Privacy notice

Chafford Hundred Dental Care (including Smile & Face, Smile Tweak and Chafford Aligners)

Last updated: 30 October 2026

In short: we use your details to reply to you, book and run your appointments, provide your dental care and take deposits and payments. Some of that is health information, which we protect carefully. We never sell your data. We never send your health or appointment details to Meta (Facebook, Instagram) or Google for advertising. You have rights over your data, and you can complain to us or to the Information Commissioner's Office (ICO).

This notice covers drbasrai.co.uk, smileandface.co.uk, smiletweak.co.uk and chaffordaligners.co.uk, and the WhatsApp, website chat, phone, text and email contact you have with us through them.

1. Who we are

Chafford Hundred Dental Care is a private dental practice run by Dr Jagmail Basrai as a sole trader. Dr Basrai is the "data controller". That means he decides how and why your personal data is used and is responsible for it. Smile & Face, Smile Tweak and Chafford Aligners are names we use for the same practice and its treatments.

• Address: Chafford Hundred Dental Care, Drake Road, Chafford Hundred, Grays, Essex RM16 6SE
• Phone: 01375 481000
• WhatsApp: 07300 421405
• Email: [email protected]
• ICO registration number: ZA515381

Your contact for anything about your data is Dr Jagmail Basrai, using the details above. We are not required to appoint a Data Protection Officer, so Dr Basrai is responsible for data protection at the practice.

2. What information we collect

When you get in touch - Website enquiry forms: your name, phone number, email address and what you'd like help with. If you use "Send us a selfie", the photo you choose to send. - Website chat: your name, contact details and the messages you send. - WhatsApp: your name, number, the messages you send (and any photos you choose to send) and the details of any appointment we book for you. - Phone calls: your number, why you called and what was agreed. - Email: your email address and what you write to us.

When you book - The appointment you choose, any deposit you pay (we see that a payment was made, not your full card number), and whether you are 18 or over where we ask.

When you become a patient - Your name, date of birth, address and contact details, and an emergency contact if you give one. - Health information, such as your medical history, medicines, dental records, X-rays, scans, photos, treatment plans and clinical notes. This is "special category" data and gets extra protection in law. - Payment details and, if you choose to apply, patient finance details.

When you visit our websites - Technical information such as your device, browser, the pages you view and how you arrived (for example from a search or an advert). Some of this uses cookies. See our Cookie policy for the full list.

Please don't send detailed medical information through the website form. If you need to tell us something clinical, we can talk it through by phone or at the practice.

3. Why we use it, and our lawful basis

Data protection law says we need a lawful basis for each use. For health information we also need an extra condition.

What we do	Lawful basis
Reply to your enquiry and book, change or remind you about appointments	Taking the steps you ask for before you become a patient, and providing your care (UK GDPR Article 6(1)(b), contract)
Provide your dental care and keep your clinical records	Contract for your private care (Article 6(1)(b)). For health information: providing health care (Article 9(2)(h) and the Data Protection Act 2018, Schedule 1, paragraph 2), by or under the responsibility of health professionals who owe you a duty of confidentiality
Keep records the law requires (for example X-ray records, accounts and tax records) and meet our duties to regulators such as the Care Quality Commission and the General Dental Council	Legal obligation (Article 6(1)(c)). For health information, Article 9(2)(h), and Article 9(2)(f) where we need to deal with a legal claim
Take deposits and payments	Contract (Article 6(1)(b)), and legal obligation for our financial records (Article 6(1)(c))
Send you offers and news about our treatments	Your consent (Article 6(1)(a) and the Privacy and Electronic Communications Regulations). You can withdraw it at any time
Website analytics cookies, and (on smileandface.co.uk) Google Ads cookies to measure our adverts	Your consent (Article 6(1)(a) and the Privacy and Electronic Communications Regulations). You can withdraw it at any time

We will not use your data for a new, unrelated purpose without telling you first.

4. Our booking assistant (Ava)

Ava is an AI assistant that answers our WhatsApp messages and website chat and helps with booking. She says she is an AI assistant. She can answer general questions about the practice, find appointment times, book appointments and send deposit links. She never gives clinical advice; clinical questions are passed to the dentist. If Ava is unsure, or you ask for a person, our team will contact you. Ava does not make decisions about you that have a legal or similarly significant effect, and you can always change or cancel a booking by talking to our team.

5. Messages from us, and marketing

• Appointment and service messages: if you give us your mobile number for an appointment, we send confirmations, reminders and practical information by WhatsApp from 07300 421405 and by text. These are part of your care, not marketing.
• Marketing: we only send offers and news about our treatments, and practice news, by WhatsApp, text or email, if you have said yes. You can say yes by pressing "Yes please" when we ask on WhatsApp, or by ticking the optional box on our enquiry form: "Yes, I'd like to hear about offers and news from Chafford Hundred Dental Care by WhatsApp, text or email. I can stop at any time." The box is never ticked for you, and you don't need to tick it to send an enquiry or book. Our marketing never refers to your own treatment or appointments.
• Stopping marketing: reply STOP to any WhatsApp or text message, use the unsubscribe link in any marketing email, or contact us, and we will stop straight away. Saying no will never affect your care.

6. Advertising (Facebook, Instagram and Google)

We advertise on Facebook and Instagram, which are run by Meta, and on Google.

• We do not send Meta (or Google) any health information, appointment details or attendance information for advertising or to measure our adverts.
• We do not upload lists of our patients or their contact details to Meta.
• Our websites do not use the Meta Pixel or any other Meta tracking code. If we ever want to add it, we will update this notice and our Cookie policy first, and it will only load if you say yes in our cookie settings.
• On smileandface.co.uk only, we use Google Ads cookies, only if you say yes, to measure whether our Google adverts lead to enquiries. We have switched off personalised advertising for these cookies, and we don't use visits to our pages to show you adverts afterwards ("remarketing").
• If you tap one of our Facebook or Instagram adverts, or message us from one, Meta knows that from your own Facebook or Instagram use, under Meta's own privacy policy (facebook.com/privacy/policy).
• We work out which adverts lead to bookings inside our own systems, using the advert or link you came from. We do not tell Meta.

7. Who we share your information with

We only share what is needed, and we never sell your data. The companies below act for us under contract ("processors") unless we say otherwise.

Who	What they do for us
HighLevel (LeadConnector)	Hosts these websites and runs our enquiry forms, website chat, customer management system, WhatsApp inbox, Ava, messaging and reviews widget
Dentally	Our practice management system, where appointments and clinical records are kept
Make.com	Passes the Chafford Aligners enquiry form details into our systems
Stripe	Takes card payments for deposits. We never see or store your full card number
Twilio	Carries our phone calls and text messages
WhatsApp (Meta)	Delivers WhatsApp messages between you and us
Fly.io	Hosts our booking server, which connects our systems, in its London (UK) region
Google Analytics	Website visit statistics, only if you accept analytics cookies
Google Ads (smileandface.co.uk only)	Measuring whether our Google adverts lead to enquiries, only if you accept advertising cookies
Tabeo	Patient finance, only if you choose to apply. Tabeo uses your details under its own privacy notice

We may also share information with people involved in your care (such as dental laboratories, specialists and hospitals we refer you to, and your GP where needed), our accountant and IT support, our professional advisers and indemnity provider, and regulators, the police or courts when the law requires it.

About Meta (including WhatsApp). For people in the UK, the Meta company involved is Meta Platforms, Inc., 1 Meta Way, Menlo Park, CA 94025, USA. Depending on the service, Meta acts as our service provider (processor) or, for some uses, as a joint controller with us, and afterwards uses information as an independent controller under its own privacy policy. WhatsApp's privacy policy is at whatsapp.com/legal/privacy-policy.

8. Information sent outside the UK

Some of our providers, including HighLevel, Stripe, Twilio, Google and Meta, are based in the United States or use servers outside the UK. When your data leaves the UK we make sure it is protected in a way the law allows. For Meta Platforms, Inc., the transfer is covered by the UK Extension to the EU-US Data Privacy Framework (Meta is certified) and Meta's UK Data Transfer Addendum. For other providers we rely on the UK Extension to the Data Privacy Framework where they are certified, or on the UK's approved contract terms (the International Data Transfer Agreement or the UK Addendum). You can ask us for details.

9. How long we keep it

• Dental records (adults): at least 11 years after your last treatment.
• Dental records (children): until the patient's 25th birthday (26th if they were 17 when treatment ended), or 11 years, whichever is longer.
• Payment and accounting records: at least 6 years, as tax law requires.
• Enquiries and messages from people who don't become patients: 12 months after our last contact, then deleted.
• Marketing: until you say stop. We keep a record of your consent, and of you withdrawing it, for 6 years so we can show we acted properly.
• Cookie choices: your choice is kept on your device for 6 months. Our record of it (which holds no name, contact details or IP address) is kept for 2 years.
• Website analytics (Google Analytics): 14 months.
• Google Ads measurement cookies (smileandface.co.uk): up to 90 days on your device.

After that we securely delete the information, unless we need it for a complaint, a legal claim or a legal duty.

10. Keeping it safe

We use password-protected systems with restricted access, staff training on confidentiality, and providers who meet recognised security standards. Our team only see what they need for their job. If something goes wrong, we will act quickly and tell you and the ICO where the law requires.

11. Your rights

You have the right to:

• be informed about how we use your data (this notice);
• access a copy of the personal data we hold about you;
• ask us to correct information that is wrong or incomplete;
• ask us to erase your data. We can't erase clinical records we must keep by law, but we will explain why;
• ask us to restrict how we use your data;
• object to how we use your data, including an absolute right to object to direct marketing;
• data portability: ask for data you gave us in a common digital format, where this applies;
• withdraw consent at any time, where we rely on consent. Withdrawing is as easy as giving it: reply STOP, use the unsubscribe link in an email, use Cookie settings at the bottom of any page, or contact us;
• not be subject to a decision based solely on automated processing that has a legal or similarly significant effect on you.

To use any of these rights, contact Dr Jagmail Basrai by phone, email or post (details in section 1). It is free in most cases. We may need to check your identity. We will reply within one month, or tell you within that month if we need up to two more months for a complex request.

12. Complaints

If you are unhappy with how we have used your data, please tell us first so we can put it right: email [email protected], call 01375 481000 or write to us at the practice. We will acknowledge your complaint within 30 days and respond without undue delay.

If you are still unhappy, you can complain to the Information Commissioner's Office (ICO): - Website: ico.org.uk/make-a-complaint - Phone: 0303 123 1113 - Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

13. Children and age

We treat children with a parent or guardian. Our websites and WhatsApp are meant for adults, so a parent or guardian should contact us for a child. Smile Tweak and our marketing are for adults aged 18 or over.

14. Cookies

We only use non-essential cookies, such as Google Analytics (and Google Ads cookies on smileandface.co.uk), if you say yes. You can change your mind at any time with Cookie settings at the bottom of every page. Our Cookie policy lists every cookie and similar technology on our websites.

15. Changes to this notice

We update this notice when our services or the law change. The date at the top shows the latest version.