Security

Full Technical Privacy Statement

Registered Name: West House Partnership Ltd
Data Controller: West House Dental
Data Protection Officer: Shabnam Zai

This document provides a comprehensive technical breakdown of the personal data we collect, our purposes for processing, and the legal bases we rely upon under the UK GDPR and Data Protection Act 2018.

1. Contact Details

• Address: 2nd Floor, West House, 50 West End Lane, Pinner, Middx, HA5 1AE, GB
• Telephone: 020 8866 3025
• Email: hello@westhousedental.com / privacy@westhousedental.com

2. Data Processing Activities

A. Patient Care & Services

Purpose: To provide patient care, dental services, pharmaceutical products, and other goods.

• Data Collected: Name, contact details, gender, pronouns, DOB, NHS/HSC/CHI number, Hospital number, Next of Kin, emergency contacts, photographs, health info (medical history, allergies), care needs, test results (scans, X-rays, bloods), insurance details, and records of decisions.
• Lawful Bases: * Consent: Explicit permission for specific treatments.
  • Contract: Necessary to provide requested services.
  • Legal Obligation: Compliance with healthcare regulations.
  • Legitimate Interest: Ensuring safe, effective, and compliant dental care.
  • Public Task: Carrying out tasks laid down in law for healthcare.

B. Crime Prevention & Detection

Purpose: Prevention, detection, investigation, or prosecution of crimes (including fraud).

• Data Collected: Name, contact details, witness statements, previous investigation info, financial info, and health info.
• Lawful Bases:
  • Legal Obligation (Art 6(1)(c)): Cooperation with law enforcement.
  • Substantial Public Interest (Art 9(2)(g)): Processing health data for crime prevention.
  • Legitimate Interests (Art 6(1)(f)): Use of CCTV for safety/theft prevention.

C. Safeguarding & Public Protection

Purpose: Protecting children or vulnerable adults at risk of harm.

• Data Collected: Contact details, NHS number, emergency contacts, photographs, health info, care needs, test results, and meeting records.
• Lawful Bases:
  • Legal Obligation: Reporting duties under the Children Act 1989/Care Act 2014.
  • Vital Interests: Protecting life in emergencies.
  • Public Task: Working with social services.
  • Substantial Public Interest: Safeguarding individuals at risk.

D. Patient App & Portal Functionality

Purpose: Providing secure digital access to appointments and records.

• Data Collected: Names, addresses, contact details, medical history, account registration, security logs, and marketing preferences.
• Lawful Bases:
  • Contract: Delivering the requested digital service functionality.
  • Consent: Optional features like health reminders.
  • Legitimate Interests: Maintaining system security and usability.

E. Recruitment

Purpose: Assessing suitability for roles within the practice.

• Data Collected: Contact details, DOB, NI number, ID copies (Passport), employment/education history, Right to Work info, DBS checks, and health info.
• Lawful Bases:
  • Legitimate Interests: Managing recruitment efficiently.
  • Pre-contractual Steps: Arranging interviews and terms.
  • Legal Obligation: Verifying right to work and DBS status.

F. Marketing & Research

Purpose: Providing updates, promotional information, or conducting market research.

• Data Collected: Names, contact details, marketing preferences, website/app user journey, and health info.
• Lawful Bases:
  • Consent: Active opt-in for marketing communications.
  • Legitimate Interests: Keeping patients informed about relevant new services.
  • Contract: Communications related to ongoing treatments (e.g., reminders).

G. Medical Research & Archiving

Purpose: Retaining records for long-term health trends or historical archiving.

• Data Collected: Names, contact details, X-rays, scans, photographs, and consent records.
• Lawful Bases:
  • Legal Obligation: Mandatory retention periods for clinical records.
  • Public Interest (Public Health): Advancing medical knowledge.
  • Scientific/Historical Research: Ethical research with appropriate safeguards.

H. Queries, Complaints & Claims

Purpose: Resolving patient concerns and managing legal claims.

• Data Collected: Contact details, service history, witness statements, financial transactions, correspondence, and health info.
• Lawful Bases:
  • Contract: Managing queries related to services received.
  • Legal Obligation: Responding to regulatory investigations (GDC/CQC).
  • Legitimate Interests: Resolving disputes and ensuring high standards.

3. Your Data Protection Rights

Under UK law, you have the following rights:

1. Right of Access: Request copies of your personal information.
2. Right to Rectification: Correct inaccurate or incomplete data.
3. Right to Erasure: Request deletion (subject to medical record retention laws).
4. Right to Restriction: Limit how we use your data.
5. Right to Object: Object to processing (e.g., for marketing).
6. Right to Data Portability: Transfer your data to another provider.
7. Right to Withdraw Consent: Revoke permission at any time.

To exercise these rights, please contact privacy@westhousedental.com. You also have the right to complain to the Information Commissioner’s Office (ICO) if you are unhappy with how we use your data.

Last updated: 10 February 2025