Privacy Notice
What information we hold about you, why we hold it, and what you can ask us to do with it.
Who we are
The practice is committed to complying with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, GDC and other standards.
Orford Hill Ltd is the Data Controller responsible for your personal data.
8 Orford Hill, Norwich, NR1 3QD
Email: reception@orfordhilldental.co.uk
Telephone: 01603 762900
What information we hold
We collect and process your personal data when you provide the information we request, or when you request more information about, or purchase, a product or service.
- Personal details such as your address, date of birth, phone number and email address — used to provide dental health care, treatment plans, estimates and recalls.
- Details of your dental plan provider number and entitlement to healthcare treatment, and exemption status if applicable.
- Personal details of family members or emergency contact details.
- Medical history including your GP’s name and address.
- Past and present dental history including x-rays and photographs.
- Information about the treatment we have proposed and provided, along with its price.
- Notes of conversations or incidents for which a record needs to be kept.
- Records of permission or consent for treatment.
- Correspondence to other healthcare professionals, such as referrals.
- Financial information relating to your treatment.
- Details of any complaints made.
This data may include identity data, contact data, financial data, transaction data, technical data, profile data, usage data, and marketing and communications data.
Information collected through this website
When you use our website, we may collect and process personal data that you provide directly, for example when you complete a contact form, submit an enquiry, or register as a patient or book an appointment online. This information may include your name, contact details, and any details you choose to provide in your message.
We may also automatically collect limited technical information, such as your IP address, browser type and device information, and website usage data through cookies where applicable.
This information is used to respond to your enquiries, manage appointments, improve our website and services, and ensure website security.
Where cookies or similar technologies are used, you will be provided with clear information and choices in line with data protection requirements. We will only use information collected via our website for legitimate purposes and in accordance with this privacy notice.
Why we need it
We use your information to:
- Provide safe and appropriate dental care and treatment.
- Maintain accurate clinical records.
- Arrange appointments and recalls.
- Communicate with other healthcare professionals.
- Process payments and manage accounts.
- Meet legal and regulatory obligations.
- Manage complaints and incidents.
- Improve our services.
We process your personal data under the following lawful bases:
- Article 6(1)(c) — Legal obligation, for example regulatory requirements.
- Article 6(1)(f) — Legitimate interests, for example managing appointments, complaints and business administration.
For special category health data:
- Article 9(2)(h) — Health and social care provision.
- Article 9(2)(f) — Legal claims.
Who we share it with
We will only share your information if it is done securely, and it is necessary for us to do so.
Your personal information may be securely shared with other healthcare professionals who need to be involved in your care — for example if we refer you to a specialist, need laboratory work undertaken, or need to consult with your doctor.
We may also share your personal information securely with third parties where we are required by law or regulation to do so. This may include the General Dental Council, the Care Quality Commission, and dental payment plans or insurers.
We may also share your data with trusted service providers — for example dental software providers, IT support and payment processors — who process data on our behalf under strict contractual agreements.
We will only send you marketing communications if you have given explicit consent or where the law allows. You may withdraw your consent at any time.
How we store it, and for how long
Your information is stored securely at the practice in paper form and on protected computer systems. Computer information is backed up regularly and may be securely stored away from our premises.
We retain dental records in line with the NHS Records Management Code of Practice, or equivalent guidance, typically for a minimum of 11 years, or longer where required.
There are several other documents we may collect that have a variety of retention dates. We have a retention schedule listing all documents and the timeframes for disposal. Retention periods may be changed from time to time based on business, legal or regulatory requirements.
Your rights
- Access. You have a right to access the information that we hold about you and to receive a copy. You can make a request by contacting the practice or by emailing reception@orfordhilldental.co.uk.
- Rectification. You have a right to correct any information that you believe is inaccurate or incomplete. Please contact the practice to request a change.
- Erasure. You have a right to request that we delete your personal information, although you should be aware that, for legal reasons, we may be unable to erase certain information — for example, information about your dental treatment.
- Restriction. You have the right to ask us to restrict the processing of your personal information, for example sending you reminders for appointments or information about our service.
- Portability. You have a right to data portability; this could include supplying your information to another dentist.
Concerns or complaints
If you have a concern about how your personal data is being used, we ask that you contact us in the first instance so we can investigate and resolve the issue. We take all data protection complaints seriously and will acknowledge your concern promptly, investigate the matter thoroughly, and respond within a reasonable timeframe.
You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at any time, although we encourage you to contact us first so we can try to resolve your concern. Further details on how complaints are handled can be found within our Complaints Policy.
The Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. You can start a live chat or call the helpline on 0303 123 1113.
Privacy notice for children
When you visit our dental practice, we need to collect some information about you.
What we record: personal details such as your address, date of birth, phone number and email address, so we can provide dental health care, treatment plans and recalls; personal details of family members or emergency contact details; medical history including your GP’s name and address; information about the treatment we have proposed and provided; notes of conversations or incidents for which a record needs to be kept; and correspondence to other healthcare professionals, such as referrals.
Why we keep it. We need to keep records of personal information regarding our patients in order to provide safe and appropriate dental care and treatment. It is also used to maintain accurate treatment records.
What we do with it. We will keep your information safe. Only the people involved in your care will be able to see your information. We will not share your information with anyone else unless we are required to by law, or where it is really important for your health — such as if we need to refer you to another dentist or orthodontist.
Your rights. Where a child is not considered competent to make their own decisions, consent will be obtained from a person with parental responsibility. Where a child is deemed competent (Gillick competent), they may make decisions about their own data.
Retention. For children, we will retain dental records for 11 years or until you reach the age of 25 — or your 26th birthday if you finished treatment at 17 years old — whichever is longer.
For details of your rights under data protection laws, including the right to receive a copy of the personal data we hold about you and the right to make a complaint at any time to the Information Commissioner’s Office, the UK regulator for data protection issues (ico.org.uk), please contact our Data Protection Officer by email at reception@orfordhilldental.co.uk.
This notice was last reviewed on 14 August 2026.