Who we are and who this notice covers
Medomsley Road Dental Practice is responsible for the personal information described in this notice. We trade as 270 Dental and our registered address is 177 Medomsley Road Consett Durham DH8 5HA. This notice covers patients, prospective patients, people making enquiries, parents, guardians, representatives and other people who contact the practice.
Our ICO registration number is ZC061365.
Our data-protection contact is [email protected].
Information we collect
We collect information needed to provide safe dental care and run the practice. This can include your name, date of birth and contact details; dental and medical history; medicines, allergies and accessibility needs; examination findings, diagnoses, treatment plans, consent discussions, treatment provided and outcomes; correspondence, appointment and billing information; and relevant images or recordings where a confirmed activity below applies.
Where information comes from
We usually receive information from you. We may also receive it from a parent, guardian or authorised representative, a referring clinician, another healthcare provider, a dental laboratory, a commissioning body or another lawful source where this is relevant to your care or our responsibilities. We record the source where that is important.
Using information for patient care
We use relevant information to assess your oral health, make a diagnosis, discuss and plan treatment, provide treatment, keep an accurate clinical record, arrange follow-up and support continuity of care. We use only the information reasonably needed for these purposes. Consent to treatment and data-protection lawful bases are separate matters; this notice does not treat consent as a blanket basis for clinical care.
Appointments and service communications
We use contact and appointment information to register patients, book or change appointments, respond to service requests and send operational messages about care. Appointment reminders and recalls are included only when the practice has confirmed that activity. Service communications are separate from promotional messages.
Health information and confidentiality
Dental and medical information is special-category information and receives additional protection. We keep it confidential and use it only where both a lawful basis and an applicable health-data condition have been confirmed. Depending on the purpose, a relevant condition may include provision or management of health care, legal claims, vital interests or substantial public interest. The confirmed position is shown in the purpose table below.
Where an enquiry includes health information, the practice has selected the health or social care condition.
Purposes and lawful bases
The table below shows only purpose decisions the practice owner has confirmed. A lawful basis is selected purpose by purpose. We do not claim that all processing is required by law, and we do not use consent as a blanket basis for clinical care.
For website enquiries, our Article 6 basis is our legitimate interests in responding to and managing enquiries.
| Purpose | Information involved | Why we may use it | Relevant health-data condition |
|---|---|---|---|
| Appointments, reminders and recalls | Contact, appointment, reminder and recall information | Legitimate interests; Public task or official authority. We use limited patient contact, appointment and recall information to arrange dental care, send service reminders and tell patients when routine review or continuing care may be due. These communications support continuity of care and are separate from promotional marketing. Health information is handled where necessary to arrange and manage dental care by professionals and staff subject to duties of confidentiality.. Our legitimate interests are supporting continuity of dental care, keeping patients informed about booked appointments and recalls, and reducing missed appointments. Using limited contact, appointment and recall information is necessary to communicate reliably with patients. Patients would reasonably expect these service communications from their dental practice. We minimise the information used, avoid unnecessary clinical detail, respect communication preferences, consider objections and take additional care where children or vulnerable patients are involved. Reminder and recall information is not used for promotional marketing. | Health or social care |
| Clinical records and diagnosis | Clinical notes, diagnoses, radiographs, scans and relevant images | Consent; Legal obligation; Public task or official authority. We create and maintain clinical records—including medical histories, examinations, diagnoses, radiographs, treatment plans, consent discussions and treatment provided—to deliver safe and continuous dental care. Contract applies where this processing is necessary for requested private dental care. Public task applies where we provide NHS dental care under the applicable NHS statutory and contractual framework. Legal obligation applies where creating, retaining or disclosing records is required by applicable law and professional regulatory requirements. Health information is processed where necessary for diagnosis, treatment and management of dental care by professionals and staff subject to duties of confidentiality. | Health or social care |
| Complaints, claims and legal matters | Clinical, correspondence, incident, complaint and claim records | Contract or steps requested before a contract; Legal obligation; Public task or official authority. We create and maintain clinical records—including medical histories, examinations, diagnoses, radiographs, treatment plans, consent discussions and treatment provided—to deliver safe and continuous dental care. Contract applies where this processing is necessary for requested private dental care. Public task applies where we provide NHS dental care under the applicable NHS statutory and contractual framework. Legal obligation applies where creating, retaining or disclosing records is required by applicable law and professional regulatory requirements. Health information is processed where necessary for diagnosis, treatment and management of dental care by professionals and staff subject to duties of confidentiality. | Health or social care |
| Direct marketing | Contact details, channel choices and suppression records | Consent | Not applicable |
| NHS claims and administration | Identity, treatment, clinical and administration information | Legal obligation; Public task or official authority. We process patient identification, NHS treatment and claim information to submit and manage NHS dental claims, receive payment, support claim verification and meet NHS reporting and administration requirements. Public task applies where this processing supports the provision and administration of NHS dental services under the NHS statutory framework. Legal obligation applies where information must be recorded, retained or submitted under applicable NHS dental legislation and statutory contract requirements. Health information is processed where necessary for the provision and management of NHS dental care and healthcare services by professionals and staff subject to duties of confidentiality. | Health or social care |
| Patient registration and administration | Identity, contact, appointment and administrative information | Contract or steps requested before a contract; Public task or official authority. We collect and maintain patient identity, contact, registration, eligibility and administrative information to arrange and manage dental care. Contract applies where registration and administration are necessary to take requested steps or provide private dental services. Public task applies where this processing is necessary to register and administer patients receiving NHS dental services under the applicable NHS statutory and contractual framework. Where registration includes medical history, accessibility requirements or other health information, it is processed where necessary to arrange and manage dental care by professionals and staff subject to duties of confidentiality. | Health or social care |
| Payments, insurance and finance | Identity, treatment, payment, plan, insurance or finance information | Contract or steps requested before a contract; Legal obligation. We process patient identity, contact, billing, payment, insurance and plan information to calculate charges, collect payments, issue invoices and receipts, administer payment or insurance arrangements and maintain financial records. Contract applies where this processing is necessary to provide and receive payment for requested private dental services or administer an agreed payment arrangement. Legal obligation applies to accounting, taxation and other financial records that the practice is required to maintain. Payment-card transactions are handled through authorised payment providers, and we use only the information necessary for the transaction. | Not applicable |
| Prescriptions and medicines | Identity, clinical, allergy, prescription and medicines information | Contract or steps requested before a contract; Legal obligation; Public task or official authority. We process patient identity, medical history, allergies, diagnoses, current medication, prescription and administration information to assess whether medicines are suitable, prescribe or administer them safely, communicate with pharmacies where necessary and maintain appropriate clinical records. Contract applies where this processing is necessary for private dental treatment. Public task applies where medicines are prescribed or administered as part of NHS dental care under the applicable NHS statutory framework. Legal obligation applies to applicable prescribing, medicines-management and record-keeping requirements. Health information is processed where necessary for diagnosis and the safe provision and management of dental care by professionals and staff subject to duties of confidentiality. | Health or social care |
| Providing dental care | Dental and medical history, findings, treatment plans and care records | Contract or steps requested before a contract; Public task or official authority. We process patient identity, contact, medical history, oral-health information and treatment information where necessary to assess needs and provide safe dental care. Contract applies where processing is necessary to take steps requested by a patient or provide private dental treatment under our agreement with them. Public task applies where processing is necessary to provide NHS dental care under the applicable NHS statutory and contractual framework. Health information is processed where necessary for diagnosis, treatment and management of dental care by professionals and staff subject to duties of confidentiality. | Health or social care |
| Referrals and care coordination | Contact details and relevant clinical and referral information | Contract or steps requested before a contract; Public task or official authority. We process and share limited patient identity, contact, medical, dental and referral information where necessary to make and receive referrals and coordinate care with other dental professionals, general practitioners, hospitals, laboratories and other healthcare providers involved in the patient’s care. Contract applies where referral and coordination are necessary for requested private dental care. Public task applies where this processing supports NHS dental care under the applicable NHS statutory and contractual framework. Health information is processed where necessary for diagnosis, treatment and coordination of care by professionals and staff subject to duties of confidentiality. We share only information relevant to the referral or coordinated care. | Health or social care |
| Safeguarding and vital interests | Relevant identity, contact, clinical and risk information | Legal obligation; Vital interests. We process and, where necessary, share limited personal and health information to identify, assess and respond to safeguarding concerns involving children and adults at risk. Legal obligation applies where safeguarding law or applicable professional duties require the practice to record, use or disclose relevant information. Substantial public interest applies to special-category information where processing is necessary and proportionate to safeguard a child or an individual at risk under the applicable Data Protection Act 2018 condition. Vital interests applies only where processing is necessary to protect someone’s life and the person is physically or legally unable to give consent. Information is restricted to what is relevant and shared only with appropriate professionals or authorities that need it. | Substantial public interest; Vital interests |
| Testimonials and promotional media | Testimonials, images, recordings and permission records | Consent. We use identifiable patient testimonials, photographs, videos or before-and-after images for promotional purposes only where the patient has given separate, specific, informed and freely given consent. Explicit consent is obtained where the material reveals treatment or other health information. Consent identifies the material, purpose and publication channels covered. Promotional consent is not a condition of receiving NHS or private dental care, is recorded separately from treatment consent and may be withdrawn. Following withdrawal, we stop new use and remove material from channels under our control where reasonably possible, subject to any limitations explained when consent was obtained. | Explicit consent |
| Website enquiries | Contact details and the information provided in the enquiry | Consent. We use identifiable patient testimonials, photographs, videos or before-and-after images for promotional purposes only where the patient has given separate, specific, informed and freely given consent. Explicit consent is obtained where the material reveals treatment or other health information. Consent identifies the material, purpose and publication channels covered. Promotional consent is not a condition of receiving NHS or private dental care, is recorded separately from treatment consent and may be withdrawn. Following withdrawal, we stop new use and remove material from channels under our control where reasonably possible, subject to any limitations explained when consent was obtained. | Explicit consent |
Clinical sharing and other recipients
Within the practice, authorised team members use information according to their roles. Where necessary, we may share relevant information with other healthcare professionals involved in your care and with service providers working under appropriate terms. Confirmed modules below explain referrals, laboratories and other particular recipients. We share the minimum information reasonably needed and do not say that every regulator routinely receives patient information.
Legal, safeguarding and regulatory disclosures
We may disclose information where this is required or permitted by law, including where necessary for safeguarding, responding to a court or lawful authority, investigating a complaint, handling a claim or meeting a specific professional or regulatory duty. Whether disclosure is appropriate depends on the circumstances. Regulators do not routinely receive every patient's information.
How long we keep information
We keep different categories of information for the periods or according to the criteria confirmed by the practice and shown below. Clinical records are not the same as website enquiries. We may retain information longer where a complaint, incident, claim, investigation or legal hold requires it. Documentary periods here do not operate deletion in an external practice-management system.
Adult patient clinical records: Retain adult dental clinical records for 11 years from the date of the last entry or last attendance. At the end of that period, review and securely destroy the record if it is no longer required. Retain it longer where there is an active complaint, claim, investigation, litigation hold, public inquiry, continuing course of care or another documented clinical or legal reason. Record the review and any destruction decision..
Appointment and communication records: Retain appointment diaries, booking histories and routine administrative communication records for 2 years after the end of the year to which they relate, provided all information relevant to diagnosis, treatment, consent, complaints or continuing care has been transferred to the patient’s clinical record. Communications forming part of the dental clinical record—including clinically relevant emails, messages and correspondence—are retained with that record for 11 years from its last entry. Routine reminders, duplicate messages and delivery logs may be deleted earlier when their operational purpose has ended and they are not required for a complaint, claim, audit or investigation. At expiry, review and securely destroy records that are no longer required, recording material destruction decisions..
CCTV: CCTV footage is retained for 30 days from the date of recording and then automatically overwritten or securely deleted. Where footage records a specific security incident, accident, complaint or suspected crime, the relevant extract may be retained separately only for as long as necessary to investigate and resolve the matter, respond to a lawful authority request or deal with related proceedings. Extended retention must be documented and reviewed, and the footage must be securely deleted when no longer required..
Child patient clinical records: Retain until the later of 11 years after the last clinical entry or the patient’s 25th birthday. If the patient was 17 when treatment ended, retain until at least their 26th birthday. At the end of the period, review before confidential destruction. Retain longer where required for ongoing care, a complaint, claim, investigation, safeguarding matter, inquiry or legal hold..
Odinma website enquiries (website-enquiry retention): 90 days.
Payment, accounting and tax records: Retain invoices, receipts, bank and card-payment records, ledgers, tax calculations, returns and supporting accounting records for 6 years after the end of the financial year or accounting period to which they relate. Retain records longer where they concern a transaction spanning multiple periods, a capital asset still owned by the practice, a late return, an unresolved debt, an HMRC compliance check, investigation, dispute or legal hold. At expiry, review and securely destroy records no longer required..
Security and confidentiality
We use proportionate organisational and technical measures designed to protect personal information from accidental loss, misuse, alteration, unauthorised access or disclosure. Measures include role-based access, staff confidentiality, supplier controls, secure disposal and appropriate system safeguards. No system or internet transmission can be guaranteed completely secure.
International transfers
Personal information submitted through this website is primarily stored and hosted in the United Kingdom. Our website platform provider, Odinma Dental Pages, hosts the primary application and database in DigitalOcean’s London region. DigitalOcean, LLC is based in the United States and uses authorised subprocessors located outside the UK, including in the United States, for services such as infrastructure and backups, platform security, troubleshooting and support. Personal information may therefore be transferred to, or accessed from, outside the UK. These transfers are governed by applicable data-processing agreements. For relevant transfers to the United States, DigitalOcean currently relies on the UK Extension to the EU–US Data Privacy Framework. If that mechanism becomes unavailable, DigitalOcean’s Data Processing Agreement provides for the UK Addendum to the EU Standard Contractual Clauses. DigitalOcean also requires its subprocessors to meet appropriate data-protection obligations. You may contact us using the details in this privacy notice to request further information about these safeguards or a copy of the relevant contractual safeguards.
Your data-protection rights
Depending on the circumstances and the lawful basis, you may have rights to access, correct, erase, restrict or object to use of your information and to receive certain information in a portable form. You may withdraw consent where a purpose relies on consent. Some rights are limited by law; for example, erasure may not apply where clinical records must be retained or information is needed for legal claims. Contact us to make a request.
Children and representatives
Our dental services are available to children and young people. We may receive a child’s personal information through this website when a child, parent, guardian or other authorised person contacts us about an enquiry or possible dental care. This may include the child’s name, contact and appointment information, and any dental or health information included in the enquiry. We use this information only where necessary to respond to the enquiry, arrange or provide dental care, meet our legal and professional responsibilities, safeguard the child, or establish or defend legal claims. The lawful bases and additional condition for health information described elsewhere in this notice also apply where the information concerns a child. We consider the child’s best interests, age, understanding and confidentiality when using their information. A parent or guardian may act for a child where appropriate, but children have their own data-protection rights. Where a child is capable of understanding and exercising those rights, we will take the child’s wishes into account. We do not sell children’s personal information, use it for behavioural advertising or profiling, or use a child’s dental or health information for direct marketing. We do not knowingly send direct marketing to children. Children, parents and guardians may contact us using the details in this notice to ask questions or exercise applicable data-protection rights.
Data-protection concerns and complaints
If you believe that we have not handled your personal information properly or have not complied with data-protection law, you may make a data-protection complaint using the contact details below. Please describe your concern and provide any information reasonably needed for us to investigate it. Please do not send unnecessary health information. We will acknowledge receipt of your complaint within 30 days. We will investigate it without undue delay, keep you appropriately informed of progress and explain the outcome of our investigation. You also have the right to complain to the Information Commissioner’s Office (ICO). Contacting us first does not affect that right. Information Commissioner’s Office Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF Telephone: 0303 123 1113 Website: https://ico.org.uk/make-a-complaint This section concerns complaints about the use of personal information. Complaints about dental treatment or another aspect of our clinical service are handled under our separate patient complaints procedure.
Changes to this notice
We keep this privacy notice under regular review and may update it when our services, use of personal information, suppliers or legal obligations change. If we intend to use personal information for a materially different purpose, we will update this notice before starting that processing and, where required, take reasonable steps to bring the change to the attention of affected individuals. This notice was last updated on 5 August 2026. Previous versions are available from us on request.
Contact us about privacy
Write to us at 177 Medomsley Road, Consett, Durham, DH8 5HU.
Email: [email protected]
Website: https://270dental.com
NHS dental services
When providing NHS dental services, we use relevant patient, clinical and administrative information to deliver care and complete applicable NHS administration, claims and submissions. We share it with the relevant NHS bodies only where necessary for those functions. The confirmed purpose table states the lawful basis selected for this processing.
Private dental services
For private dental services, we use relevant clinical, contact and administrative information to take requested steps, provide care, manage the patient relationship and meet applicable professional duties. The confirmed purpose table states the basis used for each purpose.
Referrals and specialists
When we send or receive a referral, we may share or receive contact details, relevant history, clinical findings, images and the reason for referral with the referring or receiving healthcare professional. We limit this to information reasonably needed for assessment, care and coordination.
Dental laboratories
We provide dental laboratories with the minimum patient, clinical and order information needed to make or repair an appliance or restoration and to resolve related queries. The laboratory may act as our processor or have its own professional responsibilities, depending on the arrangement.
Prescriptions and medicines
We use relevant identity, clinical, allergy and medicines information to prescribe, administer and review medicines safely, keep required records and communicate with pharmacies or other healthcare professionals where necessary.
Radiographs, scans and clinical images
We create and use radiographs, scans and clinical photographs where needed for assessment, diagnosis, treatment planning, treatment, monitoring and the clinical record. We share them only where necessary for care or another confirmed purpose and retain them according to the clinical-image category below.
Payments, plans and insurance
We use identity, contact, treatment and payment information to take payment, administer a plan, submit or answer an insurance claim, keep accounts and prevent or resolve payment errors. We share only the information needed with payment providers, plan administrators, insurers, accountants or tax authorities as applicable. We do not claim to store full card details unless the practice has confirmed that separately.
Treatment finance
If you ask about treatment finance, we may introduce you to a finance provider and pass information you have agreed is needed for the application. The finance provider normally makes its own decisions as a separate controller and provides its own privacy information. Any applicable credit-broker relationship should be explained before you apply.
Reminders and recalls
We use contact and appointment information to send reminders, recalls and other service messages by the channels the practice has confirmed. These messages support care and appointment administration; they are separate from promotional direct marketing. We respect communication preferences where applicable.
Direct marketing
We may use your name and contact details to send you information about our dental services, practice news, appointment availability and offers, but only where you have chosen to receive that marketing. Our lawful basis for using your personal information for direct marketing is consent. Where marketing is sent by email, text message or another form of electronic communication, we also comply with the Privacy and Electronic Communications Regulations 2003. Marketing consent is optional, is requested separately from consent to treatment or other matters, and is not a condition of receiving dental care. We record when and how you gave consent and what you were told at the time. We retain your marketing details until you withdraw consent or we determine that the information is no longer required. We review marketing permissions periodically. After you opt out, we may retain your contact details on a suppression list for 90 days, so that we can continue to respect your preference. You may withdraw consent or object to direct marketing at any time by using the unsubscribe method in a message or by contacting us using the details in this notice. We will stop using your information for direct marketing without undue delay. We do not sell personal information or disclose it to another organisation for that organisation’s own marketing. Service providers that help us distribute communications may process information only on our instructions and subject to appropriate contractual obligations. We do not use information about your dental treatment, medical history or health to select or personalise marketing. We would only use health information for marketing if we first obtained your separate, explicit consent for that specific purpose. We do not knowingly send direct marketing to children.
Testimonials and promotional images
We use a testimonial or identifiable patient image for promotion only with separate, specific permission that explains the intended channels and context. Withdrawing permission stops future use where withdrawal applies, but may not undo material already lawfully published or distributed.
Online booking and patient portal
Our confirmed online booking or patient-portal service uses the contact, appointment and other information needed to provide the service. The provider, data flow, access arrangements and any overseas processing must be reviewed by the practice; you may ask us for current provider details.
CCTV
We use CCTV only in the locations and for the security purposes confirmed by the practice. Signs provide immediate notice. Access is restricted, footage is retained for the confirmed CCTV period below and may be disclosed where necessary to investigate an incident or comply with law. This wording does not assume that cameras operate in treatment rooms.
Call recording
Where calls are recorded, callers are told and the practice uses recordings only for the confirmed purposes. Access is restricted and recordings are kept for the confirmed call-recording period below.
Safeguarding
We may use and disclose relevant information where necessary to protect a child or adult at risk. We consider the circumstances, share only what is needed and rely on the confirmed lawful basis and applicable substantial-public-interest, health-care or vital-interests condition.
Complaints, claims and indemnity
We may use and share relevant records with indemnity providers, insurers, legal advisers, experts or other parties where necessary to investigate a complaint, respond to an incident, establish or defend a legal claim or meet an insurance obligation. Legal holds may extend ordinary retention.
Overseas processing safeguards
A confirmed supplier may process or access information outside the UK. The practice reviews the destination or destination category and uses an applicable transfer mechanism and safeguards, such as adequacy regulations or approved contractual protections, where required. Contact us for details relevant to a particular transfer.