Patient Privacy & Data Protection Policy

1. Identity of the Data Controller

The Data Controller responsible for the processing of your personal and special category healthcare data is Lumina Dental Studio, situated at 18 Harley Crescent, Suite 4B, The Pavilion, London W1G 9PL, United Kingdom.

For questions concerning patient data rights, contact our appointed Data Protection Officer at: concierge@luminadental.example.com.

2. Categories of Information Collected

To provide safe, clinically appropriate aesthetic and restorative dental treatment, we process:

• Demographic Information: Full name, date of birth, residential address, telephone number, and email.
• Special Category Health Data: Medical history, allergies, prescription medications, past dental surgeries, periodontal status, and emergency contact details.
• Diagnostic Records: 3D Cone Beam CT scans, intraoral 3D optical scans (TRIOS 5), digital radiographs (X-rays), and clinical study models.
• Photographic Documentation: High-definition facial, smile, and intraoral portrait photographs. Clinical photographs used for external education or marketing require separate, explicit written consent.
• Appointment Enquiry Submissions: Data provided through our online website consultation forms.

3. Lawful Basis for Processing

We process patient data under the following legal bases under Article 6 and Article 9 of the UK GDPR:

• Article 6(1)(b) – Contract: Taking necessary steps prior to entering into a clinical treatment plan and providing agreed private care.
• Article 9(2)(h) – Health & Social Care: Processing necessary for the provision of healthcare or medical diagnosis by registered dental professionals bound by professional confidentiality (GDC standards).
• Article 6(1)(a) – Consent: For voluntary marketing communications, practice newsletters, or publishing photographic case demonstrations.

4. Retention of Dental Records

In compliance with dental regulatory standards, adult patient clinical records (including radiographs and treatment logs) must be retained for a minimum period of 11 years from the date of last treatment, or until the age of 25 (whichever is longer) in accordance with British Dental Association and GDC guidance.

5. Security of Healthcare Information

Patient records are stored in ISO 27001-certified, encrypted electronic health record systems. All communication with our digital scanning systems (e.g. 3Shape TRIOS) and dental laboratory partners utilizes TLS 1.3 encryption. Physical clinic suites feature biometric or coded access restricted strictly to licensed clinical personnel.

6. Your Rights as a Data Subject

Under data protection law, you hold rights including:

• Right of Access: You may request copies of your dental charts, treatment notes, and digital radiographs (Subject Access Request). These are provided free of charge within 30 days.
• Right of Rectification: You may request correction of any inaccurate or outdated information.
• Right to Restrict or Object: You may opt out of non-clinical communications at any time. (Note that legal obligations to maintain medical records take precedence over requests for complete clinical erasure).

7. Cookies & Analytical Technologies

Our website uses strictly necessary session cookies to maintain navigation state and form validation. We do not deploy invasive third-party ad-tracking cookies without your explicit cookie consent selection.

8. Supervisory Authority Contact

If you have unresolved concerns regarding how your data is handled, you maintain the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk or by telephoning 0303 123 1113.