This policy explains how Savona Dental collects, uses and protects personal information: what this website does, what happens when you contact us, and how we look after your records if you become a patient.
Last updated: 29 September 2026
Who we are
Savona Dental is run by Savona Dental Limited, a company registered in England and Wales (company number 15753798), with its registered office at Harcourt Tower, 69 Marsh Wall, London E14 9YE. We are the data controller for the personal information described in this policy, and we are registered with the Information Commissioner's Office (registration number ZB737255).
For anything about your personal information, email enquiries@savonadental.com, call 020 4579 6698, or write to us at the address above.
Information we collect through this website
We only collect what you choose to send us, plus limited technical information about your visit.
- Enquiry forms. Your name, email address and phone number, and anything you write in your message. The corporate and insurance form also asks for your company's name and phone number, its number of employees and an HR contact name.
- Online booking. Our "Book Now" buttons take you to our online booking system, provided by CareStack. The details you enter there are sent to the practice.
- WhatsApp. If you message us on WhatsApp, we receive your phone number, your profile name and your messages. WhatsApp itself is run by Meta, under its own terms and privacy policy.
- Your visit. The pages you view, how you arrived, your device and browser, and your approximate location, collected by Google Analytics (see Cookies below). Our hosting provider also keeps short-lived server logs, including IP addresses, to keep the website secure and working.
You don't need to give us medical details in a website form: a short description is enough, and we will talk through the rest with you.
How we use it, and our lawful basis
UK data protection law (UK GDPR and the Data Protection Act 2018) only allows us to use personal information when we have a lawful basis to do so:
- Replying to your enquiry or booking request: to take the steps you have asked for before you become a patient, and our legitimate interest in answering people who contact us.
- Health information you choose to share with us: used only to respond to you and arrange appropriate care, under the healthcare condition in Article 9(2)(h) of UK GDPR.
- Understanding how the website is used: our legitimate interest in improving it.
- Keeping the website secure: our legitimate interest in protecting it and the people who use it.
- Marketing emails: only if you have agreed to receive them. You can withdraw your agreement at any time, using the unsubscribe link in any email or by contacting us.
If you become a patient
To provide safe dental care we keep a clinical record for every patient. It includes your contact details, date of birth, medical history, notes of your appointments and treatment, X-rays, photographs and scans, correspondence with you, and payment and insurance details.
We use it to plan and provide your care, to contact you about appointments and treatment, to take payment, and to meet our legal and professional obligations. Our lawful bases are the contract for your treatment and our legal obligations, and for health information, the provision of healthcare (Article 9(2)(h) of UK GDPR).
We only share patient information when your care needs it or the law requires it, for example with:
- other healthcare professionals involved in your care, such as a practitioner we refer you to, or your GP;
- dental laboratories that make items such as crowns, dentures and aligners;
- your dental insurer or finance provider, when you ask us to deal with them;
- our regulators, the Care Quality Commission and the General Dental Council, or anyone else the law requires us to share it with.
Who else handles your information
We don't sell personal information, and we don't share it with anyone for their own marketing. These providers handle information on our behalf, under contracts that require them to protect it:
- Vercel, which hosts this website.
- Resend, which delivers the website's enquiry forms to our inbox.
- Google, for our email (Google Workspace) and website analytics (Google Analytics).
- CareStack, our online booking system.
Some of these providers are based in, or process information in, the United States. When personal information leaves the UK it is protected by UK adequacy regulations (including the UK–US "data bridge" for certified US companies), or by the data transfer contracts approved by the Information Commissioner's Office (the International Data Transfer Agreement and Addendum).
How long we keep it
- Website enquiries: only as long as we need to deal with your enquiry and any follow-up. If you become a patient, the relevant details become part of your patient record.
- Patient records: at least 11 years after your last treatment. For children, 11 years or until their 25th birthday, whichever is longer. These are the minimum periods set by the NHS Records Management Code of Practice, which we follow.
- Analytics data: Google Analytics keeps detailed data for no more than 14 months, the longest period it offers. Its summary reports do not identify you.
- Server logs: kept by our hosting provider for a short period, for security.
Cookies
Cookies are small files that a website stores in your browser. This website uses:
- Google Analytics cookies (_ga and _ga_EJV1HE86C8), set when you visit, to count visits and show us which pages are useful. They last up to two years. Google signals and advertising features are switched off, and Google states that Google Analytics 4 does not log or store IP addresses.
- Two settings saved in your browser, which are never sent to anyone: that you have seen our cookie notice, and that you have closed our new-patient offer (remembered for 30 days).
We don't use advertising or retargeting cookies, and we don't record visitors' sessions.
Content from other services. Some pages show content from other companies, which may receive your IP address and set their own cookies under their own privacy policies:
- Google Maps, for the map showing where we are.
- YouTube, for video previews. The video player itself, in YouTube's privacy-enhanced mode, only loads when you press play.
- Instagram, for our latest posts on the homepage, when they are shown.
Your choices. You can block or delete cookies in your browser settings, or install Google's browser add-on for opting out of Google Analytics. This website works normally without cookies.
Your rights
You have the right to:
- ask for a copy of the personal information we hold about you;
- ask us to correct anything that is wrong or incomplete;
- ask us to delete your information, where we don't have to keep it (we must keep clinical records for the periods above);
- ask us to restrict how we use it, or object to our using it, including where we rely on our legitimate interests;
- ask for information you gave us to be transferred to another organisation, where that applies;
- withdraw your consent at any time, where we rely on it.
To use any of these rights, contact us using the details above. We will reply within one month, and there is usually no charge. We don't make decisions about you by automated means.
Complaints
If you are unhappy with how we have handled your information, please tell us first so that we can try to put it right. You can also complain to the Information Commissioner's Office: online at ico.org.uk/make-a-complaint, by phone on 0303 123 1113, or by post to Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
Keeping it secure
This website only uses encrypted (HTTPS) connections. We limit access to personal information to the people and providers who need it, and our providers are required to keep it secure.
Children
When we treat children, a parent or guardian usually gives us their information. Children who are old enough to understand their rights can use them themselves; otherwise a parent or guardian can do so on their behalf.
Changes to this policy
When the way we use personal information changes, we will update this policy and the date at the top.