Privacy Policy for OrthodonticLounge.com

OrthodonticLounge.com (“we,” “our,” or “us”) operates from:

Lockerbie Dental
134 High Street
Lockerbie
DG11 2BX
Phone: 01576 205 898

We are a Data Controller under the terms of the Data Protection Act 2018 and the UK General Data Protection Regulation (UK GDPR). We process personal data in order to provide healthcare services to our patients.

This Privacy Policy explains what personal data we hold, why we process it, who we may share it with, and your rights under the law.

1. Types of Personal Data

We may hold personal data in the following categories:

  • Patient clinical and health records, including correspondence

  • Staff employment data

  • Contractor and supplier data

2. Why We Process Personal Data

“Processing” means collecting, storing, updating, and securely archiving data.

We process personal data for the following purposes:

  • Patient data: To provide appropriate, high-quality, safe, and effective dental and orthodontic care

  • Staff data: To comply with employment, taxation, and pension obligations

  • Contractor data: To manage contracts and business relationships

3. Lawful Basis for Processing

Under data protection law, we rely on the following lawful bases:

  • Legitimate Interest: For holding and using patient data necessary to deliver care

  • Public Task: Where NHS treatment is involved and required by law

  • Legal Obligation: For processing staff employment data

  • Contractual Necessity: For processing contractor data

4. Sharing Your Information

We only share personal data when necessary and in a secure manner. This may include:

  • Healthcare professionals involved in your care (e.g. specialists, hospitals and laboratories)

  • NHS Business Services Authority (for NHS dental treatment)

  • Third-party dental plan providers (e.g. Denplan or Simplyhealth Professionals)

  • IT and software providers for secure data storage and backup (which may be located outside the UK)

  • Your authorised representatives (e.g. parents, carers or legal advisors)

  • Insurance providers (with your consent)

  • Government bodies such as HMRC and the Department for Work and Pensions

  • Accountants, payroll providers and healthcare regulators

  • Contractors engaged for practice management purposes

We may also use your contact details for marketing communications, but only with your explicit consent.

5. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including encrypted backups and secure systems. However, no system is completely secure, and we cannot guarantee absolute security.

6. Your Rights

You have the following rights under data protection law:

  • The right to be informed about how your data is used

  • The right to access your personal data

  • The right to request correction of inaccurate data

  • The right to request deletion of your data in certain circumstances

  • The right to data portability

  • The right to restrict processing

  • The right to object to processing

  • The right not to be subject to automated decision-making

To exercise any of these rights, please contact us directly.

7. Data Retention

We retain personal data as follows:

  • Patient records: Retained during active care and archived for legal purposes. Records are typically securely destroyed after 11 years unless required longer

  • Staff data: Retained for 6 years after employment ends

  • Contractor data: Retained for 7 years after contract completion

8. Complaints

If you are not satisfied with how we handle your data, you can contact our Data Protection Officer:

Data Protection Officer: xxxxxx

We will do our best to resolve your concern. If you remain dissatisfied, you may contact the Information Commissioner’s Office (ICO):

Website: www.ico.org.uk
Phone: 0303 123 1113

9. Updates to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated revision date.

By using OrthodonticLounge.com, you agree to the terms of this Privacy Policy.

If you want, I can also insert today’s date properly and replace the DPO placeholder so it’s 100% ready to publish.