Privacy Policy

Last updated: 1 October 2026

This privacy policy explains how The Tooth Spa collects, uses and protects personal information when you visit this website, contact us, or become a patient. We are committed to handling your information in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).

1. Who we are

The Tooth Spa Ltd (“The Tooth Spa”, “we”, “us”) is the data controller for the personal information described in this policy.

• Address: 47 Potternewton Lane, Chapel Allerton, Leeds, LS7 3LW
• Telephone: 0113 262 5545
• Email: [email protected]

If you have any questions about this policy or how we use your information, please contact the Practice Manager using the details above.

2. The information we collect

Information you give us through this website

• Contact and feedback forms: your name, email address, telephone number and anything you tell us in your message.
• Referral forms (completed by dental professionals): the patient’s name, date of birth, address, contact number, details of the case and any images or files uploaded, together with the referring practitioner’s name, practice address and contact number.
• Online booking: the details you enter to book an appointment, such as your name, contact details, date of birth and the reason for your visit.
• WhatsApp, telephone and email: your contact details and the content of your messages when you get in touch with us this way.

Information we hold about patients

If you become a patient we keep a dental record, which includes your contact details, medical and dental history, clinical notes, X-rays, scans and photographs, treatment plans, consent forms, correspondence and a record of payments. Information about your health is “special category” data and is given extra protection.

Information collected automatically

• Technical data: your IP address, browser type and the pages requested are processed by our hosting and security providers to deliver the website and protect it from misuse.
• Cookies and analytics: with your consent, we use Google Analytics to understand how visitors use the site. See section 8 and our Cookie Policy.

3. How we use your information and our lawful basis

• To reply to your enquiry or feedback – our legitimate interest in responding to people who contact us, or steps taken at your request before entering into a contract.
• To book and manage appointments and provide dental care – performance of a contract with you. We process health information because it is necessary for the provision of health care by, or under the responsibility of, a registered health professional (UK GDPR Article 9(2)(h)).
• To handle referrals from other dental professionals – our legitimate interest in providing the care requested, and the provision of health care (Article 9(2)(h)).
• To take payment, arrange finance or administer a dental plan – performance of a contract.
• To keep records and meet professional and legal duties – legal obligation, including the requirements of the General Dental Council, the Care Quality Commission and tax law.
• To send appointment reminders and recalls – our legitimate interest in helping you attend and maintain your dental health.
• To measure how the website is used – your consent, given through the cookie banner.
• To keep the website secure – our legitimate interest in preventing fraud and attacks.

We will only send you marketing messages if you have agreed to receive them, and you can opt out at any time.

4. Who we share your information with

We never sell your personal information. We share it only where necessary with:

• Healthcare professionals and organisations involved in your care, such as your GP, a specialist or hospital we refer you to, and dental laboratories.
• Service providers who process information on our behalf, under contracts that require them to keep it secure. These include our practice management and online booking provider (Dentr), our online form provider for imaging referrals (Jotform), our website hosting, security and email delivery providers (including Cloudflare and SMTP2GO), and the provider of our website chat button (Elfsight).
• Finance and dental plan providers, such as Tabeo, if you apply for finance or join a plan. They are responsible for the information you give them directly and have their own privacy policies.
• WhatsApp (Meta), if you choose to contact us that way.
• Google, which provides analytics, maps and video on this site once you have given consent.
• Regulators and other bodies where the law requires it, such as the General Dental Council, the Care Quality Commission, HM Revenue & Customs, our indemnity providers, or the police and courts.

5. Transfers outside the UK

Some of the service providers named above are based outside the United Kingdom or store information on servers outside it. Where this happens we rely on a UK adequacy decision or on appropriate safeguards, such as the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

6. How long we keep your information

• Website enquiries and feedback from people who do not become patients are normally deleted within 12 months.
• Dental records are kept for at least 11 years after your last visit, or until your 25th birthday if you were treated as a child, whichever is longer, in line with professional guidance.
• Financial records are kept for at least 6 years, as required by tax law.
• Analytics data is kept by Google for up to 14 months.

When information is no longer needed it is securely deleted or destroyed.

7. How we keep your information secure

This website uses encryption (HTTPS) to protect information you send to us, and a firewall and security monitoring to guard against attacks. Access to patient records is restricted to members of our team who need it, all of whom are bound by a duty of confidentiality. No method of sending information over the internet is completely secure, so please do not include detailed medical information in a website enquiry if you would prefer to discuss it by phone.

8. Cookies

Cookies are small files stored on your device. We use essential cookies to make the website work. Analytics cookies, and content from third parties such as Google Maps and YouTube, are only loaded if you accept them in the cookie banner. You can change or withdraw your consent at any time using the “Manage consent” tab on any page. Full details are in our Cookie Policy.

9. Your rights

Under data protection law you have the right to:

• ask for a copy of the information we hold about you;
• ask us to correct information that is inaccurate or incomplete;
• ask us to delete your information, where we have no legal reason to keep it;
• ask us to restrict how we use your information, or object to our using it;
• ask us to transfer your information to you or another organisation; and
• withdraw your consent at any time, where we rely on consent.

To exercise any of these rights, please contact us using the details in section 1. We will reply within one month and there is normally no charge. Some rights are limited where we must keep dental records by law.

10. Complaints

If you are unhappy with how we have handled your information, please tell us first so that we can try to put it right. You also have the right to complain to the Information Commissioner’s Office (ICO): ico.org.uk/make-a-complaint, telephone 0303 123 1113.

11. Children

This website is intended for adults. Parents and guardians may give us information about a child in order to arrange the child’s dental care.

12. Links to other websites

This website contains links to other sites, including our online booking system, finance provider and social media pages. We are not responsible for the privacy practices of those sites and recommend you read their privacy policies.

13. Changes to this policy

We review this policy regularly and will post any changes on this page, with the date of the latest update shown at the top.