Privacy notice

This privacy notice tells you what to expect us to do with your personal information when you contact us or use our services.

You can find more detailed information about how we your information for the following specific purposes on the Dental CIC website.

Our contact details

Name: University of Suffolk Dental CIC

Address: Waterfront Building, Neptune Quay, Ipswich, IP41QJ

General phone number: 01743 957010

General inquiries email address: dentalcic@uos.ac.uk

We are the controller for your information. A controller decides on why and how information is used and shared.

Data Protection Officer contact details

Our Data Protection Officer is Fiona Fisk and is responsible for monitoring our compliance with data protection requirements. You can contact them with queries or concerns relating to the use of your personal data at datagovernance@uos.ac.uk.

How do we get information and why do we have it?

The personal information we collect is provided directly from you for one of the following reasons:

● you have provided information to seek care – this is used directly for your care, and also to manage the services we provide, to clinically audit our services, investigate complaints, or to be used as evidence as part of an investigation into care
● you have sought funding for continuing health care or personal health budget support
● you have applied for a job with us or work for us
● you have signed up to our newsletter/patient participation group
● you have made a complaint
● you are making payment for treatment

We also receive personal information about you indirectly from others, in the following scenarios:

● from other health and care organisations involved in your care so that we can provide you with care
● from family members or carers to support your care
● you have been referred to the University of Suffolk Dental CIC through a third party, such as 111.

What information do we collect?

Personal information

We currently collect and use the following personal information: [delete or add to list as appropriate]

● personal identifiers and contacts (for example, name and contact details, NHS number, date of birth)
● family details such as next of kin, and details of any guardians, carers and representatives.
● health data such as medical and dental histories, lifestyle questions (e.g. alcohol and tobacco use), x-rays, clinical photographs, digital scans of your mouth and teeth, study models, treatment plans, patient understanding exercises, recorded communications (e.g. voice messages, video calls, instant messages, letters and emails), clinical notes made by our clinical staff and other dental professionals involved in your care and treatment, information of any health and safety incident you have been involved in.
● details of any payments you make or need to make to us, your debit and credit card information, and if applicable, your bank account details.
● data about your use of our websites such as your IP address, your login data, details about your browser, length of visit to pages on our website, page views and navigation paths, details about the number of times you use our website, time zone settings and other technology on the devices you use to access our website.
● general personal data contained in emails and letters
● where required, we may need to ask about your occupation, hobbies, state benefit status, whether you are pregnant/new mother and whether you’re a pensioner or student on a low income.
● where relevant to your care, we may need to process your ethnicity and language.
● we may need to ask about religious and philosophical beliefs where relevant to your care, such as fasting or abstaining from certain types of treatments

More sensitive information

We process the following more sensitive data (including special category data):

● data concerning physical or mental health (for example, details about your appointments or diagnosis)
● data revealing racial or ethnic origin
● genetic data
● biometric data (where used for identification purposes)
● data revealing religious or philosophical beliefs
● data relating to criminal or suspected criminal offences

Who do we share information with?

We may share information with the following types of organisations:

● third party data processors (such as IT systems suppliers, clinical care systems suppliers)
● planners of health and care services (such as Integrated Care Boards)
● health and care regulators such as CQC
● hospitals
● emergency services such as 111
● community care teams
● care homes

In some circumstances we are legally obliged to share information. This includes:

● when required by NHS England to develop national IT and data services
● when reporting some infectious diseases
● when a court orders us to do so
● where a public inquiry requires the information

We will also share information if the public good outweighs your right to confidentiality. This could include:

● where a serious crime has been committed
● where there are serious risks to the public or staff
● to protect children or vulnerable adults

We may also process your information in order to de-identify it, so that it can be used for purposes beyond your individual care whilst maintaining your confidentiality. These purposes will include to comply with the law and for public interest reasons.

What is our lawful basis for using information?

Personal information

Under the UK General Data Protection Regulation (UK GDPR), the lawful basis we rely on for using personal information is:

We have your consent – this must be freely given, specific, informed and unambiguous. This would apply to cookies collected on the Dental CIC website.

We need it to perform a public task – a public body, such as an NHS organisation or Care Quality Commission (CQC) registered social care organisation, is required to undertake particular activities by law. See this list for the most likely laws that apply when using and sharing information in health and care.

More sensitive data

Under UK GDPR, the lawful basis we rely on for using information that is more sensitive (special category):

To provide and manage health or social care (with a basis in law). See this list for the most likely laws that apply when using and sharing information in health and care.

To manage public health (with a basis in law). See this list for the most likely laws that apply when using and sharing information in health and care.

Common law duty of confidentiality

In our use of health and care information, we satisfy the common law duty of confidentiality because:

● you have provided us with your consent (we have taken it as implied to provide you with care, or you have given it explicitly for other uses)
● we have a legal requirement to collect, share and use the data
● for specific individual cases, we have assessed that the public interest to share the data overrides the public interest served by protecting the duty of confidentiality (for example sharing information with the police to support the detection or prevention of serious crime). This will always be considered on a case by case basis, with careful assessment of whether it is appropriate to share the particular information, balanced against the public interest in maintaining a confidential health service

How do we store your personal information?

Your information is securely stored for the time periods specified in the Records Management Code of Practice and our own data retention schedules. We will then dispose of the information as recommended by the Records Management Code for example we will:

● securely dispose of your information by deleting data at the end of the retention period and wiping hard drives to legal standards of destruction.

What are your data protection rights?

Under data protection law, you have rights including:

Your right of access – You have the right to ask us for copies of your personal information (known as a subject access request).

Your right to rectification – You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.

Your right to erasure – You have the right to ask us to erase your personal information in certain circumstances.

Your right to restriction of processing – You have the right to ask us to restrict the processing of your personal information in certain circumstances.

Your right to object to processing – You have the right to object to the processing of your personal information in certain circumstances.

Your right to data portability – You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.

Please contact us at datagovernance@uos.ac.uk know if you wish to make a request.

Automated decision making

We may use your information to make automated decisions without human involvement, which could have substantial impact on a person, for example in staff recruitment or staff rostering. We may also use profiling, which refers to the use of personal data to predict things such as an individual’s health.

National data opt-out

● we are applying the national data opt-out because we are using confidential patient information for planning or research purposes

The information collected about you when you use health and care services can also be used and provided to other organisations for purposes beyond your individual care, for instance to help with:

● improving the quality and standards of care provided
● research into the development of new treatments
● preventing illness and diseases
● monitoring safety
● planning services

This may only take place when there is a clear lawful basis to use this information. All these uses help to provide better health and care for you, your family and future generations. Confidential health and care information is only used like this when allowed by law.

Whenever possible data used for research and planning is anonymised, so that you cannot be identified and your confidential information is not accessed.

You have a choice about whether you want your confidential information to be used in this way. If you are happy with this use of information you do not need to do anything. If you do choose to opt out your confidential information will still be used to support your individual care.

To find out more or to register your choice to opt out, please visit www.nhs.uk/your-nhs-data-matters.

You can change your mind about your choice at any time.

Data being used or shared for purposes beyond individual care does not include your data being shared with insurance companies or used for marketing purposes and data would only be used in this way with your specific agreement.

How do I complain?

If you have any concerns about our use of your personal information, you can make a complaint to us at datagovernance@uos.ac.uk.

Following this, if you are still unhappy with how we have used your data, you can then complain to the ICO.

The ICO’s address is:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline number: 0303 123 1113

ICO website: https://www.ico.org.uk

Date of last review

27.02.2024