College Road Dental Practice | Last reviewed: May 2026 

College Road Dental Practice processes personal identifiable information that relates to patients and is therefore required by law to comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Data (Use and Access) Act 2025 (in force from February 2026), which protect your privacy and ensure that your personal information is processed fairly and lawfully. 

Data Protection Officer: Umar Sabat 

Our Commitment to Patients 

College Road Dental Practice is committed to ensuring that it complies with UK GDPR and applies ethical principles to all aspects of its work to protect the interests of patients and maintain the confidentiality and security of any personal information held in any form by the practice. 

Why Does the Practice Hold Personal Information About Me? 

We keep information about you to: 

• Ensure the dental team can contact you easily 

• Provide you with the best possible dental care 

• Provide care for you under the NHS 

• Enable administration of the NHS 

• Fulfil our contractual and legal obligations as a dental practice 

Our legal basis for holding this information is: contract fulfilment, legal obligation, legitimate interests, and/or the provision of healthcare (Article 9(2)(h) UK GDPR). Under the Data (Use and Access) Act 2025, we may also rely on “recognised legitimate interests” for sharing data with regulators and public bodies. 

How Does the Practice Collect Personal Information? 

We collect personal information either directly from you or are provided with it by third parties, such as other dental or medical providers. It is important that the personal information we hold about you is accurate and current. Please keep us informed of any changes to your personal information. 

What Personal Information is Kept? 

Personal information includes facts (e.g. treatment you have had) and opinions (e.g. any concerns you or your dentist might have about your dental health). To provide the best possible care for you, accurate and comprehensive personal information is required. The following records are kept and updated regularly: 

• Personal information and contact details, including your name, address, date of birth, NHS number, national insurance number, telephone number and email address 

• Dental, social and medical histories (e.g. past or current medical conditions, current medication, the name of your GP) 

• Results of the examination of your mouth and oral health, including X-rays, clinical photographs and digital scans 

• Information about appointments 

• Any treatments and the costs, including NHS and private payment details 

• Any proposed care, including advice we give to you and referrals you might need 

• Any concerns you or your dental team might have 

• Details of your consent for specific procedures 

• Correspondence with other healthcare workers that relates to your care 

• Details of any complaints you have made and how these were dealt with 

How is My Personal Information Processed? 

Your care – We keep patient records to allow us to provide appropriate dental treatment and care. 

Practice administration – We will use your contact information to let you know when your next appointment is due, and we will also send reminders about any appointments that you have booked. 

Quality improvement – We may contact you to conduct patient surveys or to find out if you are happy with the treatment you received for quality control purposes. 

Regulatory compliance – Under the Data (Use and Access) Act 2025, we may process your information where we have a recognised legitimate interest in doing so, such as sharing with regulators or public health bodies. 

Sharing Relevant Information 

To provide you with appropriate care, we might need to share your personal data with: 

• Another dentist or health professional who is caring for you 

• Your GP 

• The hospital or community dental services 

• Specialist dental or medical services to which we may refer you 

• A dental laboratory 

• NHS payment authorities 

• HM Revenue and Customs 

• The Department for Work and Pensions, if you are claiming exemption or remission from NHS charges 

• A private dental scheme, if you are a member (e.g. Denplan/Simply Health Professionals) 

• Debt collection agencies (where necessary) 

In these cases, only the minimum information required will be shared. Rarely, the law requires us to pass on information to prevent serious crime or injury. Where possible, we will inform you of requests to share personal information. We will let you know in advance if we send your medical information to another medical provider and will give you the details of that provider at that time. 

Storage and Retention of Personal Information 

Personal information is stored on a secure, password-protected practice computer system and in a manual filing system; only authorised practice staff have access to these systems. Back-ups of these data are made regularly. We use cloud computing facilities for storing some of your information. The practice has a rigorous agreement with our provider to ensure your information is kept securely and lawfully. 

We keep your records for 11 years after the date of your last visit to the practice or until you reach the age of 25 years, whichever is the longer. At your request, we will delete non-essential information (for example, some contact details) before the end of this period. We will not keep records for longer than necessary; after they are no longer required, records will be securely destroyed. 

We have CCTV at the practice for the purposes of patient and staff safety. Please see our CCTV policy for further details. 

Your Rights 

Under UK GDPR and the Data (Use and Access) Act 2025, you have the right to: 

• Access the information we hold about you and receive a copy (Subject Access Request). We do not usually charge a fee for this, unless the request is deemed excessive. We will respond within one month of receipt. Under the Data (Use and Access) Act 2025, we may pause this timeline to seek clarification where needed. 

• Correct any information that you believe is inaccurate or incomplete 

• Erase some of the information we hold. For legal reasons, we may be unable to erase certain information (e.g. information about your dental treatment), but we can delete non-clinical information on request 

• Object to or restrict the processing of your information – for example, to stop receiving appointment reminders or marketing 

• Withdraw consent at any time where we are relying on consent as our lawful basis 

• Request the transfer of your personal information to another dental practice (data portability) 

• Complain about the handling of your personal data (a new right under the Data (Use and Access) Act 2025, in force from June 2026). We will acknowledge complaints within 30 days. 

To exercise any of these rights, please email our practice manager at laura@completedental.co.uk or write to us at the address below. A copy of photo identification may be required prior to releasing a copy of your records. 

Concerns and Complaints 

If you have any concerns about how we use your information and you do not feel able to discuss it with your dentist or anyone at the practice, you should contact: 

The Information Commissioner’s Office (ICO) 
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF 
Tel: 0303 123 1113 or 01625 545745 
Email: mail@ico.org.uk 
Website: www.ico.org.uk 

Contact Us 

College Road Dental Practice 
2 College Road, Bromsgrove, Worcestershire B60 2NE 
Data Protection Officer: Umar Sabat