Last updated: 16 June 2026
1. Who we are
This privacy policy applies to Omni Dental Limited, trading as Epsom Smiles (“we”, “us”, “our”), a private dental practice based in Epsom, Surrey. We are the data controller for the personal information described in this policy.
You can contact our Data Protection Lead at enquiries@epsomsmiles.co.uk or by writing to us at our practice address.
2. What information we collect
From you directly
- Your name, date of birth, address, phone number and email
- NHS number where relevant
- Medical and dental history, medications and allergies
- Information you provide in pre-visit questionnaires
- Photographs, X-rays, 3D scans and clinical notes captured during treatment
- Payment card details (processed by our payment processor — we do not store full card numbers)
- Form submissions and email correspondence
From other sources
- Your previous dentist, with your consent, for continuity of care
- Your GP or other healthcare providers, with your consent
- Lab partners who manufacture custom restorations
- Credit reference agencies if you apply for our 0% finance options
Automatically when you use our website
- IP address, browser type, device and operating system
- Pages visited and how you found us
- Cookie data — see our Cookie Policy
3. How we use your information
We use your information to:
- Provide your dental and facial aesthetics care
- Manage appointments, reminders and follow-ups
- Take and process payments
- Communicate with you about your care
- Comply with our legal and regulatory obligations (GDC, CQC, HMRC, etc.)
- Improve our services through anonymised analysis
- Send you marketing communications, only with your explicit consent
4. Lawful basis for processing
We process your information under one or more of the following lawful bases under UK GDPR:
- Contract — to provide the care you have asked us to provide
- Legal obligation — to comply with our regulatory duties
- Vital interests — to protect your life in an emergency
- Legitimate interests — to run our practice efficiently
- Consent — for marketing and any sharing beyond direct care
For special-category data (health information) we additionally rely on Article 9(2)(h) of UK GDPR — provision of healthcare.
5. Who we share your information with
We share your information only when necessary, with:
- Lab partners manufacturing your restorations
- Specialist consultants when we refer your care
- Your GP, hospital or other healthcare providers, with your consent
- Our payment processor and accounting software providers
- Our IT and clinical systems providers (under strict data processing agreements)
- Our regulators (GDC, CQC) when required
- HMRC and other government authorities when legally required
We never sell your data. We never share it for third-party marketing.
6. How long we keep your information
We retain dental records for a minimum of 11 years from the date of last treatment, or until age 25 for child patients — whichever is longer. This is in line with NHS Records Management Code of Practice for Health and Social Care.
Other records are retained for the period required by law (e.g. 6 years for financial records).
7. Your rights
Under UK GDPR you have the right to:
- Access the personal data we hold about you
- Have inaccurate data corrected
- Request erasure where applicable (note: clinical records have statutory retention)
- Restrict or object to processing
- Data portability — receive your data in a portable format
- Withdraw consent at any time
- Lodge a complaint with the Information Commissioner's Office (ICO)
To exercise any of these rights, email enquiries@epsomsmiles.co.uk. We will respond within one calendar month.
8. Security
We use appropriate technical and organisational measures to protect your information: encrypted storage, access controls, staff training, and regular review. Our clinical systems are hosted in UK data centres.
9. International transfers
Your personal data is processed in the UK and European Economic Area. Where any third-party processor operates outside these regions, we ensure equivalent protections through Standard Contractual Clauses.
10. Children
Where we treat patients under 16, we obtain consent from a parent or guardian. Children aged 13+ may also be asked to provide their own consent depending on Gillick competence.
11. Changes to this policy
We may update this policy from time to time. Material changes will be communicated to you directly. The current version is always available on this page with a “last updated” date.
12. Complaints
If you're unhappy with how we've handled your data, contact us first at enquiries@epsomsmiles.co.uk. You may also complain to the Information Commissioner's Office at ico.org.uk or by calling 0303 123 1113.
See also our Complaints Policy for our general complaints procedure.