Data Protection Patient Privacy Notice
(External-facing / For Patients and Website Disclosure)
|
Date of policy review: |
June 2026 |
|
Date of next planned review: |
June 2027 |
|
Signed: |
Nigel Magee and Alice Young |
About us
We are Magee Dental Care, operating at 18–24 William Street, Lurgan, County Armagh, BT66 6JA.
- Data Controller: Nigel Magee (Practice Owner) is legally responsible for keeping the information that we hold about you secure.
- Joint Controllers (Associate Dentists): Self-employed associate dentists who treat you at the practice are joint controllers with the practice for the clinical records they make about your care. The practice is your single point of contact for all data protection matters, including requests to see your records, and handles these on behalf of both the practice and your dentist.
- Access to Information: Personnel at the practice who have access to your information include dentists and other dental professionals involved with your care and treatment, alongside reception staff, administrative staff, and managers responsible for the administration of the practice.
- Data Protection Officer (DPO): Dr Alice Young BDS ensures that the practice complies with data protection requirements to ensure we collect, use, store, and dispose of your information responsibly. You can contact our DPO by email at info@mageedentalcare.co.uk or by phone on 028 38 322441.
Lawful Basis for Processing Your Data
We can only keep and use information for specific reasons set out in the law. Under the UK GDPR, our lawful bases for processing your personal data are:
- Contractual Necessity (Article 6(1)(b)): For private treatment and practice plans, to fulfil our contract with you to provide appointments, manage dental treatments, issue estimates, and process fees (including managing dental plan memberships or facilitating financing if requested).
- Public Task (Article 6(1)(e)): To provide Health Service (NHS) dental care as part of the public health service we deliver, including related appointment reminders and recalls for Health Service patients.
- Legitimate Interests (Article 6(1)(f)): For private patients, to send appointment reminders, routine recall notices, provide educational treatment leaflets, monitor clinical quality, and administer our business safely.
- Legal Obligation (Article 6(1)(c)): To comply with statutory regulations, such as submitting health service claims, financial accounting to HMRC, or mandatory reporting of workplace accidents, safeguarding concerns, and clinical incidents.
- Vital Interests (Article 6(1)(d)): To protect your life or health in an emergency situation.
Special Category Data (Health Records): Because your dental and medical histories are sensitive health data, we process this under Article 9(2)(h) of the UK GDPR (the provision of health or social care or treatment) and the Data Protection Act 2018.
Information That We Hold
-
- Contact Details & Administrative Data
We hold personal information including your name, date of birth, Health and Care (H&C) Number, address, telephone and mobile number, and email address. - Clinical & Dental Records
We hold information about your dental and general health, including:- Clinical notes made by dentists and dental professionals involved in your care.
- X-rays, clinical photographs, digital intraoral scans, and study models.
- Medical and dental histories, formal treatment plans, cost estimates, and signed consent forms.
- Copies of practice treatment leaflets provided to support your clinical understanding.
- Notes of conversations regarding your care options, and records of your appointments.
- Details of any complaints made and how they were resolved.
- Correspondence with you, your GP, or other health professionals/institutions.
- Financial Information
We hold information about the fees charged, payments made, and payment method details. This forms part of our contractual obligation and satisfies legal financial requirements. Where care is provided under the Health Service (NHS), we complete statutory forms to allow payments to be processed. - Reasonable Adjustment Information
We collect, hold, and share information on reasonable adjustments required by our patients under disability discrimination legislation to ensure we provide equal, accessible, and high-quality care. - Technical and Website Data
As we host this privacy notice online, when you visit our website (mageedentalcare.co.uk) or use digital communication channels, we may collect technical data. This includes your IP address, browser type, and information about how you interact with our site. This is processed under our legitimate interest to maintain a functional, optimized, and secure web presence. Please see our separate Website Cookie Policy for more detailed tracking specifics.
- Contact Details & Administrative Data
How We Use and Share Your Information
To provide safe, accurate dental treatment, we require up-to-date information. Your data is normally confidential to the practice, but we may share it on a strictly need-to-know basis with minimum disclosure to:
- Your General Practitioner (GP).
- Hospitals, community dental services, or specialist dental services to which you are being referred.
- The Business Services Organisation (BSO) and the Department of Health’s Strategic Planning and Performance Group (SPPG), for Health Service payments and claims.
- The Department for Work and Pensions (DWP) or their fraud prevention agencies, if they contact us to verify or audit a claim for exemption from Health Service charges.
- Dental laboratories fabricating your appliances.
- Debt collection agencies (in the event of unpaid fees).
- Private dental schemes or plan providers (e.g., Practice Plan Ltd) of which you are a member.
- Chrysalis Finance Limited, where you choose to apply for patient finance options to fund your dental treatment.
- External enforcement, safeguarding, and health agencies in the event of mandatory reporting or severe incidents, including the Police Service of Northern Ireland (PSNI), Health and Social Care (HSC) Safeguarding Teams, The Regulation and Quality Improvement Authority (RQIA), the Northern Ireland Adverse Incident Centre (NIAIC), and the Health and Safety Executive for Northern Ireland (HSENI).
- Regulatory or law enforcement bodies (e.g., HMRC or the GDC) if legally required.
We will only disclose your information on a need-to-know basis and will limit any information that we share to the minimum necessary. We will let you know in advance if we send your medical information to another medical provider and we will give you the details of that provider at that time.
Third-Party Dental Laboratories:
To manufacture custom-made dental appliances (such as dentures, crowns, bridges, and orthodontic retainers), we must share clinical records, prescriptions, and dental dimensions with third-party dental laboratories.
These laboratories process your information on our behalf, only to make your appliance, under a written agreement that requires them to keep it secure and confidential. Medical device law also requires laboratories to keep certain manufacturing records for a set period. Wherever practical, we protect your identity by using a unique practice ID number or your initials on laboratory instructions rather than your full name.
We collect and use this information to allow us to fulfil our contract with you to discuss your treatment options and provide dental care that meets your needs. We also use this information for the legitimate interest of ensuring the quality of the treatment we provide.
Patient Finance Options (Chrysalis Finance):
Where you wish to explore or apply for a patient finance plan, we will share your relevant contact and treatment details with our finance partner, Chrysalis Finance Limited, to facilitate your credit application. Please note that Nigel Magee (Practice Owner) is an Authorised Representative of Chrysalis Finance Limited for consumer credit activities. Chrysalis Finance Limited is a separate data controller for your credit application and will give you its own privacy notice. You can apply yourself using the Chrysalis Finance link on our website, which takes you to Chrysalis’s own secure online application, or we can complete the application with you using the secure portal Chrysalis provides to the practice. In that case, we will enter the details needed for your application, such as your contact, personal and treatment cost details, directly into the portal. Chrysalis will carry out its own credit and identity checks, and may tell us the outcome of your application so that we can arrange your treatment.
Private Dental Schemes (Practice Plan):
If you are a member of our practice private dental plan, we will share your administrative and financial details with Practice Plan Ltd to collect your monthly membership fees and administer your plan benefits. You can apply for the plan yourself, or we can complete the application with you using Practice Plan’s secure online portal. In that case, we will enter the details needed for your application, such as your name, address, contact details and date of birth, directly into the portal. Your bank details for the Direct Debit are held by Practice Plan, not by the practice. Practice Plan acts as a processor on our behalf when administering your plan, and its own patient privacy notice (available at practiceplan.co.uk) explains how it handles your information. If your plan includes dental accident and emergency insurance, your details will also be shared with the insurer that provides this cover.
Communication Preferences, Portal Security, and Marketing
- The Dentally Portal: To help keep your personal, medical and financial data secure, we use a secure digital portal powered by our clinical system, Dentally. All essential clinical and financial documentation—including pre-appointment medical history forms, treatment plans, cost estimates, consent documentation, and educational leaflets—will be issued to you via a secure Dentally Portal link sent by email or SMS text message. When accessing this link, your information is transmitted and stored securely using encryption.
- Standard Communications & Electronic Risks: Routine administrative communications—specifically limited to appointment reminders, missed appointment (failure to attend/was not brought) notifications, or requests for you to contact the practice—are sent via standard SMS text message or email outside of the portal link system. Please note that standard text messages and emails travel over open public networks and are not encrypted. By providing your email address and mobile number, you accept these inherent communication risks for basic administrative alerts. If you would prefer not to receive these by text or email, please let us know and we will contact you by telephone or letter instead.
- Patient Surveys: We may contact you for quality control purposes or feedback.
- Clinical Photography and Social Media: We may take clinical photographs, scans, or videos of your teeth and smile to monitor your treatment progress. We will never use these images for marketing, website galleries, or social media platforms unless you have given us your explicit, written consent on a dedicated media release form. You can withdraw this consent at any time.
- Marketing: We will only send you information regarding practice products or promotional treatments (e.g., tooth whitening, cosmetic dentistry) if you have given us your explicit, opt-in consent.
- Preference Changes & Opt-Outs: We will seek your preference for how we contact you about your dental care (telephone, email, or letter). If you wish to change your communication preferences or opt-out of text/email reminders, just let our reception team know in person, by telephone on 028 38 322441 or by email at info@mageedentalcare.co.uk
- Education/Research: If we wish to use your records for dental education or research, we will anonymise it where possible. If anonymisation is impossible, we will seek your explicit consent beforehand.
Keeping Your Information Safe & Retention Periods
We store your personal information securely on Dentally, our cloud-based dental software (equipped with secure audit trails and routine backups) and/or within locked manual filing systems.
- Cloud Storage: We use secure cloud computing facilities to store data. Our rigorous agreements ensure that all cloud providers keep your data secure and process it entirely within the requirements of UK data laws. Our clinical system, Dentally, stores data in the European Economic Area (EEA), on Amazon Web Services (AWS) servers. The UK recognises the EEA as providing an adequate level of data protection. Where any of your data is processed outside the UK, we make sure appropriate safeguards are in place as required by UK data protection law.
- Dentally: Your records, including clinical notes, X-rays, medical histories, treatment plans, appointments and payments, are held on Dentally. Dentally processes your information on the practice’s behalf under a written agreement, and is also used to send appointment reminders, recall notices and secure portal links.
- Previous Practice Software: Most of your older records and X-rays were transferred to Dentally when we changed systems. Some older records are still held securely on our previous practice software (R4), which is no longer used day to day. Access to it is restricted to the Practice Owner and Practice Manager, and these records are kept for the same retention periods as all other records.
- Retention Period: In strict accordance with the Department of Health (Northern Ireland) “Good Management, Good Records” guidelines and the Regulation and Quality Improvement Authority (RQIA), we retain health records for the periods set out in its Disposal Schedule:
- Adult Records: Retained for 11 years after the date of your last visit to the practice.
- Children’s Records: Retained until the patient’s 25th birthday, or 11 years after the last visit (whichever is longer).
- Financial Records: Payment, plan membership and finance application records are kept for 6 years to meet tax and accounting requirements.
- Data Erasure Requests: At your explicit request, we will delete non-essential information (such as non-clinical contact details, marketing preferences, or website analytics data) before the end of this period.
Your Rights Under UK GDPR
You have the following rights regarding your data, which you can exercise by contacting us in person, by telephone or in writing, or by emailing our DPO at info@mageedentalcare.co.uk. We will respond within one month.
- Right of Access: You can request a copy of the information we hold about you free of charge.
- Right to Rectification: You can ask us to correct inaccurate or incomplete data.
- Right to Erasure (Right to be Forgotten): You can ask us to delete non-clinical data. Please note: We are legally unable to erase clinical dental records before the end of the statutory DoH/RQIA retention periods.
- Right to Restrict or Object: You can object to us using your data for direct marketing or specific processing activities.
- Right to Withdraw Consent: Where we rely on your consent (for example, for marketing or using your photographs), you can withdraw it at any time.
- Transferring Your Records: You can ask us to transfer a copy of your records to another dental provider.
If You Do Not Agree or Wish to Complain
If you object to how we collect and use your data, please contact our Data Protection Officer or Practice Manager, or speak to your dentist. Refusing to provide an essential medical or dental history means we may be legally unable to safely continue providing your dental care.
If you have concerns about our data handling, you have the right to lodge a formal complaint with the UK data regulator:
Information Commissioner's Office (ICO)
ICO Northern Ireland Regional Office
3rd Floor, 14 Cromac Place, Gasworks, Belfast, BT7 2JB Tel: 0303 123 1114 | Email: ni@ico.org.uk
As a registered dental practice in Northern Ireland, we are regulated by the Regulation and Quality Improvement Authority (RQIA). If your concern relates specifically to the quality, regulation, or management of our clinic, you can contact them at:
The Regulation and Quality Improvement Authority (RQIA)
James House, 2-4 Cromac Avenue, Belfast, BT7 2JA Tel: 028 9536 1111 | Website: www.rqia.org.uk