Privacy Notice
Last updated: 9 October 2026
Who we are
Waterloo Dental & Orthodontics, 223 Waterloo Road, London SE1 8XH, is the data controller for the personal information we hold about you. We are registered with the Information Commissioner’s Office (ICO), registration reference ZB823947.
If you have any questions about this notice or your information, contact our Practice Manager, Zhazira Vyas (Zee), on 020 7928 5844 or at info@waterloodental.co.uk.
What information we hold
- Your details: name, address, date of birth, phone numbers, email, and next of kin or parent/guardian details for children.
- Your health information: your medical history, dental records, X-rays, photographs, scans, treatment plans, and letters to and from other healthcare professionals.
- Payment information: fees, practice plan and payment plan details, finance applications, and NHS exemption details. Card payments are processed by our payment providers (such as Stripe); we do not store full card numbers.
- Messages and enquiries: what you send us through our website forms, by email, phone, WhatsApp or social media. If you accept cookies, we also collect information about how you use our website (see “Cookies and our website”).
Health information is “special category” data under UK data protection law, and we protect it accordingly.
Why we use it, and our legal basis
| Purpose | Legal basis (UK GDPR) |
|---|---|
| Providing your dental and orthodontic care, keeping accurate records, and communicating with you about appointments and treatment | Article 6(1)(e) public task (NHS care) or 6(1)(b) contract (private care); Article 9(2)(h) provision of health care |
| Referrals to and from other dentists, hospitals and your GP | As above, Article 9(2)(h) |
| NHS claims and payment (NHS Business Services Authority), and NHS audits | Article 6(1)(c) legal obligation; Article 9(2)(h) |
| Taking payments, practice plans, finance and keeping accounts | Article 6(1)(b) contract; 6(1)(c) legal obligation |
| Answering enquiries sent through our website, phone, WhatsApp or social media | Article 6(1)(b), steps you ask us to take before treatment |
| WhatsApp check-ins after your visit, feedback and review requests, and marketing messages, only if you have agreed | Article 6(1)(a) consent. You can withdraw it at any time by replying STOP or telling us |
| Website analytics and advertising cookies, only if you accept them | Consent (PECR and Article 6(1)(a)) |
| Safeguarding, legal claims, and meeting CQC and GDC requirements | Article 6(1)(c) legal obligation; Article 9(2)(h), (f) and (g) as relevant |
Who we share it with
Only when needed, and only the minimum required:
- other healthcare professionals involved in your care (your GP, hospitals, specialists, dental laboratories);
- the NHS Business Services Authority and NHS England / NHS South East London, for NHS treatment;
- our practice management system (Dentally), and IT, email, messaging (including WhatsApp), website and payment providers who process data for us under contract;
- regulators (CQC, GDC) and our professional indemnity providers, when required;
- anyone else only with your permission, or where the law requires it (for example, safeguarding).
We do not sell your information.
Cookies and our website
When you first visit our website we ask which cookies you accept. Analytics (Google Analytics) and advertising cookies (Meta/Facebook, Google Ads) are only used if you agree. You can change your choice at any time using “Manage consent” at the bottom of any page. See our Cookie Policy.
Please don’t send detailed medical information through our website forms, WhatsApp or social media. If you’re in pain or worried, call us on 020 7928 5844, or NHS 111 out of hours.
How long we keep it
- Dental records (adults): at least 11 years after your last treatment.
- Dental records (children): until age 25, or 11 years after the last treatment, whichever is longer.
- Orthodontic records and models: in line with NHS and professional guidance.
- Financial records: 6 years.
- Website and WhatsApp enquiries that don’t lead to treatment: up to 12 months.
Your rights
You have the right to:
- ask for a copy of your information (a “subject access request”), free of charge, normally within one month;
- ask us to correct anything that is wrong;
- ask us to delete or restrict your information, where the law allows (we must keep health records for the periods above);
- object to how we use your information, and withdraw consent for messages or marketing at any time;
- ask for your information to be transferred to another provider.
To make a request, contact our Practice Manager, Zhazira Vyas (Zee), on 020 7928 5844 or at info@waterloodental.co.uk.
Keeping your information safe
Records are held on secure, password-protected systems with restricted access. Staff are trained in confidentiality and data protection.
Complaints about how we use your information
Please contact us first. You can also complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint, 0303 123 1113, Wycliffe House, Water Lane, Wilmslow SK9 5AF.