This Privacy Notice explains how 76 Harley Street Limited, trading as 76 Harley Street (“we”, “us” or “the Practice”), collects, uses, shares and protects personal information. It applies to patients, prospective patients, parents, guardians, carers, website visitors and people who contact us.
1. Who is responsible for your information?
The data controller is 76 Harley Street Limited (company number 06301876), operating as 76 Harley Street Ltd, at 76 Harley Street, London W1G 7HH. Our Information Commissioner’s Office registration reference is Z1228806.
Our Data Protection Officer is Emma Russell. You can contact her at e.russell@76harleystreet.com, by post at the address above, or by telephone on 020 7631 3276.
2. Information we collect
- Identity and contact information, including name, title, date of birth, address, telephone number, email address and emergency contacts.
- Information about parents, guardians, carers, representatives and parental responsibility where relevant.
- Medical and dental history, medicines, allergies, health conditions and information supplied by other healthcare professionals.
- Clinical records, diagnoses, treatment discussions, treatment plans, referrals, prescriptions, radiographs, scans, study models, photographs, video and records of consent.
- Appointment, correspondence, call-note, complaint, incident and communication records.
- Financial information, estimates, invoices, payments, payment plans, insurance or dental-scheme information and account-recovery history.
- Website and device information, including IP address, browser details, pages visited and cookie or analytics identifiers, subject to applicable consent requirements.
- Marketing preferences and records of consent or objection.
3. How we obtain information
We receive information directly from you through forms, appointments, telephone calls, email, SMS, letters, online booking and our website. We may also receive information from a parent or guardian, referring dentist, GP, hospital, other healthcare professional, insurer, dental scheme, finance provider, emergency contact, regulator or other person involved in your care. For proportionate debt recovery, information may also come from payment providers, professional advisers or lawful tracing sources.
4. Why we use information and our lawful bases
We use personal information only where we have a lawful basis. Depending on the activity, we may rely upon performance of our contract with you; compliance with legal or regulatory obligations; our legitimate interests or those of a third party; protection of vital interests; or your consent where consent is appropriate.
Health information is special-category data. We process it where necessary for the provision and management of health care by professionals subject to confidentiality, and where necessary for legal claims or another applicable condition under data-protection law.
Clinical care and practice administration
- To assess, diagnose, plan, provide and review dental care and maintain complete clinical records.
- To communicate about appointments, recalls, treatment, prescriptions, referrals, safety and service administration.
- To manage consent, safeguarding, complaints, incidents, quality assurance, audits and professional or regulatory obligations.
- To process fees, payments, insurance claims, payment plans and accounts.
- To establish, exercise or defend legal claims and respond to lawful requests from courts, regulators or public authorities.
- To operate, secure, improve and administer the Practice and its systems.
Our legitimate interests may include safe and efficient practice administration, preventing fraud, maintaining security, recovering valid debts, improving services and protecting our legal rights. Where we rely on legitimate interests, we consider necessity, proportionality and the impact on your rights.
5. Appointments, recalls and service messages
We may send appointment confirmations, reminders, recall invitations, treatment reports, safety notices and account communications. These are service or care communications rather than promotional marketing. Some reminders may be generated automatically, but replies, disputes and decisions with significant effects are reviewed by a member of our team.
6. Marketing
With appropriate permission, or where another lawful rule permits, we may send information about services, events, open days or offers by email, SMS, telephone or post. You can object to direct marketing at any time by contacting us or using the unsubscribe facility provided. We will stop marketing but may keep a minimal suppression record so that we respect your preference. Marketing consent is separate from accepting treatment or acknowledging this Privacy Notice.
We do not ordinarily direct personalised marketing to children. Any use of children’s information for marketing will receive particular protection and will occur only where lawful and fair.
7. Children and people represented by others
We process children’s information to provide safe dental care and manage appointments and accounts. Information may be supplied by and shared with a person who has parental responsibility, but a child who has sufficient understanding may exercise privacy and confidentiality rights personally. We will consider the child’s capacity, best interests, confidentiality, safeguarding and the legal authority of anyone requesting information. We aim to explain information in an age-appropriate way.
8. Photographs, recordings and radiographs
Clinical photographs, video, scans and radiographs may be processed where necessary for diagnosis, treatment, records, referrals or legal and regulatory purposes. We seek separate, specific consent before using identifiable material for external education, publication, our website, social media or promotion. Refusing promotional use will not affect care. Consent may be withdrawn for future use, although it may not be possible to recall material already lawfully printed, distributed or published.
9. Payments and debt recovery
We use identity, contact, invoice, payment and account information to administer payments through providers including Stripe, Barclaycard and GoCardless, investigate disputed balances and recover valid debts. Where an account remains unpaid, we may share the minimum information reasonably necessary with Frontline Collections, another appointed debt-recovery provider, tracing provider, legal adviser or court. Clinical information is not ordinarily disclosed for debt recovery unless necessary to establish or defend a disputed claim and there is a lawful basis.
10. AI-assisted treatment documentation
We may use ChatGPT Business, supplied by OpenAI, to assist authorised team members with drafting treatment documentation. Before information is submitted, direct identifiers are removed and replaced with a randomly generated reference that cannot identify the patient without access to the Practice’s separate clinical system. We do not submit names, initials, dates of birth, addresses, contact details, appointment dates or patient images for this purpose.
AI-generated content is reviewed by an authorised clinician or team member before it is used. The Practice remains responsible for all final clinical records and decisions. We apply appropriate contractual safeguards, access controls and a defined retention procedure to this processing.
11. Who we share information with
Where necessary and lawful, recipients may include:
- Authorised members of the Practice team and treating clinicians.
- Referring dentists, GPs, hospitals, emergency services and other healthcare professionals involved in your care.
- Dental laboratories, imaging services and other clinical suppliers.
- Exact SOE for patient records, online booking, SMS and appointment reminders.
- Adobe Acrobat Sign for secure treatment reports and electronic signatures, Microsoft 365 for communications, Dropbox Business for management-controlled cloud storage, and authorised IT, backup and support providers.
- Stripe, Barclaycard and GoCardless for payments and agreed instalment arrangements.
- Klinical or a replacement provider for website hosting and development.
- Google Analytics, Google Ads, Google Tag Manager and Meta Pixel where permitted by your cookie choices, together with relevant advertising and analytics providers.
- OpenAI as the provider of ChatGPT Business for controlled AI-assisted treatment-document drafting.
- Finance providers, insurers and private dental schemes where relevant to a patient’s arrangements.
- Legal or professional advisers where their involvement is necessary and lawful.
- Frontline Collections and other appropriately appointed debt-recovery or tracing providers.
- The CQC, GDC, ICO, HM Revenue & Customs and other regulators or public authorities where relevant and lawful.
- Police, courts, safeguarding authorities or other bodies where disclosure is required or permitted by law.
- 78MPR, which is a separate data controller, where a patient is referred or receives treatment at both practices and record sharing is necessary for coordinated care.
We require service providers acting on our behalf to protect information and use it only for authorised purposes. We disclose only information reasonably necessary for the relevant purpose.
12. International transfers
Some technology providers may store or access information outside the United Kingdom. Where this occurs, we use providers and safeguards permitted by data-protection law, such as UK adequacy regulations or approved contractual safeguards. You may contact our Data Protection Officer for further information about relevant destinations and safeguards.
13. Website, cookies and analytics
Our website may collect technical and usage information through cookies and similar technologies. Strictly necessary technologies may operate without consent where permitted. We will request a valid choice before using non-essential analytics, advertising or tracking technologies where consent is required. Our Cookie Notice identifies the technologies used, their providers, purposes and durations, and explains how to change or withdraw your choices.
14. How we protect information
We use proportionate organisational and technical measures designed to protect personal information against unauthorised access, alteration, loss, disclosure or destruction. These include role-based access controls, staff confidentiality and training, secure systems, management-controlled Dropbox Business storage, encrypted hard-drive backups stored securely, supplier checks and incident procedures. We do not currently use CCTV or record or automatically transcribe telephone calls. No system can be guaranteed completely secure, but we regularly review our measures and respond to suspected breaches in accordance with law.
15. How long we keep information
We retain information only for as long as reasonably necessary for care, legal, regulatory, insurance, accounting and dispute-resolution purposes. Adult clinical dental records are normally retained for at least 11 years. For a child, records are normally retained until at least age 25 where that is longer. Other information has different periods:
- Financial and accounting records are generally retained for the applicable statutory period.
- Enquiries that do not become patient records are retained only as long as needed to respond and manage any follow-up.
- Complaints, incidents, claims and debt-recovery records may be retained until relevant limitation, regulatory and insurance periods have expired.
- Website logs and analytics are retained for shorter periods appropriate to their purpose and the settings of the relevant service.
- Marketing preference and suppression information may be retained to ensure we continue to respect an objection.
Our detailed retention schedule is reviewed periodically. Please contact us if you would like information about the period applying to a particular record.
16. Your rights
Depending on the processing and lawful basis, you may have the right to:
- Be informed about how we use your information.
- Request access to your personal information.
- Ask us to correct inaccurate or incomplete information.
- Request erasure in circumstances where we are not legally or professionally required to retain the information.
- Request restriction of processing in certain circumstances.
- Receive certain information in a portable format where the legal conditions apply.
- Object to processing based on legitimate interests and object at any time to direct marketing.
- Withdraw consent at any time where processing relies on consent, without affecting earlier lawful processing.
- Ask for human intervention where a solely automated decision has a legal or similarly significant effect.
These rights are not absolute. We may need to retain clinical information or continue particular processing to meet legal, regulatory or professional obligations. To exercise a right, contact our Data Protection Officer. We may request information needed to verify identity and authority.
17. Complaints
Please contact Emma Russell, our Data Protection Officer, at e.russell@76harleystreet.com if you have a concern. We will try to resolve it promptly. You may also complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or by telephone on 0303 123 1113. You may contact the ICO without first complaining to us, although the ICO may ask whether we have had an opportunity to respond.
18. Changes to this notice
We review this Privacy Notice regularly and may update it to reflect changes in our services, suppliers or legal obligations. The current version and effective date will be published on our website. We will draw material changes to your attention where appropriate.