Privacy Policy

Castle Dental Practice, Lincoln (“we”, “us”, “our”) is committed to protecting your personal information and respecting your privacy. This notice explains how we collect, use, store and share your information, and your rights under UK data protection law.

1) Who we are (Data Controller)

Castle Dental Practice, Lincoln is the data controller for the personal information we hold about patients.

Contact details
19 Burton Road, Lincoln, LN1 3JY
01522 543213
info@castledentallincoln.co.uk

Privacy queries: Please contact the Practice Manager (or your usual point of contact at the practice).

2) The personal information we collect

We may collect and store the following types of information:

• Identity & contact details: name, date of birth, address, phone number, email
• Dental and medical information (health data): dental history, medical history, medications, allergies, x-rays, photographs, treatment plans and clinical notes
• Appointment information: appointment dates/times, attendance, reminders and correspondence
• Payment & administration: invoices, receipts, payment status, plan/membership details (where applicable)
• Communications: emails, letters, messages and notes of phone conversations
• Website/online services: information you submit via online forms/booking (and basic technical data such as IP address/cookies if used)

Health information is classed as special category data under UK GDPR.

3) How we use your information (and our lawful basis)

We use personal information to:

• Provide dental care and treatment (including diagnosis, prevention, treatment planning, follow-ups and recalls)
• Manage appointments, reminders and patient communications
• Maintain accurate clinical records and ensure continuity of care
• Process payments and manage accounts
• Handle complaints, incidents and quality improvement
• Meet legal and regulatory obligations (including professional standards and record keeping expectations)

Lawful bases (UK GDPR): depending on the situation, our lawful basis will usually be one or more of: contract, legal obligation, and/or legitimate interests. For health (special category) data, we typically rely on the health or social care condition under UK GDPR Article 9, alongside an Article 6 basis.

4) Where we get your information from

We collect information:

• Directly from you (forms, phone calls, emails, online booking, in-practice conversations)
• From a parent/guardian (for child patients)
• From other healthcare providers if you consent or if it’s required for your care (e.g., referrals, previous records)

5) Who we share your information with

We only share information when necessary and appropriate. This may include:

• Dental laboratories and clinical partners involved in your treatment (e.g., crowns, dentures, aligners)
• Specialist providers or referral practices (if you’re referred)
• Dental plan providers (where you are a member of a plan)
• Payment providers (to process transactions)
• IT and system suppliers (practice management software, secure email, backups) acting as our processors
• Regulators or authorities where required by law

We require third parties we use to keep your information secure and only use it for agreed purposes.

6) International transfers

Where we use suppliers who store data outside the UK, we ensure appropriate safeguards are in place (for example, approved transfer mechanisms and contractual protections) in line with UK data protection requirements.

7) How we keep your data secure

We use organisational and technical measures to protect your data, such as access controls, staff confidentiality training, secure systems, and appropriate backups. We only keep personal information for as long as necessary and in line with our retention schedule.

8) How long we keep your information

We keep dental records for as long as needed for your care and to meet legal/regulatory requirements. We follow a documented retention schedule.

As a guide, recognised healthcare record management guidance for dental clinical records refers to minimum retention periods such as:

• Adults: commonly at least 11 years after the last entry/treatment
• Children/young people: until age 25 (or 26 if treatment ended at 17), or longer where needed

(We may keep records longer if required for legal or clinical reasons.)

9) Your data protection rights

Under UK GDPR, you have rights which may include:

• Access to your personal data (subject access request)
• Rectification (correction of inaccurate information)
• Erasure (in certain circumstances)
• Restriction of processing (in certain circumstances)
• Objection (in certain circumstances)
• Data portability (in certain circumstances)
• Withdraw consent (where we rely on consent)

The ICO provides guidance on these rights and how organisations should respond.

10) Marketing

We will only send marketing messages (e.g., newsletters/offers) if we have a lawful basis to do so. You can opt out at any time by contacting us or using the unsubscribe option (if provided).

11) Cookies and website analytics

If our website uses cookies or analytics tools, we will provide a cookie notice/banner explaining what cookies are used and how you can manage your preferences.

12) How to raise a concern or complaint

If you have any concerns about how we use your information, please contact us first so we can help.

If you’re not satisfied, you can complain to the Information Commissioner’s Office (ICO):

• Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
• Telephone: 0303 123 1113

13) Changes to this privacy notice

We may update this notice from time to time. The latest version will be available on our website and/or at reception.

Last updated: 10 February 2026