Privacy Policy

1. About this notice and how to contact the practice

This client-review draft concerns information supplied through the Mona Lisa Smiles website, including enquiries, professional referrals and links to online booking. It does not replace any separate patient or clinical privacy information.

Mona Lisa Smiles is based at 83 Station Road, New Barnet, Barnet EN5 1PX. For privacy questions or requests, email info@monalisasmiles.co.uk, call 020 8449 3411, or write to the practice at that address.

Review needed — controller: [Identify the legal person or organisation responsible for the processing described here, any joint controllers, and the responsible privacy contact or data protection officer if applicable. A trading name, care-provider registration or similarly named company does not by itself establish this role.]

2. Information collected through the website

The contact form requires your full name, phone number, email address and subject. The message field and subscription checkbox are optional. The checkbox labelled “Also subscribe us” is not selected by default.

The professional referral form collects patient and referring-practitioner identity, address and contact details, together with a summary, referral type, medical history, reason for referral and requested treatment. Some fields are required by the form. Its file-upload field is optional and accepts JPG, JPEG, PNG, PDF, DOC and DOCX files up to 10 MB.

The referrals page also offers blank dental and CBCT referral forms and describes referral by email or post. This draft does not establish what additional information is recorded during telephone or email follow-up, in technical logs or in connected clinical systems.

Please supply only information needed for your enquiry or referral. If you are referring a patient, ensure you have appropriate authority to share their information and follow the practice’s arrangements for sending clinical material.

3. Purposes, form routing and legal grounds

The website forms are intended to let people contact the practice and provide professional referral information. Their email templates are configured to send the submitted details to info@monalisasmiles.co.uk. Referral uploads are included as email attachments. The website’s mail service is configured through Microsoft’s SMTP endpoint, smtp.office365.com. These are configuration findings; delivery and the practice’s subsequent handling have not been tested.

A legal basis under Article 6 of the UK GDPR and an appropriate Article 9 condition must be identified where special-category health information is processed. Consent to dental treatment and data-protection consent are different matters.

Review needed — processing details: [Confirm the actual purposes and corresponding Article 6 bases, the Article 9 condition for health information and any associated requirements. Explain which information is legally or contractually required and the consequences of not providing it; form validation alone does not establish that requirement. Confirm whether any automated decisions or profiling with legal or similarly significant effects take place, and provide the required information if they do.]

4. Booking, website services and recipients

Online booking links open the Mona Lisa Smiles booking portal. Its Privacy Policy dialog currently asks visitors to contact the practice for the privacy policy and terms and conditions; it does not supply a substantive practice privacy notice there. Please contact the practice if you need this information before using the booking service.

The website includes Google Analytics through Google Tag Manager, Google Maps and Google review content through Trustindex. The mail configuration described above uses Microsoft’s SMTP service. These observations identify visible services and configured routes, not every supplier or recipient involved in the practice’s processing.

Review needed — recipients and safeguards: [Complete the supplier and recipient information, including hosting, email, IT/support, booking and clinical systems and any further disclosures. Confirm the relevant controller/processor roles, contractual safeguards and actual access arrangements. The observed services do not establish the complete inventory or the practice’s internal security procedures.]

5. International transfers

The names of the services above do not establish where personal information is stored or accessed, or what transfer safeguards apply.

Review needed — transfers: [Confirm any access, storage or transfers outside the UK, the destinations and applicable adequacy arrangements or other safeguards, and how people can obtain information about those safeguards.]

6. Keeping information

Different retention arrangements may apply to general enquiries, referral material and uploaded files, email copies, clinical records, marketing preferences, security logs and analytics information.

Review needed — retention: [Provide meaningful retention periods or criteria for the relevant record types and explain deletion or anonymisation. No practice retention schedule has been verified in the website information reviewed. Cookie lifetimes do not establish clinical, enquiry or email-record retention.]

7. Marketing and subscription choices

The optional “Also subscribe us” selection is included with the contact-form email sent to the practice. An automatic subscription process and what happens to that request after receipt have not been verified.

Review needed — marketing: [Explain whether these details are used for marketing, the offered messages and channels, the applicable permission or other lawful arrangement, any supplier, how preferences are recorded and the unsubscribe route.]

Where processing relies on consent, you can withdraw it without affecting the lawfulness of processing before withdrawal. You can object to use of your information for direct marketing. Contact the practice using the details above for help with your preferences.

8. Cookies, analytics and embedded content

Google Analytics and Tag Manager, Google Maps and third-party review content are present on the website. Cookies or similar technologies may be involved depending on their configuration.

At this review, the website’s WPConsent inventory lists one cookie: wpconsent_preferences, described as storing cookie preferences for 30 days. Its Statistics and Marketing lists have no entries. This is the configured list, not a verified complete inventory of technologies actually used.

The consent banner, script blocking and third-party content blocking are currently disabled, and no Cookie Policy is selected. Google Consent Mode is enabled in the settings, but a functioning visitor choice flow has not been verified. The full technical inventory and any required consent or objection controls still need to be completed and tested.

This review draft does not provide consent to marketing or technologies that require consent. Any applicable statistical exception must be assessed against the actual use and configuration; it must not be assumed merely because a service provides analytics.

9. Your data-protection rights

Depending on the circumstances and legal basis, you may have rights to be informed, access your information, correct inaccuracies, request erasure, restrict processing, receive or transfer certain information and object to processing. Rights are not absolute, and some records may need to be retained to meet applicable obligations.

Where relevant, you also have rights relating to automated decisions and withdrawal of consent. You can object to direct marketing at any time.

Contact the practice using the details above to make a request. Proportionate information may be needed to confirm your identity and clarify your request. Requests must be handled within the applicable legal time limits, including any permitted extensions.

10. Questions and complaints

Raise privacy questions or complaints with the practice at info@monalisasmiles.co.uk, by phone on 020 8449 3411, or in writing to 83 Station Road, New Barnet, Barnet EN5 1PX. Please ask for the person responsible for privacy enquiries.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data-protection regulator.

Review needed — complaint handling: [Identify the responsible contact and actual internal privacy-complaint procedure. Do not substitute data-rights response limits for the practice’s complaint-handling commitments.]

11. Changes to this notice

This draft will need review when the practice’s information-handling arrangements change. The revision date identifies the latest draft update, not approval as the practice’s final policy.