Data Protection, Privacy and Confidentiality Policy
Treetops Dental Practice | Our commitments on personal information | October 2026
| Applies to | Treetops Dental Practice, run by Treetops Dental Practice Limited (company no. 06694553), owned by Norwich Dental Implant Centre Limited (company no. 06694555), and everyone who works for it |
| Practice contact | Suite 1, 11 Pottergate, Norwich, Norfolk NR2 1DS | 01603 660090 | info@treetopsdental.com |
| Data Protection Lead | Dr Robbie de Villiers |
| Data Protection Officer | Alexa de Villiers, alexa.devilliers@dvdental.co.uk |
| Last updated | October 2026 |
| Next review | October 2027 |
1. About this policy
This policy sets out how we protect the personal information of patients, enquirers, staff and anyone else we deal with. It explains our commitments and how we meet the law. Our Patient Privacy Notice and our Website, Social Media and Enquiries Privacy Notice give more detail about how we use patients’ information.
We follow UK GDPR, the Data Protection Act 2018 (as amended by the Data (Use and Access) Act 2025), the Privacy and Electronic Communications Regulations, the common law duty of confidentiality, the General Dental Council’s Standards for the Dental Team, Care Quality Commission requirements, and our NHS contracts.
2. Who is responsible
Treetops Dental Practice is run by Treetops Dental Practice Limited (company number 06694553), which also runs Norwich Dental Implant Centre from the same premises. Treetops Dental Practice Limited is owned by Norwich Dental Implant Centre Limited (company number 06694555).
The two companies are jointly responsible for your information as “joint data controllers”. You can contact either of them through the practice, and we will deal with your request whichever company you contact.
We are part of DV Dental Group, a group of five dental practices across Norfolk under the same ownership: Treetops Dental Practice, Norwich Dental Implant Centre, Golden Triangle Dental Practice, Grovefield Dental Surgery and North Norfolk Dental Implant Centre. Each practice is its own business. The group’s back-office company, De Villiers Group Limited (company number 17149733), provides shared services such as marketing to each practice, on that practice’s behalf.
Dr Robbie de Villiers is our Data Protection Lead and is accountable for data protection. Alexa de Villiers is our Data Protection Officer. She advises on and monitors how we comply with data protection law and is the contact point for patients and the Information Commissioner’s Office (ICO).
3. Our commitments
We will:
- only collect the information we need, and use it fairly, lawfully and openly
- only use it for the purposes we have explained
- keep it accurate and up to date
- keep it only for as long as we need it
- keep it secure and confidential
- respect people’s rights over their information
- be able to show how we meet these commitments
4. Our legal reasons for using information
We use personal information only where the law allows. For NHS care we rely on our public task, and for private care on our contract with the patient. Health information is used to provide health care, under the duty of confidentiality that applies to all our clinicians. We also use information to meet legal duties, for our legitimate interests in running safe and effective practices, and, where needed, with consent.
Agreeing to treatment is a clinical decision. It is separate from consent under data protection law.
5. Confidentiality
Everyone who works for us, including associates, locums and contractors, is bound by a duty of confidentiality, during and after their time with us. Staff only access a patient’s record when there is a genuine reason connected with their role. Access to our systems is controlled by job role, protected by individual logins, and recorded.
6. Sharing within DV Dental Group
Our practices work closely together, and some clinicians, staff and managers work across more than one practice. Where there is a genuine need, such as a patient’s care, a referral, covering staff absence, handling a complaint, safeguarding, clinical audit or managing the practices, authorised people from other DV Dental Group practices may access the relevant parts of a record. This sharing is covered by an agreement between the group companies. Being part of the group is not on its own a reason to access another practice’s records.
7. Sharing with others
We share information outside the group only where it is needed and lawful. This includes other clinicians and hospitals involved in a patient’s care, dental laboratories, NHS bodies, dental plan providers and insurers, and suppliers who provide services to us. Suppliers act only on our instructions, under written contracts that require them to keep information secure.
We will disclose information to regulators, the police, courts or safeguarding teams where the law requires it, or where it is needed to protect someone from serious harm. We check the legal basis for every such request and share only what is necessary. We never sell personal information.
8. Clinical records
We keep clinical records that are complete, accurate, up to date and clear, in line with the General Dental Council’s standards. Any corrections are made in a way that keeps the original entry visible.
9. How long we keep information
We keep information only for as long as we need it, following the NHS Records Management Code of Practice and guidance from dental indemnity organisations.
| Record | How long we keep it |
| Clinical records, including X-rays, scans, photographs and models of teeth | Adults: 11 years after last treatment. Children: until their 25th birthday, or 11 years after last treatment if that is later |
| Working models and appliances used during treatment | Until treatment is complete |
| Accounts and payment records | 6 years after the end of the financial year |
| Complaints | 10 years after the complaint is closed |
| Enquiries that don’t lead to an appointment | 12 months after last contact |
| Marketing opt-outs | Indefinitely, so we don’t contact the person again |
| Staff records | 6 years after employment ends |
| Recordings from AI note-taking | Deleted once the clinical note is completed |
| Video doorbell recordings | 30 days, unless needed for an incident |
We may keep records for longer if there is an ongoing complaint, claim or investigation. When information is no longer needed, we delete or destroy it securely.
10. People’s rights
Everyone has the right to see the information we hold about them, to have it corrected, and in some cases to have it deleted, to limit how we use it, or to object. Requests can be made to any practice, verbally or in writing. We will respond within one month, or within three months for complex requests, and we will not normally charge a fee.
11. Complaints about how we use information
Anyone can complain to us about how we have handled their information. We will acknowledge the complaint within 30 days, investigate it without undue delay and tell the person the outcome. If they are not satisfied, they can complain to the ICO at ico.org.uk or on 0303 123 1113.
12. Marketing
Our marketing is sent by us, by De Villiers Group Limited (DV Dental Group’s back-office company), or by a marketing company we contract to act on our behalf. We send news and offers about our services by email and text to patients and to people who have enquired about treatment, whether through our website, social media, by phone or by email. We only send news about other DV Dental Group practices to people who have told us they would like it.
Everyone is given the chance to opt out, and every message includes an easy way to unsubscribe. People can opt out of emails, texts or both. Opting out never affects anyone’s care or their appointment messages, which are part of their care and not marketing. We do not use people’s health information to decide what marketing to send them.
13. Website, social media and advertising
We only use non-essential cookies on our websites if visitors agree. We measure how well our adverts work by sharing limited, coded information with Meta (Facebook and Instagram), as explained in our Website, Social Media and Enquiries Privacy Notice.
We never post information about patients on social media or confirm that someone is a patient in a public reply. We only use identifiable photographs, testimonials or case studies with the patient’s written permission, and patients who say no receive exactly the same care.
14. AI note-taking and new technology
Our dentists may use AI note-taking software, which records the conversation during an appointment to draft clinical notes. We only use approved software from providers working under a written contract that requires them to keep information secure and use it only on our instructions. We have assessed the privacy risks before using it.
Patients are told when the software is being used and can ask for it not to be used, without any effect on their care. The clinician checks and corrects every draft before it is saved, and remains responsible for the accuracy of the record. Recordings are deleted once the note is completed.
We do not put patient information into public AI tools.
15. Video doorbells
We use video doorbells at our practice entrances for security. They are positioned to cover our doorway only, signs explain that recording takes place, and recordings are kept for 30 days unless needed for an incident. Only authorised managers can view them.
16. Security and data breaches
We protect information with appropriate technical and organisational measures, including secure systems, multi-factor authentication, encryption, controlled access and staff training. We complete the NHS Data Security and Protection Toolkit every year.
If a data breach happens, we act quickly to contain it, and we report it to the ICO within 72 hours where required. If a breach is likely to put people at high risk, we tell them without undue delay. We keep a record of every incident.
17. Information sent outside the UK
Where any supplier processes information outside the UK, we make sure it is protected by safeguards approved under UK law.
18. Staff and training
All staff receive data protection and confidentiality training. Staff and job applicants receive their own privacy notice. Breaching this policy may lead to disciplinary action.
19. Review
We review this policy every year, and sooner if the law or the way we work changes. Before introducing any new system or way of using personal information that could carry a high risk, we assess its impact on privacy.