Privacy Policy

Medical & Dental (“we”, “us”) operates Wimpole Street Medical & Dental at 22 Wimpole Street, London W1G 8GQ. This policy explains what personal information we hold about patients of that clinic, why, and what rights you have over it.

It is written to comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the record-keeping guidance of the GDC, NMC and CQC.

1. Data controller

Medical & Dental is the data controller for information collected at Wimpole Street.

2. What we collect

Identity and contact

• Name, date of birth, gender
• Postal address, email, telephone
• Emergency contact
• Photographic ID where required

Health information (special category data)

• Medical and dental history
• Medicines and allergies
• Clinical notes, treatment records, radiographs and photographs
• Laboratory and test results
• Referral letters and correspondence with other clinicians

Financial

• Card details (processed by our payment provider, not stored by us)
• Insurance policy details
• Invoices and payment history

3. Lawful basis

• Contract: to deliver the care you have asked for
• Legal obligation: to meet CQC, GDC and NMC record-keeping requirements
• Vital interests: in an emergency
• Legitimate interests: running the practice, improving quality, defending claims
• Health and social care provision (Article 9(2)(h)): processing health data in order to treat you

4. How we use it

• Providing and recording dental and medical care
• Booking, reminders and follow-up
• Invoicing, payment and insurance paperwork
• Referrals to specialists or laboratories
• Responding to complaints and meeting regulatory duties

5. Who we share it with

• Our other clinics: your record is shared across Medical & Dental's South Kensington, City of London and Wimpole Street locations so you can be seen at any of them
• Other healthcare providers: with your consent or where clinically necessary
• Laboratories: for diagnostic testing
• Regulators: CQC, GDC, NMC, ICO, where required by law
• Insurers: for claims, with your consent
• IT and professional suppliers: under data-processing agreements

We do not sell personal data.

6. How long we keep it

7. Your rights

• Access: a copy of your data (subject access request)
• Rectification: correcting inaccurate data
• Erasure: deletion, subject to legal retention periods
• Restriction and objection: limiting how we use your data
• Portability: receiving your data in a usable format
• Withdrawing consent: where consent is the basis

Write to wimpolestreet@md.co.uk. We respond within one month.

8. Security

• Encrypted storage and transmission
• Role-based access controls and staff authentication
• Regular security review
• Confidentiality and data-protection training for all staff
• Secure destruction of records at the end of retention

9. International transfers

Data is processed in the UK. Any transfer abroad is made only with UK GDPR-compliant safeguards in place.

10. Complaints about data handling

Please contact us first. You may also complain to the regulator:

11. Changes

We may update this policy; the date at the top reflects the current version.

12. Contact