR:

  1. Lawfulness, fairness and transparency — we only process data on a valid legal basis and are open about how we use it
  2. Purpose limitation — we only collect data for specified, explicit and legitimate purposes and do not process it in ways incompatible with those purposes
  3. Data minimisation — we only collect what is necessary for the purpose for which it is processed
  4. Accuracy — we take reasonable steps to ensure personal data is accurate and kept up to date
  5. Storage limitation — we retain personal data only for as long as necessary, in accordance with our retention schedules
  6. Integrity and confidentiality — we process personal data securely using appropriate technical and organisational measures to protect against unauthorised access, loss or destruction

Special Category Data

As a dental practice, we routinely handle special category health data. This includes medical histories, clinical records, dental X-rays and treatment notes. We process this data under Article 9(2)(h) of UK GDPR, which permits processing where it is necessary for the purposes of preventive or occupational medicine, medical diagnosis, the provision of health or social care, or the management of health or social care systems.

All clinical staff accessing patient health data are bound by professional duties of confidentiality under their GDC registration.

Data Security Measures

We implement appropriate technical and organisational security measures including:

  • Secure, password-protected practice management software with role-based access controls
  • Encrypted storage of electronic patient records
  • Secure disposal of physical records containing personal data
  • Staff training on data protection obligations and information security
  • Regular review of data protection practices and access permissions
  • Secure website hosting with SSL encryption

Data Breach Procedures

In the event of a personal data breach, we will:

  • Contain the breach and assess the risk to individuals as quickly as possible
  • Report notifiable breaches to the Information Commissioner’s Office (ICO) within 72 hours of becoming aware
  • Notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms
  • Keep a record of all breaches, whether or not they are notifiable

Third Party Processors

Where we use third party service providers who process personal data on our behalf, we ensure they are bound by appropriate Data Processing Agreements (DPAs) and provide sufficient guarantees of compliance with UK GDPR. We only share data with third parties where there is a lawful basis to do so.

Individual Rights

Individuals whose data we process have the following rights under UK GDPR:

  • Right of access (Subject Access Request)
  • Right to rectification
  • Right to erasure (right to be forgotten)
  • Right to restriction of processing
  • Right to data portability
  • Right to object
  • Rights relating to automated decision making and profiling

To make a request to exercise any of these rights, please contact us in writing at info@heslingtondental.co.uk or at our practice address. We will respond within one calendar month. There is no charge for making a request.

Staff and GDPR

All members of the Heslington Dental Practice team are trained on their data protection obligations. Access to patient data is restricted on a need-to-know basis. All staff are required to handle personal data in accordance with this policy and our internal data protection procedures.

Policy Review

This GDPR Policy is reviewed annually or whenever there is a significant change in our processing activities or in data protection legislation. The date of the most recent review is shown at the top of this page.

Complaints and Supervisory Authority

If you have a concern about how we handle your personal data, please contact us in the first instance at info@heslingtondental.co.uk. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK’s supervisory authority for data protection:

ico.org.uk
Telephone: 0303 123 1113