Privacy policy

Who we are

Dental (Pvt) Ltd operates the dental practices at Ward Place Colombo, High Level Road Nugegoda and Lewis Place Negombo, and is the data controller for the information described in this policy.

Questions about this policy, or any request relating to your data, should be sent to our Data Protection contact at hello@dental.lk or by post to the Colombo practice.

Information we collect

• Identity and contact details: your name, date of birth, address, phone number and email address.
• Appointment information: the branch, dentist, date, time, appointment reason and any note you add when booking.
• Health information: medical history, dental history, clinical notes, radiographs, photographs and treatment records.
• Payment information: amounts, dates, method and insurer details. We never store full card numbers — card payments are processed by our payment provider.
• Guardian details where a patient is under 18, and emergency contact details where you provide them.
• Website information: pages visited and general usage statistics, collected only where you have accepted analytics cookies.

Why we hold it and on what basis

We hold your contact and appointment information in order to provide the dental care you have asked us for, and to contact you about your appointments.

We hold your health information because it is necessary for the provision of health care and because we are professionally and legally required to keep accurate clinical records.

We hold payment records to meet accounting and tax obligations.

We send you marketing or newsletter content only where you have separately opted in, and you can withdraw that consent at any time without it affecting your care.

Who we share it with

We do not sell your data, and we never share health information with advertising or analytics platforms.

• Our clinicians and staff who are involved in your care, on a need-to-know basis.
• Dental laboratories, where a restoration is being made for you. They receive only what is required to make it.
• Specialists or hospitals, where you are referred and you have agreed to that referral.
• Your insurer, where you have asked us to claim or settle directly on your behalf.
• Our IT, SMS, email and payment providers, who process data on our instructions under written agreements.
• Regulators, courts or authorities, where we are legally required to disclose.

How long we keep it

Adult clinical records are retained for at least ten years after your last appointment. Records for patients treated as children are retained until their twenty-fifth birthday, or ten years after the last appointment, whichever is later.

Contact enquiries that do not lead to an appointment are deleted after twenty-four months. Notification delivery logs are kept for twelve months. Website analytics data is retained for fourteen months.

Your rights

We respond to requests within thirty days. There is no charge unless a request is repetitive or excessive.

• Ask for a copy of the information we hold about you.
• Ask us to correct anything inaccurate in your contact details or records.
• Ask us to delete information, where we are not required to retain it for clinical or legal reasons.
• Object to, or withdraw consent for, marketing communications at any time.
• Ask us to restrict how we use your information while a concern is being resolved.
• Complain to the relevant supervisory authority if you are not satisfied with our response.

How we protect it

Clinical systems are accessed only through individual named accounts with role-based permissions, and access to records is logged. Data is encrypted in transit and sensitive fields are encrypted at rest. Backups are encrypted and stored separately from our main systems.

We do not include clinical details in SMS or WhatsApp messages, and we do not put identifying information in web addresses.