Data Retention Policy for Duffield Dental Practice

Duffield Dental Practice**

Last updated: 22/04/26
Applies to: Duffield Dental Practice and www.duffielddentist.co.uk

1. Purpose of This Policy

This Data Retention Policy outlines how long Duffield Dental Practice (“we”, “our”, “us”) keeps personal data, how it is securely stored and when it is deleted. We are committed to retaining data only for as long as necessary in line with:

  • UK GDPR
  • Data Protection Act 2018
  • NHS and General Dental Council (GDC) requirements
  • ICO guidance on secure retention and disposal

2. What Data We Collect

We retain different types of data for different periods depending on legal, clinical and administrative requirements. These may include:

  • Patient contact details
  • Medical histories and clinical notes
  • X-rays and digital scans
  • Appointment records
  • Financial information relating to treatment
  • Website enquiry form submissions
  • Staff, supplier and contractor information

3. Retention Periods

Below are the standard retention times we follow:

3.1 Patient Records (Adults)

  • Minimum 11 years from the date of the last entry
    or
  • Until the patient reaches 25 years old (whichever is longer, in the case of minors approaching adulthood)

3.2 Patient Records (Children)

  • Until the patient is 25 years old
    or
  • 11 years after the last treatment
    (Whichever date occurs later, as per NHS regulations)

3.3 Radiographs, Scans & Clinical Images

  • Stored as part of the patient record
    → Retained for the same period as patient records

3.4 Website Form Submissions

  • Name, contact details, and message submitted via website forms
    → Transferred promptly to patient notes (where relevant)
    → Deleted permanently from the WordPress system on a regular basis
    We do not store website form data long-term on the website.

3.5 Financial Records

(Receipts, invoices, treatment plans with costs)

  • Minimum 7 years for accounting and HMRC compliance.

3.6 Staff Employment Records

  • Up to 6 years after employment ends
    (some data, such as exposure or vaccination records, may be retained longer depending on legal requirements)

3.7 Supplier and Contractor Information

  • Held for the duration of the relationship
  • Deleted 1 year after last contact, unless legally required to retain longer.

4. Secure Deletion and Disposal

When retention periods expire, data is permanently destroyed using secure methods:

  • Digital files are securely wiped and overwritten
  • Physical documents are shredded using cross-cut shredding
  • Website form entries are removed from the WordPress database

5. Individual Rights

Patients and individuals may request:

  • Access to their data
  • Correction of inaccurate data
  • Deletion of data (where legally permissible)
  • Restriction of processing

Requests can be submitted to the practice using the contact details below.

6. Contact

Duffield Dental Practice
Email: info@duffielddentist.co.uk
Telephone: 01332 840780
Address: 59 King St, Duffield, Belper DE56 4EU