About this privacy notice

April 2023.

This privacy notice describes how the University of Bristol ('UoB' or 'we') collects and uses your personal data.

Personal data is information about you from which you can identified (either directly or indirectly).

We are a "controller" (also known as a "data controller"). This means that we are responsible for deciding how and why we hold and use personal data about you, and for explaining this clearly to you.

This notice applies to our patients, who have registered with us or have received treatment from us at our Dental School. This notice also applies equally to parents, guardians, or carers of patients where applicable.

It is important that you read this notice, together with any other privacy information or notices we may provide on specific occasions when we are collecting or processing personal data about you.

This is to help ensure that you are aware of how and why we are using such information. If you do not understand anything in this notice, please speak to your parent or guardian if appropriate, or your contact at the Dental School.

Information we collect and process

We will collect information about you and your treatment when you register with us, or are referred
to us.

The types of information that we will collect will be:

• Contact details - such as your name, address, telephone number, DOB, NHS number, email etc.
• Details of any adjustments that we need to take into account, such as the need for an interpreter.
• Your relevant medical history - this will come from you, or any organisation that has referred you, and we may collect additional information from relevant healthcare practitioners where necessary to provide your treatment.
• Payment information and insurance details where relevant.

We also collect health data from you when you are assessed at each appointment you have with us, which may include medical photography and video recordings.

We use your personal data to enable us to assess and provide your treatment, to update your medical records, for clinical incident management, and where you consent, to be used for research.

We also use your personal data to communicate with you, including to provide you with information and updates relating to your care.

As you will be aware, you may be treated by a dental student at the University. The student may need to use details of your treatment as part of their academic assessments. Where possible, this information will be anonymised, but personal data may be shared within the Dental School to undertake an academic assessment of the student.

If you agree, we may also use medical photography and video recordings for teaching material or publication in clinical journals and textbooks.

Connecting Care is a local electronic patient record that allows health and social care professionals directly involved in your care, to view a summary of your medical record. 

Your Connecting Care record will help those caring for you to manage your care better and allow information to be shared quickly and safely. Only authorised staff providing health services at the University of Bristol Dental School can access your record.

For more information about Connecting Care, visit the Connecting Care website which includes information on:

• What Connecting Care is
• Why share information
• How information is protected
• How to Opt-Out/In
• Changes to our policy

Using your information, and the legal basis for this

Where we are using your information, including images or videos for the purposes of receiving treatment as set out above, the legal basis relied upon is public task carried out in the public interest. We will always seek your agreement to the taking of images or videos where possible.

For data protection purposes, we do not rely on 'consent' as a legal basis, because there will be situations where this would not be appropriate. However, we will follow best practice and ensure that you are informed about when we are taking such images, and we will seek your agreement to their use for the purposes of your treatment.

If you do not provide the information requested to facilitate your treatment plan, we will not be able to treat you, or continue with your treatment.

When we share information with other healthcare professionals, we may do this where it is required to protect your vital interests. We may also do this when it is in your best interests to do so, and it is a legitimate interest of yours that we share the information.

When information about you is shared for the purposes of assessing a student, this is a public task carried out in the public interest, because the training of dental students is such a task.

When we use images for teaching, research or publication purposes, we will only do so where you have agreed to this use.

We will only use the images or videos where you have given us express consent to do so. If you do give us consent, you may withdraw that consent at any time by emailing student-treatments@bristol.ac.uk. Please be aware that, as explained in the consent form, images that have been made available on the internet may be difficult to withdraw from circulation.

Sharing your information

In addition to the specific sharing mentioned above, we may share your information with third parties as follows:

• We will share your personal data with third parties where required by law, where it is necessary to administer the working relationship with you or where we have another legitimate interest in doing so.
• If ever in the future, we are considering restructuring University of Bristol, we may share your information with the other parties involved and with the relevant professional advisors. This is for our legitimate interest in ensuring the continuation of the business.
• If we have a legal obligation to do so or for the purposes of fraud protection and credit risk reduction.
• We may need to share information about you to make safeguarding referrals, or onward health referrals as part of continuing care This is a legal obligation, but where it is not, it would be a legitimate interest of UoB to comply with best practice.
• We may share your personal data with third party service providers who act on our behalf such as our professional advisers and IT services providers.
• We use third party "cloud computing" services to store some information rather than the information being stored on hard drives located at the University of Bristol. If you have any questions about any of the above, please speak to the Data Protection Officer, using data-protection@bristol.ac.uk.

Overseas transfers

Any personal data that you submit to us will be held on secure cloud-based servers within the UK.

How long will we use your personal data for?

Usually, we only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements. For instance, we retain your medical records for a minimum of 11 years from when the patient last attended the practice, or until age 25 for children (whichever is longer).

Images and videos that are used for teaching, research and publication will be kept as long as they are relevant to the teaching methods, research and publication, and this may be indefinitely.

If you would like further information, please contact our Data Protection Officer, using data-protection@bristol.ac.uk.

Processing in line with your rights

Data protection legislation gives you a number of rights in your information. Your rights are as follows:

• Correction: if information the University of Bristol holds about you is incorrect you can ask us to correct it.
• Access: you can also ask what information we hold about you and be provided with a copy of it. This is commonly known as making a subject access request. We will also give you extra information, such as why we use this information about you, where it came from and what types of people we have sent it to.
• Deletion: you can ask us to delete the information that we hold about you in certain circumstances. For example, where we no longer need the information.
• Portability: you can request the transfer of your information to you or to a third party in a format that can be read by computer. This applies where (a) the information has been provided by you; (b) the basis that we are relying on to process your personal data is consent or contract (please see "Our purposes and lawful bases in more detail" above); and (c) the information is being processed by us on computer.
• Object: you may object to us using your personal data where:
  • we are using it for direct marketing purposes
  • the lawful basis on which we are relying is either legitimate interests or public interest task. Please see the section "Our lawful bases for using your personal data" above
  • if we ever use your information for scientific or historical research purposes or statistical purposes
  • Restriction: you can request that we restrict how we use your personal data.

Our Data Protection Officer can give you more information about your data protection rights. To exercise any of your rights you can submit your request in writing to the Data Protection Officer at data-protection@bristol.ac.uk.

We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights).

If you ask us to restrict our use of your personal data or delete it, we will not be able to provide you with our products or services.

You have a right to lodge a complaint with the Information Commissioner's Office. If you do have any concerns about how we have handled your personal data, we would kindly ask that you contact us in the first instance before you speak to the ICO so that we have an opportunity to put things right.