Last reviewed: September 2026
This notice explains how Garton & Garton Limited collects, uses, stores and shares personal information when you are referred to Dr Stuart Garton or another clinician working on behalf of Garton & Garton Limited for dental implant or related dental care.
It applies particularly where information about you has been provided to us by your own dentist or another healthcare professional.
The data controller for information processed as part of this clinical referral service is:
Garton & Garton LimitedCompany number: 13193117Registered office: 167–169 Great Portland Street, 5th Floor, London, W1W 5PFEmail: smile@drstuartgarton.com
Garton & Garton Limited determines how and why personal information received through the referral pathway is used.
Clinical treatment may sometimes be delivered at another dental practice. Where another practice independently determines how it uses information about you, it may also act as a separate data controller and will have its own privacy information.
The referral pathway may be promoted through the Engage Implant website. Engage Implant Education Limited is not the clinical data controller for referrals made to Garton & Garton Limited, and identifiable clinical referral information is not used for Engage Implant course marketing or delegate education.
We may receive information:
Where your information is supplied by a referring dentist, they should normally have discussed the referral with you and explained that relevant information will be shared to enable us to assess and, where appropriate, treat you.
Depending upon the nature of your referral, this may include:
Health information is treated as confidential special-category personal data and receives additional protection under data-protection law.
We aim only to collect information that is relevant and necessary for your care.
We may use your information to:
We will not use confidential clinical referral information for unrelated marketing purposes.
Under the UK General Data Protection Regulation and Data Protection Act 2018, we must have a lawful basis for processing personal information.
Depending on what we are doing, we may rely upon:
Legitimate interests – Article 6(1)(f)Where it is necessary for us to receive and manage appropriate clinical referrals, communicate with patients and healthcare professionals and operate a safe and effective private dental service.
Contract – Article 6(1)(b)Where processing is necessary to take steps requested by you before treatment or to provide services under our treatment relationship with you.
Legal obligation – Article 6(1)(c)Where information must be processed or retained to comply with a legal or regulatory obligation.
Because clinical and medical information is special-category data, we also rely primarily upon:
Article 9(2)(h) UK GDPR – provision of health care or treatment, together with the relevant condition under Schedule 1, Part 1 of the Data Protection Act 2018.
Clinical information is processed by, or under the responsibility of, healthcare professionals who are subject to professional duties of confidentiality.
Where necessary in relation to complaints, claims or legal proceedings, other lawful conditions may apply, including Article 9(2)(f), relating to the establishment, exercise or defence of legal claims.
Your agreement to your dentist making a referral is important from a professional confidentiality perspective. However, this is separate from "consent" as a lawful basis under UK GDPR, and we do not ordinarily rely upon UK GDPR consent to maintain your clinical record or provide necessary healthcare.
Where necessary for your care or where otherwise permitted by law, information may be shared with:
We only share information that is reasonably necessary for the relevant purpose.
Anyone processing information on our behalf is expected to maintain appropriate confidentiality, security and data-protection standards.
Referral care often requires communication between Garton & Garton Limited and the dentist who referred you.
This may include information about:
This information is shared to support safe and joined-up healthcare.
You may discuss any concerns you have about information being shared with the clinician responsible for your care.
We take appropriate technical and organisational measures to protect confidential information against loss, inappropriate disclosure, alteration or unauthorised access.
These measures include, where appropriate:
Confidential clinical information should only be transferred using appropriately secure methods.
We may use carefully selected organisations to provide services such as clinical software, secure referral systems, communications, IT hosting, backup or administration.
Where these organisations process personal information on our behalf, appropriate contractual and security arrangements are put in place.
Where information is processed outside the United Kingdom, we will ensure that an appropriate lawful transfer mechanism and safeguards are in place where required by UK data-protection law.
Receiving clinical care through this referral pathway does not mean that your identifiable information, photographs, radiographs or treatment will automatically be used for teaching, professional education, publication, social media or marketing.
Where identifiable patient material is proposed for such a purpose, this will be dealt with separately and appropriate permission will be obtained where required.
Fully anonymised information that can no longer identify an individual may be used for legitimate purposes such as clinical audit, service evaluation or education.
Clinical dental records are retained for appropriate clinical, professional, legal and regulatory purposes.
As a general retention period, dental clinical records will normally be retained for at least 11 years following the last relevant clinical entry or completion of treatment.
For patients treated as children, records may need to be retained for longer, generally until at least the patient's 25th birthday, or 26th birthday where treatment ended when the patient was 17, where this results in a longer retention period.
Records may be retained for longer where there is an appropriate clinical, safeguarding, regulatory, indemnity or legal reason to do so.
Information that no longer needs to be retained will be securely deleted or destroyed.
Depending on the circumstances, you may have the right to:
These rights are not absolute. For example, we may be required or entitled to retain clinical records even where a patient asks for them to be deleted.
We may need to confirm your identity before releasing confidential information.
We do not make decisions about your clinical care solely through automated decision-making or profiling.
Clinical decisions relating to your suitability for implant or dental treatment are made by appropriately qualified clinicians.
You can discuss concerns about confidentiality or sharing information at any stage.
There may be circumstances where some information must be shared or retained because of professional, safeguarding or legal requirements. Where appropriate, we will explain this to you.
If you have questions about how Garton & Garton Limited uses your information, or wish to exercise a data-protection right, please contact:
Garton & Garton LimitedEmail: smile@drstuartgarton.com
If you remain concerned about the way your personal information has been handled, you also have the right to raise a concern with the:
Information Commissioner's OfficeWycliffe HouseWater LaneWilmslowCheshireSK9 5AFHelpline: 0303 123 1113
We would welcome the opportunity to address your concern directly first.
We may update this notice from time to time to reflect changes in our clinical services, technology, suppliers or legal requirements.
The current version will be made available through our clinical referral service and website.
