PRIVACY NOTICE

Effective date: 30 August 2026

Who we are

MARKET CROSS SMILE STUDIO LTD, trading as Market Cross Dental, is the data controller responsible for the personal information described in this notice.

Company number: 16555473

Address:
The Market Cross, 1st Floor
Cornhill
Bury St Edmunds
Suffolk
IP33 1BT

General enquiries: info@marketcrossdental.co.uk
Data protection and complaints contact: manager@marketcrossdental.co.uk

This notice explains how we collect, use, disclose and protect personal information relating to patients, prospective patients, website visitors, referring clinicians and other people who communicate with us.

Information we collect

Depending on your relationship with us, we may collect:

• Your name, title, date of birth and contact details.

• Details of your general dental practitioner and referring clinician.

• Appointment, referral and correspondence information.

• Dental, medical and medication histories.

• Clinical notes, diagnoses, treatment plans and consent records.

• Radiographs, scans, photographs, videos, models and laboratory information.

• Details of allergies, disabilities, communication requirements and reasonable adjustments.

• Payment, invoice, deposit, finance and transaction information.

• Complaints, feedback and incident information.

• Marketing preferences and permissions.

• Website information including IP address, browser, device, pages visited and cookie identifiers.

• Information provided by a parent, guardian, representative or person acting with your authority.

We may receive information directly from you or from your general dental practitioner, referring clinician, another healthcare professional, laboratory, authorised representative, finance provider or payment provider.

How we use information

We use personal information to:

• Respond to enquiries and assess referrals.

• Arrange and manage appointments.

• Provide safe, appropriate dental assessment and treatment.

• Obtain and document valid consent.

• Communicate with your general dental practitioner, referring clinician and other professionals involved in your care.

• Produce restorations, appliances and other laboratory work.

• Process deposits, treatment payments, refunds and finance arrangements.

• Maintain complete and accurate clinical records.

• Manage complaints, incidents, safeguarding concerns and legal claims.

• Meet professional, regulatory, tax, accounting and legal obligations.

• Monitor and improve the safety and quality of our service.

• Protect our patients, staff, systems and premises.

• Send newsletters or marketing where you have agreed to receive them.

• Operate, secure and improve our Shopify website.

Our lawful bases

Depending on the purpose, we rely on:

• Contract: where processing is necessary to take steps at your request or provide agreed services.

• Legal obligation: where we must keep records, meet regulatory duties, maintain accounts, manage safeguarding concerns or comply with lawful requests.

• Legitimate interests: where necessary to operate and protect the practice, administer referrals, manage appointments, establish or defend legal claims and improve our service, provided those interests are not overridden by your rights.

• Consent: for optional marketing, non-essential cookies and other activities for which consent is appropriate.

Dental and medical information is special-category data. We normally process it because this is necessary for medical diagnosis, dental treatment or the management of healthcare services under Article 9(2)(h) UK GDPR and the Data Protection Act 2018, subject to professional confidentiality.

We may also process special-category information where necessary for legal claims or where you have given explicit consent.

Clinical and promotional photographs

Clinical photographs, radiographs and scans may form part of your confidential dental record and may be used for diagnosis, treatment planning, laboratory communication and continuity of care.

We will obtain separate, explicit permission before using identifiable patient photographs, videos or case information for website, educational or promotional purposes. Refusing promotional consent will not affect your care. You may withdraw promotional consent for future use at any time.

Sharing information

We only share information where necessary and appropriate. Recipients may include:

• Members of the Market Cross Dental team.

• Your general dental practitioner and referring clinician.

• Other healthcare professionals involved in your care.

• Dental laboratories, imaging services and equipment suppliers.

• Clinical software, secure communications, cloud storage and IT support providers.

• Shopify, Shop Pay and website service providers.

• Banks, payment processors and finance providers.

• Professional indemnity providers, insurers, legal advisers and accountants.

• CQC, GDC, ICO, HMRC and other authorities where required.

• Police, courts, safeguarding bodies or emergency services where disclosure is lawful and necessary.

Everyone working within the practice is required to respect confidentiality. External providers are selected and managed through appropriate confidentiality, security and data-processing arrangements.

We do not sell patient information.

Shopify and online payments

Our website is powered by Shopify. Shopify processes website, checkout, account and transaction information on our behalf and may also process information for its own legally defined purposes.

Payment card details are handled by approved payment providers. Market Cross Dental does not normally receive or retain your complete payment-card number.

You can read Shopify’s consumer privacy information at:

https://www.shopify.com/uk/legal/privacy/customers

International transfers

Shopify and some other technology providers may process information outside the United Kingdom. Where personal information is transferred internationally, we require an applicable adequacy arrangement or recognised contractual and organisational safeguards.

Further information about relevant safeguards may be requested from manager@marketcrossdental.co.uk.

Retention

We retain information only for as long as necessary for clinical, legal, regulatory, insurance and operational purposes.

Our standard periods include:

• Adult dental clinical records: normally 11 years following the last clinical entry.

• Children’s records: at least until the patient’s 25th birthday, or 26th birthday if the patient was 17 when treatment ended, and longer where clinically or legally required.

• Financial and accounting records: normally six years after the relevant financial year.

• Enquiries that do not lead to treatment: normally 12 months after the last meaningful contact.

• Complaints and associated correspondence: retained according to clinical, regulatory and legal requirements.

• Marketing information: until consent is withdrawn or the information is no longer required, with minimal suppression information retained to respect opt-out requests.

Records may be kept longer where there is an ongoing course of care, complaint, safeguarding matter, legal claim, regulatory investigation or other lawful reason.

Your rights

Depending on the circumstances, you may have the right to:

• Be informed about our use of your information.

• Request access to your personal information.

• Ask us to correct inaccurate or incomplete information.

• Request deletion in certain circumstances.

• Request restriction of processing.

• Object to processing based on legitimate interests or direct marketing.

• Request transfer of information you supplied to us.

• Withdraw consent at any time where consent is the lawful basis.

Some rights are not absolute. We may need to retain clinical or financial records despite a deletion request where retention is required for patient safety, professional accountability, legal obligations or legal claims.

To exercise your rights, email manager@marketcrossdental.co.uk. We may ask for proof of identity before releasing confidential information.

You have an absolute right to object to direct marketing. Every marketing email will provide an unsubscribe method.

Automated decisions

We do not use solely automated decision-making to make clinical decisions about patients. Shopify, payment processors or finance providers may use automated fraud, identity or credit checks under their own privacy notices.

Security

We use appropriate organisational and technical measures to protect personal information, including access controls, staff confidentiality, secure systems, backups and encrypted transmission where appropriate.

Please do not send detailed medical histories or highly sensitive clinical information through a general website contact form. We will provide a suitable secure route when necessary.

Complaints about personal information

Please contact manager@marketcrossdental.co.uk first so that we can investigate your concern.

If you remain dissatisfied, you may complain to:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113
Website: https://www.ico.org.uk/make-a-complaint

Updates

We may revise this notice when our services, systems or legal obligations change. The current version will always appear on this website.