Privacy Policy

Who we are

First Smiles Clinic LTD trading as First Smiles is a private children's dental practice based at 100 Hagley Road, Birmingham, B16 8LT.

If you have any questions about this privacy policy or how we use personal information, you can contact us at hello@firstsmiles.co.uk or call 01217 989 058.

The information we may collect

Depending on how you interact with us, we may collect:

• parent or guardian details such as name, phone number, email address and postal address;
• child patient details such as name, date of birth and appointment information;
• health and dental information needed to assess, plan and provide treatment;
• information you include in emails, phone calls, WhatsApp messages, referral messages or other enquiries;
• booking details submitted through our online booking provider, CareStack;
• professional referral information sent to us by other clinicians or practices;
• limited technical website data such as IP address, browser information and security logs collected through our hosting and security providers.

How we use personal information

We use personal information to:

• respond to enquiries and arrange appointments;
• provide dental care, advice and treatment;
• keep clinical records and manage follow-up care;
• communicate with parents, guardians, patients, referrers and other healthcare professionals where appropriate;
• manage billing, administration, complaints and legal or regulatory obligations;
• keep our website, systems and booking services secure and working properly.

Our lawful bases

Under UK data protection law, we must have a lawful basis for using personal information. Depending on the situation, we may rely on one or more of the following:

• contract, where we need your information to arrange or provide services you have asked for;
• legal obligation, where we need to keep records or meet legal, tax, regulatory or professional duties;
• legitimate interests, where we need to run and protect our practice and website in a fair and proportionate way;
• consent, where we specifically ask for it.

Where we use health information or other special category data, we do so because it is necessary for the provision and management of health care, or because another condition under data protection law applies.

Children's information

Our services are for children, so we often process information about child patients and their parents or guardians. We expect a parent, guardian or another person with legal authority to provide information on a child's behalf where appropriate.

Online booking through CareStack

If you click our online booking link, you will be taken to CareStack's booking system. Information entered there is submitted within CareStack rather than on this website.

We use the information received through that booking system to arrange and manage appointments. CareStack acts as a service provider for dental practices and private healthcare providers. You should also review CareStack's own privacy information when using that service.

Who we share information with

We may share information where necessary with:

• our booking and practice management provider, CareStack;
• other healthcare professionals, referrers, laboratories or service providers involved in your care;
• our website hosting, security and infrastructure providers, including Cloudflare;
• professional advisers, insurers, regulators, courts or law enforcement where required;
• payment, accounting or administrative providers where necessary to run the practice.

We only share information where there is a valid reason to do so and only to the extent reasonably necessary.

Website services, cookies and third parties

Our website may use Cloudflare security and website delivery services. These services can involve technical logs and strictly necessary cookies used for security, traffic management and website delivery.

Strictly necessary cookies are cookies that are essential for the website to operate properly or to provide a service you have asked for, such as keeping the site secure, managing network traffic, or ensuring pages are delivered reliably. Because these cookies are necessary for the operation of the site, they do not usually require consent under UK cookie rules, although we still explain them here for transparency.

We also use third-party services such as Google Fonts, Font Awesome, Instagram, WhatsApp, map links and CareStack booking links. When you load content from or click through to these services, they may receive technical information such as your IP address or browser details under their own privacy terms.

International transfers

Some of our service providers may process information outside the UK. Where that happens, we expect appropriate safeguards to be in place, such as adequacy regulations or approved contractual protections.

How long we keep information

We keep personal information only for as long as reasonably necessary for the purpose it was collected, including to provide care, maintain clinical records, deal with complaints, meet legal or regulatory obligations, and defend legal claims.

Retention periods may vary depending on the type of record. Clinical records are usually kept for longer than general website or enquiry data because of healthcare and legal requirements.

How we protect information

We take appropriate technical and organisational measures to protect personal information from loss, misuse, unauthorised access, disclosure or alteration. These measures include access controls, secure systems and provider-level security protections.

Your rights

Depending on the circumstances, you may have the right to:

• ask for access to the personal information we hold about you;
• ask us to correct inaccurate or incomplete information;
• ask us to erase information in some situations;
• ask us to restrict how we use information in some situations;
• object to certain processing;
• ask for a copy of information you have provided to us in a portable format, where applicable;
• withdraw consent where we rely on consent.

To exercise any of these rights, please contact us using the details above.

Complaints

If you have concerns about how we use personal information, please contact us first and we will do our best to help.

You also have the right to complain to the Information Commissioner's Office: ico.org.uk.

Changes to this policy

We may update this privacy policy from time to time. Any significant changes will be posted on this page with a revised last updated date.