Exceptional dental care,
delivered to your door

Our Legal & Professional Duty

All team members have a legal, professional and ethical duty to keep personal and sensitive information about patients confidential at all times, in line with the Data Protection Act 2018 (UK GDPR) and the GDC's Standards for the Dental Team. Compliance with this policy is a condition of employment.

What is Confidential?

Confidentiality applies to all information about patients, including but not limited to:

• Personal details (name, address, date of birth)
• Medical history and current health status
• Treatment received, planned or discussed
• Costs and payment details
• Appointment times and attendance

Day-to-Day Practices

• Conversations about patients take place in private settings
• Medical histories are taken in the patient's own home or a private nursing office
• NHS email with patient code and date of birth is used for electronic sharing
• Day lists are not left unattended and are shredded at end of day
• No appointment messages left with third parties or on answering machines without consent

When Disclosure May Occur

Information may only be disclosed in the following restricted circumstances:

• With the patient's explicit consent
• Where necessary to enable another healthcare provider to treat the patient (with consent)
• Where the wider public interest overrides individual confidentiality (e.g. serious crime prevention)
• Where required by statute or court order

Secure Storage

• Paper records: Locked metal filing cabinets in a locked office
• Electronic records: Password-protected with restricted access; backed up daily off-site
• All team members have unique, private passwords
• All paper waste containing personal information is securely shredded

Vulnerable Patients

We recognise that many of our patients have conditions such as hearing loss, reduced mobility, memory difficulties or lack of capacity. Where appropriate, and where it is in the patient's best interest, we may liaise with family members or care providers — always seeking the patient's consent at each visit where feasible.

GDPR Compliance

Dental Home Visits Cornwall is committed to full compliance with the Data Protection Act 2018 and the UK General Data Protection Regulation (GDPR). Our Data Controller is Alasdair Railton and our Data Protection Officer (DPO) is Kristin Becker.

Key GDPR Principles

All personal data we process is:

• Processed lawfully, fairly and transparently
• Collected for specified, explicit and legitimate purposes
• Adequate, relevant and limited to what is necessary
• Accurate and kept up to date
• Retained only as long as necessary
• Processed with appropriate security measures

Your Personal Privacy Rights

• Right to subject access
• Right to have inaccuracies deleted
• Right to have information erased
• Right to object to direct marketing
• Right to restrict automated processing
• Right to data portability

What Data We Hold

Patient personal information includes name, address, contact details, medical history, treatment records, appointment information and payment details. This information is held on our secure computer system and in locked, fire-proof filing cabinets.

Subject Access Requests (SAR)

Patients may request access to their records at any time. Requests must be referred to the patient's dentist. We will supply information within one month at no charge. We will verify your identity before releasing any information.

Data Retention

• Dental records: Retained for at least 11 years after last treatment, or until age 25 for children (whichever is longer)
• Team member records: Retained for 6 years after the working relationship ends

Reporting Data Breaches

All breaches must be reported to the DPO immediately. Reportable breaches are notified to the Information Commissioner's Office (ICO) within 72 hours. Breaches that may harm individuals are also reported directly to those affected. Failure to report a breach may result in disciplinary action.