Privacy Policy

Keppel Advanced Dentistry – 1 Cedar Road, Sutton, Surrey SM2 5DA
Last updated: June 2026

Who we are

Keppel Advanced Dentistry (“the practice”, “we”, “us”, “our”) is a private dental practice located at 1 Cedar Road, Sutton, Surrey SM2 5DA. Our principal dentist is Dr Tom Keppel (GDC No. 68586). You can contact us on 0208 642 0355 or by email at [email protected].
This Privacy Notice explains how we collect, use, store and share your personal information when you visit our website, book a consultation, become a patient, or otherwise interact with the practice. It is published in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR), and the guidance issued by the Information Commissioner’s Office (ICO) and the General Dental Council (GDC).

Data controller and contact

 

Keppel Advanced Dentistry is the data controller for the personal information described in this notice. Our Information Governance Lead and Data Protection Officer is Carol Turner.

You can reach the Data Protection Officer in writing at the practice address, by telephone on 0208 642 0355, or by email at [email protected].

The information we collect

Depending on how you interact with us, we may collect and process the following categories of personal data:

• Contact information – your name, address, email address, telephone numbers, and preferred contact method.
• Identity information – date of birth, gender, next of kin, and where relevant a copy of photographic ID.
• Clinical and special category data – your dental and medical history, medications, allergies, clinical notes, charts, treatment plans, consent forms, photographs, scans, radiographs (x-rays) and intra-oral images.
• Appointment data – records of past, present and future appointments and any cancellations.
• Financial data – payment card details processed by our payment provider, invoices, finance plan applications and balances.
• Marketing data – your preferences for receiving communications from us, including consent given through forms on our website.
• Website and technical data – IP address, browser type, device information, pages visited, referring URL and cookie identifiers when you use our website.

How we collect your information

We collect your information directly from you when you complete a medical history form, book a consultation, contact us by phone or email, or attend an appointment. We may also receive information from your previous dentist or GP (with your consent), from referring practitioners, from your insurance provider where applicable, and from technology that runs on our website (such as analytics cookies).

Why we use your information and the lawful basis we rely on

We only process your personal data when we have a lawful basis to do so. The bases we rely on are:

• Provision of dental care – processing your special category (health) data is necessary for the purposes of preventive medicine, medical diagnosis, and the provision of dental treatment and care, in accordance with Article 9(2)(h) of the UK GDPR.
• Performance of a contract – to provide the treatment you have agreed to, to take and refund payments, and to manage finance plans.
• Legitimate interests – to administer the practice, maintain clinical records, follow up on treatment, manage referrals, prevent fraud, secure our premises (including CCTV where in use), and keep our website safe.
• Legal obligation – to meet our regulatory duties under the General Dental Council, the Care Quality Commission (CQC), HMRC, anti-money-laundering law, and clinical record-retention rules.
• Consent – for direct marketing communications by email or SMS, for the use of clinical photographs outside your own record, and where you specifically consent in writing.

Sharing your information

We treat your personal information as confidential. We only share it where we have a clear legal basis to do so, and only with parties who provide adequate protection. We may share information with:

• Other clinicians and laboratories involved in your care, including specialists, dental laboratories, sedation providers and orthodontic providers.
• Your GP, NHS bodies or hospital consultants where a referral or shared-care arrangement is appropriate and you have consented.
• Our regulators – the General Dental Council, the Care Quality Commission, NHS Business Services Authority where applicable, and our indemnity provider.
• Approved data processors – our practice management software supplier, IT and cloud-hosting providers, payment processors, finance plan providers (such as Tabeo or similar), email and SMS communications providers, and our accountants.
• Law enforcement, courts, or public authorities where we are legally required to disclose information.

We do not sell your data to anyone, and we do not use it for automated decision-making or profiling.

Where your data is stored

Your personal data is stored on secure systems based in the United Kingdom. Some of our suppliers may host data in the European Economic Area, the United States or other countries. Where data is transferred outside the UK, we rely on UK-approved safeguards such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or adequacy regulations made by the UK Government.

How long we keep your information

 

• Adult dental records: minimum of 11 years from the date of last entry, in line with current professional guidance.
• Children’s dental records: until the patient’s 25th birthday, or 26th if they were 17 at the last entry.
• Radiographs, photographs and consent forms: retained with the clinical record for the same period.
• Financial records and invoices: at least 6 years from the end of the relevant tax year.
• Employee and contractor records: 6 years after the end of employment or engagement.
• Website enquiry data and marketing data: up to 2 years from your last interaction, unless you withdraw consent earlier.

When information is no longer needed, we securely delete or anonymise it.

Your rights

Under UK data protection law, you have the right to:

• Be informed about how we use your data (this notice).
• Request access to a copy of the personal data we hold about you (a “subject access request”).
• Ask us to correct inaccurate or incomplete information.
• Ask us to erase personal data we no longer have a lawful reason to hold (note that we must retain clinical records for the periods set out above).
• Restrict or object to certain processing, including direct marketing.
• Request portability of certain data you provided to us.
• Withdraw any consent you have previously given, at any time, without affecting the lawfulness of processing carried out beforehand.

To exercise any of these rights, please contact our Data Protection Officer using the details above. We will respond within one calendar month and we will not charge a fee unless your request is manifestly unfounded or excessive.

Marketing communications

 

We will only send you marketing emails, SMS messages or postal mail where you have given us appropriate consent or where the law allows. You can opt out at any time by clicking the unsubscribe link in any email, replying “STOP” to any SMS, or contacting us directly. Opting out of marketing will not affect any service or appointment messages we send you about your care.

Cookies and website analytics

 

Our website uses cookies and similar technologies. Cookies are small text files placed on your device when you visit a site.

• Strictly necessary cookies make the site work – you cannot disable these.
• Performance and analytics cookies (such as Google Analytics) help us understand how the site is used so we can improve it.
• Marketing cookies are used to measure the effectiveness of advertising campaigns, including Google Ads and Meta (Facebook/Instagram) pixels where in use.

You can manage your cookie preferences through the consent banner shown the first time you visit and at any time through the “Cookie Settings” link in the footer. You can also block or delete cookies through your browser settings, although this may affect how the website works for you.

Embedded content

 

Pages on this site may include embedded content such as Google Maps, YouTube videos, booking widgets and review widgets. Embedded content behaves as if you visited that third party’s site directly. Those providers may collect data about you, set their own cookies and apply their own privacy policies, which you should review.

Security

 

We use appropriate technical and organisational measures to protect your personal data, including encryption in transit, access controls, audit logs, secure backups, staff training, confidentiality agreements and a written incident-response process. No system is ever completely secure, but we work hard to limit risk and we will notify you and the ICO if there is a personal data breach that is likely to affect your rights.

CCTV

 

Where CCTV is in operation at the practice, signs are clearly displayed. Footage is recorded for the safety of patients and staff, retained for a limited period (typically 30 days), and only accessed by authorised personnel or disclosed to law enforcement on lawful request.

Children

 

Where a patient is under 16, we obtain consent from a person with parental responsibility. We do not knowingly market to children.

Making a complaint

If you have any concerns about how we use your personal information, please contact our Data Protection Officer in the first instance and we will do our best to resolve the matter.

If you remain dissatisfied, you have the right to complain to the Information Commissioner’s Office. The ICO can be reached on 0303 123 1113 or at ico.org.uk.

Changes to this policy

 

We review this notice regularly and may update it from time to time. The version published on our website is the current version, and the “Last updated” date at the top of this notice reflects the most recent change.