This policy is complete in structure and wording but requires your own details before it goes live. Every field to complete is marked in the page source with the comment LEGAL-PLACEHOLDER. It is written to reflect UK data protection law but it is not legal advice, and you should have it reviewed against how your business actually operates.
Data controller: Add trading name, legal entity, company number and registered address
Contact for data protection matters: Add email address and postal address
ICO registration number: Add if registered
Last updated: Add date
This policy explains what personal information is collected when you use this website or arrange Teeth Whitening treatment, why it is collected, how it is used, how long it is kept, and what rights you have over it.
Information Collected
Information you provide directly
- Your name and the contact details you choose to give when making an enquiry
- The location or area relevant to arranging an appointment
- Information about your dental history that is relevant to suitability for treatment, including previous whitening, existing sensitivity, restorations and recent dental work
- Any other information you choose to include in your correspondence
Information recorded during treatment
- Notes from the pre-treatment assessment
- Your recorded starting shade and finishing shade
- Photographs, only where you have given consent for them to be taken
- A record of the treatment carried out and any aftercare guidance given
Information collected automatically
Confirm and complete — state here whether this website uses cookies, analytics, embedded maps, embedded video or any other third-party content that collects data. If it uses none, state that plainly. If it uses any, name each service, explain what it collects and provide a lawful basis and, where required, a consent mechanism.
Why Information Is Used
- To respond to enquiries. Answering the question you asked and providing the information you requested.
- To assess suitability. Establishing whether Teeth Whitening is appropriate for you and identifying anything that means treatment should be postponed.
- To arrange and carry out appointments. Scheduling, confirming and delivering treatment.
- To keep treatment records. Recording what was done, what shade was achieved and what guidance was given.
- To follow up after treatment. Answering aftercare questions and checking how you are getting on.
- To meet legal and insurance obligations. Retaining records where there is a legal or regulatory requirement to do so.
Lawful bases
Processing is carried out on the basis of your consent where you have given it, on the basis of taking steps at your request before entering into a contract and performing that contract where treatment is arranged, on the basis of legitimate interests in operating and administering the business, and on the basis of legal obligation where the law requires records to be kept. Photographs are processed on the basis of explicit consent only.
What Is Not Done With Your Information
- Your information is not sold to anyone, in any circumstances
- Your information is not shared with third parties for their marketing purposes
- You are not added to a mailing list without explicitly agreeing to it
- Photographs are not published, used in marketing or posted online without separate written consent
- Consent given for one purpose is not treated as consent for another
- Automated decision-making and profiling are not used
Sharing and Storage
Complete this section — list every third party that processes personal data on your behalf, such as your email provider, any booking or scheduling software, cloud storage, accounting software and any payment processor. For each, state what data they handle and confirm that appropriate contractual protections are in place. If data is transferred outside the UK, state where and on what safeguard.
Information may also be disclosed where there is a legal obligation to do so, or where disclosure is necessary to establish, exercise or defend legal claims.
Security
Personal information is stored securely, with access limited to those who need it to provide the service. Paper records, where kept, are stored securely. Electronic records are held on password-protected systems.
How long information is kept
Set your retention periods — state how long enquiry correspondence, treatment records, consent forms, photographs and financial records are each kept, and the reason for each period. Retention should be informed by your insurer's requirements and by any applicable limitation periods. Information is not kept for longer than there is a reason to keep it.
Your Rights
Under UK data protection law you have the following rights in relation to your personal information.
- Access. To ask what information is held about you and to receive a copy of it.
- Rectification. To have inaccurate information corrected and incomplete information completed.
- Erasure. To ask for information to be deleted, subject to any overriding legal obligation to retain it.
- Restriction. To ask that processing be limited in certain circumstances.
- Objection. To object to processing carried out on the basis of legitimate interests, and to object to direct marketing at any time.
- Portability. To receive certain information in a portable format.
- Withdrawal of consent. To withdraw consent at any time where processing is based on it, including consent for photographs. Withdrawal does not affect processing carried out before it.
To exercise any of these rights, use the data protection contact details at the top of this page. You will not be charged for making a request in normal circumstances, and a response will be provided within the statutory time limit.
Complaints
If you are not satisfied with how your information has been handled, you can complain to the Information Commissioner's Office, the UK supervisory authority for data protection. Raising the matter directly first is welcome but is not a requirement before complaining.
Children
Teeth Whitening is not offered to anyone under eighteen and this website is not directed at children. Personal information about children is not knowingly collected. If you believe information about a child has been provided, please make contact so that it can be deleted.
Changes to This Policy
This policy may be updated from time to time to reflect changes in how the business operates or in the law. The date at the top of the page indicates when it was last revised. Material changes affecting how your information is used will be communicated directly where you have provided contact details and it is appropriate to do so.
Questions about this policy can be raised through the details on the contact page. The terms applying to appointments are set out in the terms and conditions.
