Privacy Notice

Last updated: 1st June 2026

This notice explains what personal information FM Dental & Implant Centre collects about you, why we collect it, what we do with it, how long we keep it, and what rights you have. It applies to patients, prospective patients, visitors to our website, and people who contact us. Staff and job applicants are covered by a separate notice, available on request.

We are required to give you this information under the Data Protection (Jersey) Law 2018.

1. Who we are

FM Dental & Implant Centre ("we", "us", "the practice") is the data controller for the personal information described in this notice. This means we decide why and how your information is used.

• Sand Street practice: 16 Sand Street, St Helier, Jersey JE2 3QF · 01534 722288
• Bath Street practice: 9 Bath Street, St Helier, Jersey JE2 4ST · 01534 730951
• Email: surgery@fmdental.co.uk

2. Who to contact about your information

If you have a question about how we handle your personal information, or you want to exercise any of the rights set out in section 8, please contact our Data Protection Lead:

• Email: surgery@fmdental.co.uk, marked for the attention of the Data Protection Lead
• Post: Data Protection Lead, FM Dental & Implant Centre, 16 Sand Street, St Helier, Jersey JE2 3QF

3. What information we collect

If you are a patient or prospective patient

• Identity and contact details: your name, date of birth, home address, telephone numbers, email address, and the contact details of your next of kin or emergency contact.
• Health information. This is treated as "special category" data and given extra protection under the law. It includes your medical history and updates to it, current medication, allergies, clinical notes, treatment plans, dental charting, periodontal records, photographs of your teeth and face, X-rays and CBCT scans, digital intraoral scans, records of your consent to treatment, and correspondence about your care.
• Information about your care with others: referral letters and reports to and from your GP, medical consultants, specialist dentists, orthodontists and dental laboratories.
• Financial and administrative information: your appointment history, records of missed appointments, treatment estimates and invoices, payment records, dental plan or insurance membership details, and details of any finance arrangement.
• Correspondence: emails, letters, appointment requests, text messages and notes of telephone calls with the practice.
• Feedback and complaints: anything you tell us in a complaint, a survey or a review.

If you visit our website

Our website does not have contact or booking forms, and we do not store patient information on it. When you book an appointment online, you are taken to a separate secure booking portal provided by Dentally (see section 6). Anything you enter there is held in our practice management system, not on our website.

Our website does automatically record limited technical information about visitors:

• Server logs: your IP address, the date and time of your visit, the pages you requested, and your browser and device type. These are created by our web host as a normal part of running the site, and are used for security and troubleshooting.
• Cookies: see section 9.

4. Where we get your information from

Most of what we hold comes directly from you — when you register with the practice, complete a medical history form, speak to us, or book through our online portal.

We also receive information about you from:

• your GP, medical consultants or hospital, where it is relevant to your dental care;
• another dental practice, if you have transferred to us or been referred;
• specialists, laboratories and imaging providers involved in your treatment;
• your dental plan provider or insurer, where you have one;
• a parent, guardian, or someone else acting on your behalf.

5. Why we use your information, and our lawful basis

The law requires us to have a lawful basis for using your personal information, and an additional condition for using health information.

Where we rely on legitimate interests, we have considered whether our interests are outweighed by your rights and freedoms. You can ask us for details of that assessment, and you have the right to object — see section 8.

6. Who we share your information with

We do not sell your information, and we do not share it with anyone for their own marketing purposes. We share it only where necessary, and only with:

• Our practice management system provider. Your dental records, appointments and account are held in Dentally, a cloud dental practice management system operated by Henry Schein One UK LTD (company number 02940919), Medcare South, Bailey Drive, Gillingham Business Park, Gillingham, Kent ME8 0PZ. Dentally also provides the online booking portal linked from our website. Dentally acts as our processor and may only use your information on our instructions.
• Other healthcare providers involved in your care — your GP, medical consultants, hospitals, specialist dentists, orthodontists, oral surgeons and anaesthetists.
• Dental laboratories that make crowns, bridges, dentures, aligners and other appliances.
• Imaging and scanning providers, where scans are processed or interpreted externally.
• Your dental plan provider or insurer, where you have asked us to claim on your behalf. This includes Denplan if you are a member.
• Our website hosting, website development and IT support providers. These providers support our website and office systems. They do not have access to your dental records.
• Our payment processing providers, and any patient finance provider you choose to use. We do not store your full card details.
• Our accountants, auditors, insurers, indemnity provider and legal advisers, where necessary.
• Analytics and advertising providers — Google and Meta — in relation to website usage only, and only where you have consented. See section 9. They do not receive your dental records.
• Regulators and public authorities, including the General Dental Council, the Jersey Office of the Information Commissioner, the States of Jersey Police, Government of Jersey health and safeguarding teams, and the courts, where we are legally required or permitted to share.
• A purchaser or successor practice, if the practice is sold or transferred. We would tell you before this happened.

Everyone who handles your information on our behalf is bound by a written contract requiring them to keep it secure, use it only on our instructions, and delete or return it when their work for us ends.

You can ask us for the names of the providers in any of the categories above by emailing surgery@fmdental.co.uk.

7. Sending information outside Jersey

Where information is transferred to a country recognised as offering an adequate level of protection — which includes the United Kingdom and countries in the European Economic Area — no additional safeguards are needed. Where information goes anywhere else, we put an approved safeguard in place first, normally Standard Contractual Clauses with the Jersey Addendum appended.

Your dental records. Dentally holds our practice data on Amazon Web Services infrastructure located in the European Union.

Website analytics and advertising. If you consent to analytics and advertising cookies, information about your visit is transferred to Google and to Meta, both of which process data in the United States. Those transfers rely on the safeguards those providers have in place. If you do not consent, no such transfer takes place.

You can ask us for a copy of the safeguards we rely on by emailing surgery@fmdental.co.uk.

8. Your rights

You have the following rights over your personal information. They are free to exercise, and we will normally respond within one month.

• The right to be informed — to know how we use your information, which is what this notice is for.
• The right of access — to receive a copy of the personal information we hold about you, including your clinical records.
• The right to rectification — to have inaccurate information corrected. Clinical records cannot normally be altered retrospectively, but we can add a note recording that you disagree with an entry.
• The right to erasure — to ask us to delete your information. This right is limited: we are required to keep dental records for a set period (see section 11), so we will usually not be able to delete clinical records on request.
• The right to restrict processing — to ask us to pause our use of your information while a concern is looked into.
• The right to data portability — to receive certain information you gave us in a machine-readable format, or have it sent to another provider.
• The right to object — to object to processing we carry out on the basis of our legitimate interests, including recall reminders.
• The right to withdraw consent — where we rely on your consent, such as marketing messages or website cookies, you can withdraw it at any time. This does not affect anything we did before you withdrew it.
• Rights relating to automated decision-making — we do not make decisions about your care or your account by automated means alone, and we do not carry out profiling that produces legal or similarly significant effects.

To exercise any of these rights, email surgery@fmdental.co.uk marked for the attention of the Data Protection Lead, or write to us at the address in section 2. We may ask you to confirm your identity first, so that we do not release your information to the wrong person.

9. Cookies and our website

Cookies are small files placed on your device when you visit a website.

Strictly necessary cookies make the site work. These are set automatically and do not require your consent.

Analytics and advertising cookies are set only where you have given consent through our cookie banner. Where you consent, we use:

• Google Analytics 4 — to understand how many people visit the site, which pages they read and how they found us, so that we can improve it.
• Google Ads — to measure whether our online advertising is working and, where enabled, to show our adverts to people who have visited our site.
• Meta Pixel — to measure whether our advertising on Facebook and Instagram is working.

You can change or withdraw your cookie choices at any time by contacting us, and you can block or delete cookies through your browser settings. Google and Meta each publish their own privacy information explaining what they do with the data they receive.

10. How long we keep your information

We keep your information only for as long as we need it, and no longer.

• Adult dental records: eleven years from the date of the last entry in the record.
• Children's dental records: until the patient's twenty-fifth birthday, or eleven years from the last entry, whichever is longer.
• X-rays, CBCT scans and clinical photographs: kept with the clinical record, for the same period.
• Financial and accounting records: ten years, as required for tax and accounting purposes.
• Complaints: eleven years, in line with the clinical record they relate to.
• Enquiries from people who do not go on to become patients: twelve months.
• Marketing opt-outs: kept indefinitely, so that we do not contact you again by mistake.
• Website server logs: retained by our hosting provider for a short period for security and troubleshooting, and then deleted.

When information is no longer needed, we securely delete or destroy it.

11. How we keep your information secure

We take appropriate technical and organisational measures to protect your information against unauthorised access, loss, alteration and disclosure.

Your dental records are held in Dentally, which encrypts data in transit, restricts access through individual staff accounts with defined permission levels, supports two-factor authentication, and keeps an audit log of logins and changes to records. Within the practice, access is limited to staff who need it for your care or to administer your account, and all our staff are bound by a duty of confidentiality.

If a personal data breach happens that is likely to result in a risk to your rights and freedoms, we will report it to the Jersey Office of the Information Commissioner within 72 hours of becoming aware of it, and we will tell you directly if the risk to you is high.

12. Do you have to give us your information?

You are not obliged to give us your personal information. However, we cannot safely provide dental treatment without an accurate medical history and a way to contact you. If you choose not to provide these, we may not be able to treat you.

13. Making a complaint

If you are unhappy with how we have handled your personal information, please tell us first. Email surgery@fmdental.co.uk marked for the attention of the Data Protection Lead, and we will investigate and respond.

You also have the right to raise a concern with the regulator at any time:

Jersey Office of the Information Commissioner
Telephone: 01534 716530
Email: enquiries@jerseyoic.org
Website: jerseyoic.org/raise-a-concern

14. Changes to this notice

We review this notice regularly and update it when our practices change. The version number and date at the top show when it was last revised. Where changes are significant, we will draw them to your attention.