Dr Bala Orthodontics Customer Privacy Notice

This privacy notice tells you what to expect us to do with your personal information.

Contact details

Email: drbaladentistry@gmail.com

What information we collect, use, and why

We collect or use the following information to provide services and goods, including delivery:

  • Names and contact details
  • Addresses
  • Payment details (including card or bank information for transfers and direct debits)
  • Credit reference information
  • Health information (including dietary requirements, allergies and health conditions)
  • Information relating to loyalty programmes
  • Website user information (including user journeys and cookie tracking)
  • Photographs or video recordings
  • Call recordings
  • Information relating to compliments or complaints

We also collect or use the following special category information to provide services and goods, including delivery. This information is subject to additional protection due to its sensitive nature:

  • Racial or ethnic origin
  • Health information

We collect or use the following information for service updates or marketing purposes:

  • Names and contact details
  • Addresses
  • Marketing preferences
  • Location data
  • Recorded images, such as photos or videos
  • Call recordings
  • Purchase or viewing history
  • Records of consent, where appropriate

We also collect or use the following special category information for service updates or marketing purposes. This information is subject to additional protection due to its sensitive nature:

  • Racial or ethnic origin
  • Health information

We collect or use the following information to comply with legal requirements:

  • Name
  • Contact information

We also collect or use the following special category information to comply with legal requirements. This information is subject to additional protection due to its sensitive nature:

  • Racial or ethnic origin
  • Health information

We collect or use the following personal information for dealing with queries, complaints or claims:

  • Names and contact details
  • Address
  • Account information
  • Call recordings
  • Customer or client accounts and records
  • Financial transaction information
  • Correspondence

We also collect the following special category information for dealing with queries, complaints or claims. This information is subject to additional protection due to its sensitive nature:

  • Health information

Lawful bases and data protection rights

Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO’s website.

Which lawful basis we rely on may affect your data protection rights, which are set out in brief below. You can find out more about your data protection rights and the exemptions which may apply on the ICO’s website:

If you make a request, we must respond to you without undue delay and in any event within one month.

To make a data protection rights request, please contact us using the contact details at the top of this privacy notice.

Our lawful bases for the collection and use of your data

Our lawful bases for collecting or using personal information to provide services and goods are:

  • Consent – we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
  • Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
  • Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
  • Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:

     

    • Practice administration & patient experience: managing patient appointments, optimising clinic schedules, and streamlining your visit. This includes processing information to provide you with localised amenities, such as arranging practice-led parking schemes or handling the logistics of custom-branded cosmetic packaging (for example, Invisalign starter kits and patient care bags).
    • Service communication & reminders: sending you operational communications, including appointment reminders, treatment follow-up checklists, post-operative care instructions, and notifications regarding changes to our practice operating hours or facilities.
    • Business improvement & quality assurance: analysing patient feedback, reviews, and clinical outcomes to monitor quality, improve our customer service, train our team, and upgrade our internal facility management systems.
    • Financial & account management: processing payments for treatments, sundries, and premium cosmetic goods; managing patient accounts, addressing billing queries, and recovering unpaid debts directly or through authorised third parties.
    • Marketing of similar goods & services: keeping you informed about directly relevant dental treatments, advanced cosmetic options (such as upcoming practice-led Invisalign open days), oral health products, or seasonal promotions. You retain the right to opt out of these communications at any time.
    • Security & safety: using on-site CCTV, maintaining visitor logs, and monitoring practice safety to protect our patients, staff, clinical equipment, and physical premises.

For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.

Our lawful bases for collecting or using personal information for service updates or marketing purposes are:

  • Consent – we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
  • Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
  • Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
  • Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are the practice administration, service communication, business improvement, financial management, marketing, and security & safety purposes described above.

For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.

Our lawful bases for collecting or using personal information for legal requirements are:

  • Consent – we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
  • Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
  • Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
  • Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are the practice administration, service communication, business improvement, financial management, marketing, and security & safety purposes described above.

For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.

Our lawful bases for collecting or using personal information for dealing with queries, complaints or claims are:

  • Consent – we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
  • Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
  • Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
  • Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are the practice administration, service communication, business improvement, financial management, marketing, and security & safety purposes described above.

For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.

Where we get personal information from

  • Directly from you
  • Health care providers

How long we keep information

We only keep your personal information for as long as necessary to fulfil the purposes for which it was collected and to comply with our legal, regulatory and professional obligations.

Our retention periods include:

  • Clinical dental records for adults are retained for 11 years after treatment has ended.
  • Clinical records for children are retained until the patient's 25th birthday, or 26th birthday if they were 17 when treatment ended.
  • Financial records are generally retained for 6 years to comply with legal and tax obligations.
  • Marketing information is retained until you withdraw your consent or we no longer require it for the purpose for which it was collected.
  • Enquiries that do not result in treatment are generally retained for up to 12 months unless there is a legitimate reason to keep them for longer.

At the end of the relevant retention period, your personal information will be securely deleted or destroyed unless we are required by law to retain it for a longer period. For more information about our retention schedule, please contact us using the details provided above.

For more information on how long we store your personal information or the criteria we use to determine this, please contact us using the details provided above.

Who we share information with

Others we share personal information with

  • Health care providers
  • Organisations we need to share information with for safeguarding reasons
  • Suppliers and service providers

How to complain

If you have any concerns about our use of your personal information, you can make a data protection complaint to us:

Email: drbaladentistry@gmail.com
Telephone: 01202 746428
Post: 533 Ashley Road, Poole, BH14 0BD

If you remain unhappy with how we’ve used your data after raising a complaint with us, you can also complain to the ICO.

The ICO’s address:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline number: 0303 123 1113
Website: https://www.ico.org.uk/make-a-complaint

Last updated: 10th July 2026