PRIVACY NOTICE FOR PATIENTS

including children

This privacy notice sets out how Goodlight Clinic uses and protects any information that you give when joining the practice or interacting with us, including through our website, social media, online forms or marketing communications.

The practice is committed to complying with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, GDC standards, and all applicable guidance.

The person responsible for Data Protection is: Jacek Sitkiewicz

What type of information do we hold?

Personal details such as your address, date of birth, phone number and email address
This is for the provision of dental health care, providing treatment plans, estimates and recalls
Details of your NHS number and entitlement to healthcare treatment and exemption status if applicable
Personal details of family members or emergency contact details
Medical history including your GP’s name and address
Past and present dental history including x-rays and photographs
Information about the treatment we have proposed and provided along with its price.
Notes of conversations or incidents that might occur for which a record needs to be kept
Records of permission or consent for treatment.
Correspondence to other healthcare professions such as referrals
Financial information relating to your treatment
Details of any complaints made

Marketing & Communications Data

• Your name and contact details (email address, phone number) collected when you enquire about our services, complete an online form, respond to a survey, or interact with our social media pages or advertising

• Information collected through Meta (Facebook/Instagram) lead generation advertisements, where you have submitted an enquiry form via our paid social media campaigns

• Your marketing preferences — including whether you have opted in to receive promotional messages, appointment reminders, oral health tips, or information about treatments and special offers

• Survey responses submitted voluntarily, including patient satisfaction feedback

• Records of your consent, including the date, channel and nature of the consent given

Why do we need to keep this information?

We need to keep records of personal information regarding our patients in order to provide safe and appropriate dental care and treatment. It is also used to maintain accurate treatment records.

We also process personal data to ensure the proper management and administration of the practice, and where we are providing NHS care, to comply with NHS requirements.

Why We Process Marketing Data

Where you have given us your consent, we may also use your contact details to:

• Send you appointment reminders, recalls and post-treatment follow-up messages

• Share information about treatments, promotions, events or news relevant to your dental health and wellbeing

• Contact you following an enquiry submitted via our website, Meta advertisements or social media

• Send you surveys to gather feedback on your experience with the practice

We will only send marketing communications where you have clearly opted in to receive them. We will never send unsolicited marketing messages.

Our legal basis for processing data is:

Consent
Legitimate interest - Processing is necessary for the performance of our care for patients and for defence of legal claims
Data relating to your health care records is classed as special category data. Our legal basis for processing this is that it falls under Legal claims or judicial acts and Health and Social Care (Article 9 UK GDPR (f,h)).

What do we do with your Information?

We will only share your information if it is done securely and it is necessary for us to do so.

Your personal information may be securely shared with other healthcare professionals who need to be involved in your care (for example if we refer you to a specialist, need laboratory work undertaken or need to consult with your doctor)

We may also share your personal information securely to third parties where we are required by law or regulation to do so. This may include:

The General Dental Council
The CQC/HIW/HIS/RQIA
Dental payment plans or insurers
NHS Bodies if NHS dental care and treatment is provided

Third-Party Marketing Platforms

Where you have interacted with our Meta (Facebook/Instagram) advertisements or submitted an enquiry form through a social media lead generation campaign, your contact details may be processed through Meta's platform prior to being securely transferred to our practice management systems. Meta acts as a data processor in this context. For more information on how Meta processes your data, please refer to Meta's Privacy Policy at www.facebook.com/privacy/policy.

Marketing Communications — Your Choices

Opting In

We will only send you marketing messages where you have clearly given us your consent to do so. You may provide consent:

• On a paper or digital new patient registration form

• Via a consent tick-box on our website or online enquiry form

• By responding to a Meta lead generation advertisement

• Verbally at the practice, with a record kept of your preference

Opting Out

You can withdraw your consent to receive marketing communications at any time, at no cost and without affecting your dental care. To opt out:

• Reply STOP to any SMS marketing message

• Click the unsubscribe link in any marketing email

• Contact us at contact@goodlightclinic.co.uk

• Speak to a member of the team at reception

Once you opt out, we will update your preferences promptly and you will no longer receive marketing messages. Please note: you will still receive essential communications relating to your appointments and care.

Surveys

From time to time we may invite you to complete a patient satisfaction survey. Participation is entirely voluntary and based on your consent. Your responses may be used in aggregate, anonymised form to improve our services. You may decline to participate at any time without it affecting your care.

How do we store your Information?

Your Information is stored securely at the practice [in paper form] [on protected computer systems]. Computer information is backed up regularly and may be securely stored away from our premises.

Retention periods

We are required to retain your dental records, X-rays and study models while you are a patient of this practice and after you cease to be a patient for a minimum of 11 years.
There are several other documents that we may collect that have a variety of retention dates, for example the NHS PR form – used to declare payment exemptions – which needs to be kept for 2 years minimum. We have a retention schedule listing all documents and the timeframes for disposal. Retention periods may be changed from time to time based on business or legal and regulatory requirements

Marketing Data Retention

Where we hold your data for marketing purposes only (i.e. you are not a current or former patient), we will retain your contact details and consent records for no longer than 3 years from the date of your last interaction with us, or until you withdraw consent, whichever is sooner. Consent records are retained for as long as is necessary to demonstrate compliance.

Your rights under GDPR

Access

You have a right to access the information that we hold about you and to receive a copy. You can make a request by contacting your practice or by e-mailing contact@goodlightclinic.co.uk

Rectification

You have a right to correct any information that you believe is inaccurate or incomplete. Please contact your practice to request a change in information.

Erasure

You have a right to request that we delete your personal information, although you should be aware that, for legal reasons, we may be unable to erase certain information (for example, information about your dental treatment). Please contact your practice to make this request.

Restriction

You have the right to request us to restrict the processing of your personal information for example, sending you reminders for appointments or information about our service. Please contact your practice to make this request.

Portability

You have a right to data portability; this could include supplying your information to another dentist. Please contact your practice to make this request.

CCTV Privacy Notice

Our premises are monitored by a closed-circuit television (CCTV) system to ensure the safety and security of staff, patients, visitors, and property. The system operates 24/7 and is used to deter, prevent, and investigate security incidents such as unauthorized access, theft, or vandalism. CCTV recordings are stored securely and are overwritten in a continuous loop, meaning no physical deletion of data is required. Footage is only accessed in cases of emergency or for the purposes of a criminal investigation or legal proceedings. Your privacy is important to us, and we ensure the system is used responsibly and in compliance with data protection laws. For more information about how we use CCTV footage, your rights, or to make a request, please contact Trish Pater.

Concerns

If you have any concerns about how we use your information and you do not feel able to discuss it with your dentist or anyone at the practice, you can contact our Data Protection Officer via email at contact@goodlightclinic.co.uk

You can also seek advice from The Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, or start a live chat or call helpline on 0303 123 1113.

PRIVACY NOTICE FOR CHILDREN

What type of information do we hold?

Personal details such as your address, date of birth, phone number and email address - This is for the provision of dental health care, providing treatment plans and recalls.
Personal details of family members or emergency contact details
Medical history including your GP’s name and address
Information about the treatment we have proposed and provided
Notes of conversations or incidents that might occur for which a record needs to be kept
Correspondence to other healthcare professions such as referrals

Why do we need to keep this information?

We need to keep records of personal information regarding our patients in order to provide safe and appropriate dental care and treatment. It is also used to maintain accurate treatment records.

We also need to process personal data about you if we are providing care under NHS arrangements and to ensure the proper management and administration of the NHS.

What do we do with your Information?

We will only share your personal information to another dentist or doctor, such as for an orthodontic referral. We will not share your personal information to anyone else unless needed for legal reasons.

How do we store your Information?

Your Information is stored securely at the practice [in paper form] [on protected computer systems]. Computer information is backed up regularly and may be securely stored away from our premises.

Retention periods

For children – we will retain your dental records for 11 years or until they reach the age of 25 (whichever is longer).

Concerns

You can also seek advice from The Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, or start a live chat or call helpline on 0303 123 1113.

Approved By: Jacek Sitkiewicz, Malgorzata Sitkiewicz, Patrycja Pater
Date Published: 03/06/2026