Privacy Notice | Half Moon Dental

Patient Privacy Notice

1. About this Privacy Notice

Half Moon Dental Centre Limited is the data controller responsible for the personal information we hold about our patients.

We take the confidentiality, privacy and security of your information seriously.

This Privacy Notice explains:

• what personal information we collect;

• why we collect and use it;

• the legal basis on which we process it;

• how information submitted through our patient portal is used;

• how we use electronic dental records and digital clinical technology;

• how we use AI-assisted clinical note-taking and diagnostic-support software;

• how we use CCTV and audio recording;

• who we may share information with;

• how long we retain information;

• how we protect it; and

• your rights in relation to your personal information.

This notice applies to information collected through our dental practice, website, patient portal, telephone, email, online forms and other communications with us.

2. Information we hold about you

The information we collect will depend upon your relationship with the practice and the treatment or services you receive.

Personal and contact information

We may hold:

• your name;

• address;

• date of birth;

• telephone numbers;

• email address;

• patient identification number;

• next-of-kin or emergency-contact information;

• family or representative details;

• GP details where relevant;

• occupation where relevant; and

• other information needed to identify and communicate with you.

Medical and dental information

We may hold:

• your medical history;

• medications;

• allergies;

• relevant medical conditions;

• dental history;

• dental charting;

• periodontal records;

• clinical examination findings;

• diagnoses;

• clinical notes;

• treatment provided and proposed;

• treatment plans and estimates;

• prescriptions;

• referrals;

• correspondence with other healthcare professionals;

• consent records;

• dental radiographs;

• CBCT scans;

• clinical photographs;

• intraoral and optical scans;

• digital impressions;

• laboratory prescriptions; and

• other information necessary for the safe provision of your dental care.

Information concerning your health is special-category personal data and receives additional protection under data-protection law.

3. Administrative and financial information

We may also process:

• appointment information;

• recalls and reminders;

• treatment estimates;

• invoices;

• payments and transaction information;

• payment-plan or membership details;

• insurance information where relevant;

• treatment-finance information where applicable;

• correspondence with you; and

• details of complaints or concerns.

Where card payments are processed by a specialist payment provider, we do not normally retain complete payment-card details within your clinical dental record.

4. Information submitted through our patient portal

Our patient portal and online services allow you to interact with the practice electronically.

Depending upon the services you use, information processed through the portal may include:

• your name and contact information;

• date of birth and information used to identify you;

• account or authentication information;

• appointment requests and bookings;

• medical-history questionnaires;

• consent forms;

• treatment plans and estimates;

• forms completed before or after treatment;

• communications with the practice;

• information or documents you upload;

• payment information; and

• technical and security information associated with use of the portal.

Information provided through the patient portal may become part of your clinical dental record where it is relevant to your care.

Please ensure that the information you give us, particularly information concerning your medical history, medications and allergies, is complete and accurate and tell us when it changes.

5. Dentally and our electronic dental records

We use Dentally and associated digital services as part of our practice-management and electronic patient-record systems.

These systems may be used to process information concerning:

• your clinical dental record;

• medical history;

• appointments;

• recalls and reminders;

• treatment plans;

• consent;

• estimates;

• correspondence;

• radiographs and clinical images;

• invoices and payments;

• online patient forms; and

• communications connected with your care.

Your electronic dental record is accessed by members of the dental team who require access for your treatment or for the legitimate administration of your care.

We use appropriate contractual, confidentiality and data-protection arrangements with organisations that process personal information in connection with services they provide to us.

6. AI-assisted clinical note-taking and transcription

We use secure digital and artificial intelligence-assisted systems to help our clinicians produce accurate and contemporaneous clinical records.

Systems we may use include:

• Dentistry Dashboard;

• Kiroku;

• Heidi Health; and

• Dentally and associated clinical-documentation tools.

Depending upon the particular system being used, speech during or following your appointment may be processed or transcribed to help the clinician prepare:

• draft clinical notes;

• examination records;

• records of treatment discussions;

• correspondence;

• referral letters;

• treatment plans; or

• other clinical documentation.

The information processed may include details about your dental and medical health and may therefore contain special-category health information.

How we use AI-assisted notes

AI-assisted note-taking is used as a documentation aid.

It does not replace the professional judgement of your dentist or other clinician.

The treating clinician remains responsible for:

• reviewing the generated information;

• correcting inaccuracies;

• deciding what information is clinically relevant; and

• approving the final clinical record.

AI-generated draft notes are not treated as a definitive clinical record without appropriate clinician review.

Speech and audio processing

Where speech during a consultation is recorded or processed by an AI-assisted transcription system, we will explain this before using the system and seek your agreement.

You may ask us not to use AI-assisted transcription during your appointment.

Declining AI-assisted transcription will not affect the dental care or treatment available to you. Your clinician will make the clinical record using another appropriate method.

Depending upon the particular technology being used, audio may be processed temporarily to produce a transcription without a permanent audio recording being retained.

Where audio or draft transcripts are temporarily retained by a service provider, they will be handled in accordance with our confidentiality, security, retention and data-protection requirements.

We aim not to retain duplicate audio recordings or draft transcripts for longer than they are reasonably required for the purpose for which they were created.

7. Radiographs, photographs, CBCT and digital scans

Modern dental diagnosis and treatment frequently involves digital clinical information.

We may create, receive, use and retain:

• dental X-rays;

• CBCT scans;

• clinical photographs;

• intraoral scans;

• optical impressions;

• treatment-planning images; and

• other diagnostic information.

These records may be used for purposes including:

• diagnosis;

• treatment planning;

• provision of treatment;

• monitoring dental health;

• specialist consultation;

• referrals;

• communication with dental laboratories; and

• maintaining an appropriate clinical record.

Clinical photographs and images taken as part of your dental care may form part of your clinical record.

If we wish to use identifiable photographs, videos or other identifiable patient information for marketing, advertising, social media or another purpose unrelated to your direct care, we will obtain appropriate permission where required.

8. Artificial intelligence and diagnostic-support technology

We may use Pearl AI or other appropriately selected digital diagnostic-support technology to assist our clinicians when reviewing dental radiographs.

Such software may highlight areas on a radiograph that could warrant further assessment by the dentist.

Artificial intelligence is used as a clinical support tool. It does not replace the clinical examination or professional judgement of your dentist.

Your dentist remains responsible for:

• reviewing your radiographs;

• examining you;

• interpreting the available clinical information;

• making a diagnosis;

• discussing findings with you;

• explaining appropriate treatment options; and

• making treatment recommendations.

We do not rely upon Pearl AI or other diagnostic-support software to make treatment decisions about you without meaningful clinician involvement.

9. Why we use your personal information

We may process your information where necessary to:

• provide safe, appropriate and effective dental care;

• assess and diagnose dental and oral-health conditions;

• plan and provide treatment;

• maintain an accurate and contemporaneous clinical record;

• monitor your dental health;

• obtain and record consent;

• prescribe medication where appropriate;

• make and receive referrals;

• communicate with dental laboratories;

• manage appointments;

• send appointment reminders and recalls;

• communicate with you about your treatment;

• provide treatment plans and estimates;

• administer your account;

• process payments;

• administer dental-plan or membership arrangements;

• deal with questions, complaints or concerns;

• manage patient safety and safeguarding concerns;

• maintain clinical governance;

• meet professional, regulatory, legal and insurance obligations;

• establish, exercise or defend legal claims where necessary;

• prevent fraud or misuse;

• maintain the security of our premises, computer systems and services; and

• operate and administer the dental practice.

We aim to process only the information reasonably necessary for the relevant purpose.

10. Our legal basis for using your information

Data-protection law requires us to have an appropriate lawful basis for processing personal information.

The appropriate basis depends upon why the information is being processed.

Depending upon the circumstances, we may rely upon one or more of the following.

Contract

Where processing is necessary to provide dental treatment or another service you have requested, or to take steps at your request before providing that service.

Legal obligation

Where we need to process or retain information to comply with legal, professional or regulatory requirements.

Legitimate interests

Where processing is necessary for the legitimate operation, administration, security and clinical governance of the practice, provided that our interests do not override your rights and freedoms.

Consent

Where consent is the appropriate lawful basis, for example for certain optional uses of your information or certain marketing activities.

Where our processing relies upon consent, you may withdraw that consent.

Withdrawal of consent does not affect processing that lawfully took place before consent was withdrawn.

Vital interests

In exceptional circumstances, where processing is necessary to protect someone's life.

11. Health and special-category information

Medical and dental health information is special-category personal data.

An additional legal condition is therefore required before we can process it.

Where we process health information for the purposes of providing dental diagnosis, treatment or healthcare, we will generally rely upon the healthcare condition under Article 9(2)(h) of the UK GDPR, together with the relevant provisions of the Data Protection Act 2018.

This permits health information to be processed where necessary for purposes such as medical diagnosis and the provision or management of healthcare by professionals who are subject to appropriate duties of confidentiality.

Your consent to dental treatment is separate from the data-protection basis on which we process the information required to provide and document your healthcare.

12. Appointment reminders, recalls and service communications

We may contact you by:

• telephone;

• SMS;

• email;

• post; or

• our patient portal

about matters directly connected with your dental care or account.

This may include:

• appointment confirmations;

• appointment reminders;

• examination recalls;

• hygiene recalls;

• outstanding treatment;

• treatment plans;

• estimates;

• forms requiring completion;

• payment or account matters;

• follow-up after treatment; and

• other information relevant to your dental care.

These communications form part of administering your dental care and are different from promotional marketing.

13. Marketing communications

Where required by law, we will obtain appropriate permission before sending electronic direct-marketing communications.

You can ask us to stop sending marketing communications at any time.

Choosing not to receive marketing communications does not prevent us from contacting you about matters necessary for your:

• dental care;

• appointments;

• treatment;

• account;

• patient safety; or

• administration of services you have requested.

14. Who we may share your information with

We respect the confidentiality of your information and do not disclose it unnecessarily.

Where appropriate and lawful, we may share relevant information with:

• dentists, hygienists, therapists, dental nurses and other members of our dental team;

• specialist dentists;

• hospitals;

• your GP or other healthcare professionals where appropriate;

• referral centres;

• dental laboratories;

• providers of our practice-management and patient-portal systems, including Dentally;

• AI-assisted clinical-documentation providers, including Dentistry Dashboard, Kiroku and Heidi Health;

• radiography, imaging and diagnostic-support providers, including Pearl AI where used;

• IT, cybersecurity, data-storage, backup and hosting providers;

• payment-processing providers;

• dental payment-plan administrators;

• insurance companies where appropriate;

• treatment-finance providers where you have requested finance;

• professional indemnity organisations and insurers;

• accountants, auditors, solicitors and other professional advisers where necessary;

• debt-recovery or fraud-prevention services where appropriate;

• the General Dental Council and other professional or healthcare regulators where appropriate;

• NHS bodies or other public authorities where applicable;

• safeguarding authorities where necessary;

• police or law-enforcement authorities where disclosure is required or permitted by law; and

• another dental practice or healthcare professional where you ask us to transfer relevant information.

If ownership of the practice changes in the future, appropriate patient information may need to be transferred to a new practice owner, subject to appropriate confidentiality and data-protection safeguards.

We may also disclose relevant information where necessary to protect a patient or another person where we reasonably believe they may be at risk of serious harm or abuse.

We do not sell patient personal information or health information.

15. Dental laboratories and referrals

Where your treatment involves a dental laboratory, specialist or another healthcare provider, we may provide them with information reasonably necessary to provide that service.

This might include:

• your name;

• relevant medical information;

• clinical information;

• radiographs;

• photographs;

• digital scans;

• treatment requirements; and

• relevant correspondence.

We aim to share only the information reasonably necessary for the particular purpose.

16. Information received from other organisations or individuals

We may receive personal information about you from other sources, including:

• your previous dentist;

• another dental practice;

• your GP;

• a hospital;

• a specialist;

• another healthcare professional;

• a dental laboratory;

• an insurer;

• a dental payment-plan provider;

• a parent;

• a guardian;

• a carer;

• an authorised representative; or

• another organisation involved in your treatment or care.

Relevant information may be incorporated into your clinical record where necessary.

17. Children and young people

Children and young people have data-protection and confidentiality rights.

Where appropriate, privacy information will be explained in a way that is suitable for the child's age and understanding.

Depending upon the child's age, maturity, capacity and circumstances, information may be shared with or discussed with a person who has parental responsibility while also respecting the child's own confidentiality and legal rights.

We also provide a separate Children and Young People's Privacy Notice, written in clearer age-appropriate language.

18. CCTV and audio recording

We operate CCTV with audio recording in the reception and waiting room area of Half Moon Dental Centre.

The system is used for purposes including:

• maintaining the security of the practice;

• helping to prevent and detect crime;

• protecting patients, visitors, staff and property; and

• assisting with the investigation of appropriate safety or security incidents.

CCTV may therefore capture your image and, in areas where audio recording is enabled, conversations taking place within range of the system.

CCTV and audio recordings are not routinely viewed or listened to. Access is restricted to authorised individuals and recordings will only be accessed where there is an appropriate and legitimate reason to do so.

Where necessary and lawful, relevant recordings may be disclosed to organisations such as:

• the police or other law-enforcement authorities;

• insurers or indemnity providers;

• professional or legal advisers;

• regulatory authorities; or

• another appropriate organisation where disclosure is necessary and permitted by law.

How long CCTV recordings are kept

CCTV and associated audio recordings are normally retained for 30 days, after which they are automatically overwritten.

A particular recording may be retained for longer if it is required in connection with:

• a security or safety incident;

• suspected criminal activity;

• an investigation;

• an insurance matter;

• a legal claim;

• a regulatory matter; or

• another legitimate reason.

Once there is no longer a legitimate reason to retain that recording, it will be securely deleted in accordance with our retention procedures.

CCTV signage

Signs are displayed to inform patients, visitors and staff that CCTV is in operation.

Where audio recording is in use, we aim to make this clear so that individuals are aware that both images and sound may be recorded.

Access to CCTV recordings

You may have the right to request access to CCTV footage or audio containing your personal information.

Any request will be considered in accordance with data-protection law and may need to take account of the privacy and rights of other individuals who appear or can be heard in the recording.

Further information about our use of CCTV and audio recording is available from our Data Protection Leads.

19. Keeping your information secure

We use appropriate organisational and technical measures designed to protect personal information against:

• unauthorised access;

• accidental loss;

• inappropriate disclosure;

• alteration;

• destruction; and

• misuse.

Access to patient information is restricted to people who require it for a legitimate purpose.

Dentists and other registered members of the dental team are subject to professional duties of confidentiality, and members of the wider practice team are required to maintain patient confidentiality.

Organisations processing information on our behalf are required to provide appropriate security and confidentiality safeguards.

No electronic or internet-based system can be guaranteed to be completely risk-free, but we take reasonable and appropriate measures to protect information stored or transmitted electronically.

20. Information processed outside the United Kingdom

Some of the technology and service providers used by the practice may process or permit access to personal information outside the United Kingdom.

Where this constitutes a restricted international transfer under UK data-protection law, we will ensure that an appropriate lawful transfer mechanism is in place.

Depending upon the circumstances, this may include:

• transfer to a country covered by UK adequacy regulations;

• appropriate contractual safeguards; or

• another transfer mechanism permitted by UK data-protection law.

Where required, appropriate assessment of the safeguards applying to the transfer will also be undertaken.

You may contact us if you would like further information about safeguards applying to a particular international transfer.

21. How long we keep your information

We retain personal information only for as long as reasonably necessary for the purposes for which it is held and in accordance with our clinical-record retention policy.

Our current policy is to retain dental records and relevant orthodontic study records while you remain a patient and, after you cease to be a patient, for at least 11 years.

For children, records are retained until at least the age of 25, or for 11 years after the patient ceases to attend the practice, whichever provides the longer retention period.

Certain information may need to be retained for longer where necessary because of:

• ongoing treatment;

• a complaint;

• safeguarding issues;

• legal proceedings;

• professional or regulatory requirements;

• insurance or indemnity requirements; or

• another legitimate reason.

Financial and administrative records may be subject to different retention periods.

Information held temporarily by transcription, AI or other technology providers does not necessarily need to be retained for the same period as the final clinical record.

We aim to delete unnecessary intermediary information, such as temporary audio or draft transcripts, when it is no longer reasonably required for the purpose for which it was created, subject to the arrangements with the relevant provider.

CCTV and associated audio recordings are subject to the separate 30-day retention period explained above.

When information is no longer required, it will be securely destroyed, deleted or anonymised as appropriate.

22. Your data-protection rights

Depending upon the circumstances and the lawful basis on which information is processed, you may have the right to:

• be informed about how your personal information is used;

• request access to personal information we hold about you;

• have inaccurate personal information corrected;

• have incomplete information completed;

• request deletion of certain information;

• ask us to restrict certain processing;

• object to certain uses of your information;

• receive certain information in a portable format;

• withdraw consent where processing relies upon consent; and

• complain about the way your personal information has been handled.

These rights are not absolute and do not apply in every situation.

For example, we may need to retain an accurate clinical dental record even if you ask us to delete it because there may be clinical, professional, regulatory, insurance or legal reasons for retaining the information.

We will explain if a particular right does not apply in your circumstances.

Your right to object

Where we rely upon legitimate interests as our lawful basis, you may have the right to object to that processing.

You also have the right to object to the use of your personal information for direct marketing.

Please contact us if you wish to exercise this right.

23. Accessing your dental records

You may ask for access to personal information we hold about you. This is commonly known as a subject access request.

You can contact us verbally or in writing.

We may need to ask for sufficient information to:

• confirm your identity;

• protect patient confidentiality; and

• understand the information you require.

We will deal with requests in accordance with applicable data-protection law.

24. Transferring records to another dentist

If you move to another dental practice, you may ask us to provide appropriate information to your new dentist.

We will take reasonable steps to ensure that the request is genuine and that confidential information is transferred appropriately and securely.

Providing another dentist with a copy of relevant information does not normally mean that we can delete the original clinical record, because we may have continuing obligations to retain it.

25. Complaints about the use of your personal information

If you have concerns about the way we have collected, used, stored, disclosed or otherwise processed your personal information, please contact us.

Data Protection Leads

Daniel Hopkins and Nici Hopkins

Half Moon Dental Centre

1–3 Half Moon Lane

Herne Hill

London

SE24 9JU

Telephone: 020 7733 0011

Email: info@halfmoondental.com

We will:

• provide you with a clear way to raise a data-protection complaint;

• acknowledge receipt of your complaint within 30 days;

• take appropriate steps to investigate the complaint;

• keep you informed as appropriate; and

• tell you the outcome without undue delay.

If you remain dissatisfied, you have the right to raise your concern with the Information Commissioner's Office (ICO), the UK's independent data-protection regulator.

The ICO can be contacted through its website or by telephone on 0303 123 1113.

26. Changes to this Privacy Notice

We may amend this Privacy Notice from time to time.

For example, we may update it if:

• our services change;

• our technology or suppliers change;

• the way we process information changes;

• professional or regulatory guidance changes; or

• data-protection legislation changes.

The current version will be made available through our website and/or patient portal.

Email: info@halfmoondental.com

Data Protection Lead: Nici Hopkins

Last updated: 15 August 2026

Contact Us