Data Protection and GDPR
This page explains how Flora Dental Lab handles the personal data that reaches us when your practice sends a case. It is written for the practices we work with, not for patients.
Who is who under the UK GDPR
Your practice is the data controller. You decide what patient data is collected and why. Flora Orthodontics Ltd, trading as Flora Dental Lab, acts as a data processor. We only process what you send us, only to fabricate the custom-made device you prescribed, and only on your instructions.
What we receive, and why
- Prescription details: the appliance, the specification, the shade, the dates. Needed to make the device.
- Patient identifiers: usually a name or a reference so the case can be matched back to the right patient. We ask for the minimum that lets you identify the case. A practice reference is enough if you prefer.
- Clinical records: intraoral scans (STL, DCM), photographs, and physical impressions or models.
- Practice contact details: so we can reach the clinician about the case.
We do not contact patients, we do not market to them, and we never use case data for anything other than making and delivering the device you asked for.
How long we keep it
We keep case records for as long as we are required to under the MHRA rules for custom-made devices, so that a device can be traced back to its prescription and its materials. Beyond that retention period, records are deleted or destroyed securely. [[Exact retention period to be confirmed and stated here]]
Where it goes
Cases travel between your practice and our laboratory by tracked courier or post. Digital files reach us through your scanner manufacturer or by direct upload. Part of our fabrication is carried out by vetted production partners, who are bound by written processing terms and receive only what they need to make the device.
The processing agreement
We hold a written data processing agreement for practices that need one for their own compliance file. It sets out the subject matter, the duration, the nature and purpose of the processing, the categories of data, and our obligations as processor. To receive a copy for signature, email info@floradental.co.uk.
Note: the version currently in circulation carries a previous registered address and cites the Data Protection Act 1998. A reissued version reflecting our Slough address and the UK GDPR is being prepared. Ask us for the current version rather than relying on an older copy.
Breaches
If we become aware of a personal data breach affecting your cases, we notify your practice without undue delay so that you, as controller, can meet your own reporting obligations.
Contact and regulator
Data protection queries: info@floradental.co.uk, or write to us at 9 Station Road, Cippenham, Slough, SL1 6JJ.
Our supervisory authority is the Information Commissioner’s Office (ICO). ICO registration number: [[to be supplied]]. You can contact the ICO at ico.org.uk.
