Staff Privacy Notice
ONE SPECIALIST CLINICS LTD / ONE ORTHODONTICS

1. About this notice

​

This notice explains how ONE Specialist Clinics Ltd ("the Company", "we", "us") collects and uses personal data about you as a member of our staff, and your rights in relation to that data. It applies to employees, and (where relevant) to workers, contractors, trainees, locums and associates. It does not apply to patient data, which is covered by our separate main Privacy Notice, or to job applicants, who are covered by our separate Recruitment Privacy Notice.

We are the data controller for the personal data described here. This means we are responsible for deciding how your data is held and used.

If you have any questions about this notice or how we handle your data, please contact Dr Chris David Donaldson.

​

2. The data we hold about you

​

In the course of your employment we collect and process the following categories of personal data:

• Identity and contact details: name, address, telephone number, personal email, date of birth, emergency contact details.

• Right-to-work and identity verification: passport, visa or other right-to-work documentation; National Insurance number.

• Recruitment information: application, references, interview records (transferred from the recruitment process where relevant).

• Professional registration and qualifications: GDC registration number and status, professional indemnity details, qualifications, CPD records, and training records (including any qualification undertaken with a training provider).

• Employment records: contract, job role, hours, start date, probation and performance records, absence records, disciplinary and grievance records, correspondence relating to your employment.

• Payroll and financial data: salary, bank account details, tax code, pension contributions, statutory payments.

• Pension data: auto-enrolment status and contributions.

We also process the following special category data, which is subject to additional protection:

• Health data: occupational-health and immunisation records (including Hepatitis B and other immunisations relevant to a clinical role), and sickness-absence information.

• Criminal records data: the outcome of Disclosure and Barring Service (DBS) checks, as required for a regulated clinical role.

We may also process equality and diversity information (such as ethnicity) where you choose to provide it, for equal-opportunities monitoring.

​

3. Where we get your data from

​

Most of the information we hold comes directly from you. We also obtain information from third parties in the course of your recruitment and employment, including:

• Referees and previous employers, when we take up references.

• Recruitment and locum agencies, where you were introduced to us or previously supplied through an agency.

• Our occupational-health provider, for immunisation evidence and fitness-to-work assessments.

• The Disclosure and Barring Service, for criminal-records check outcomes.

• Professional registers and training providers, for example the General Dental Council, General Medical Council register and course providers, to verify registration, qualifications and training progress.

• Government departments and public bodies, for example HMRC and the Department for Work and Pensions, in connection with tax, National Insurance and statutory payments.

• Publicly available sources, for example professional registers and professional networking profiles, where relevant to your role.

​

4. Why we process your data, and our lawful bases

​

We process your personal data on the following lawful bases under the UK GDPR:

• Performance of your employment contract. To administer your employment, pay you, manage your work, and provide the role you are employed to do.

• Compliance with a legal obligation. For example, to meet our duties on tax and National Insurance (HMRC), pension auto-enrolment, right-to-work checks, and health-and-safety and clinical-governance requirements.

• Our legitimate interests. To run the clinic efficiently and safely, maintain records, manage performance, and protect the Company, our patients and our staff. Where we rely on legitimate interests, we have considered the impact on you and do not process your data in a way that overrides your interests.

• Your consent — in the limited cases where we ask for it (for example, certain equality-monitoring information). Where we rely on consent, you may withdraw it at any time.

For special category data (health and DBS data), we additionally rely on the conditions in the UK GDPR and Data Protection Act 2018 for:

• employment, social security and social protection purposes (for example, occupational-health clearance and sickness absence);

• the assessment of your working capacity (occupational health); and

• compliance with regulatory and safeguarding requirements appropriate to a clinical role (DBS).

We hold an appropriate policy document for the processing of special category and criminal-records data, as required by the Data Protection Act 2018.

 

5. Who we share your data with

​

We share your data only where necessary, and with appropriate safeguards, including:

• HM Revenue & Customs (HMRC); for tax and National Insurance.

• Our payroll provider; to process your pay.

• Our pension scheme provider;  for auto-enrolment and contributions.

• Our occupational-health provider; for immunisation and fitness-to-work assessments.

• The Disclosure and Barring Service for criminal-records checks.

• Training providers, where you are undertaking a qualification, in line with the relevant training agreement.

• Our professional and regulatory bodies, where required (for example, in connection with GDC matters).

• Our IT, practice-management and cloud-storage providers for example Microsoft 365, which store records securely on our behalf under written data-processing agreements.

• Our professional advisers,  for example HR, legal or accountancy advisers, where necessary.

Where we use a third party to process your data on our behalf, we have a written agreement in place requiring them to keep it secure and to process it only on our instructions.

We do not sell your data, and we do not transfer it outside the UK except where appropriate safeguards are in place.

 

6. Automation and artificial intelligence

​

The Company uses automation and artificial intelligence (AI) tools to support the running of the clinic — for example in scheduling, drafting documents and correspondence, and administrative workflows. Where these tools process staff personal data, they do so under the same lawful bases, safeguards and processor agreements described in this notice.

​

These tools assist our work; they do not replace human judgement. We do not make any decision that has a legal or similarly significant effect on you (for example decisions about recruitment, pay, discipline or dismissal) based solely on automated processing. Any such decision always involves meaningful human review by an appropriate person.

 

If we ever introduce decisions of that kind, we will apply the safeguards required by Articles 22A–22D UK GDPR (as amended by the Data (Use and Access) Act 2025): we will tell you that the decision has been made and explain how, and you will be able to make representations, obtain meaningful human intervention, and contest the decision. Stricter rules apply, and will be followed, where any such decision would involve your special category data (such as health information).

​

7. How long we keep your data

 

We keep your personal data only as long as necessary:

• Most employment records: for the duration of your employment and for six years after it ends, in line with limitation periods and HMRC requirements.

• Payroll, tax and pension records: as required by HMRC and pension regulations (generally at least six years).

• Occupational-health and immunisation records: in line with relevant guidance for clinical roles

• DBS check outcomes: we retain only a record that a satisfactory check was obtained and its date, in line with DBS retention guidance; we do not retain the certificate itself beyond the period necessary.

Retention periods are set out in our retention schedule, which we review periodically.

 

8. Your rights

 

Under data protection law you have the right to:

• be informed about how we use your data (this notice);

• access the personal data we hold about you;

• request rectification of inaccurate or incomplete data;

• request erasure of your data in certain circumstances (note that some data must be kept for legal reasons);

• request restriction of processing in certain circumstances;

• object to processing based on our legitimate interests;

• data portability in certain circumstances; and

• withdraw consent where we rely on it.

• safeguards in relation to any decision based solely on automated processing that has a legal or similarly significant effect on you, including being told about the decision, making representations, obtaining human intervention, and contesting the decision (see section 6).

To exercise any of these rights, please contact Dr Chris David Donaldson at pm@oneorthodontics.co.uk We will respond within one month.

If you are unhappy with how we have handled your data, you may complain to the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF (0303 123 1113, ico.org.uk). We would, however, appreciate the chance to address your concerns first.

 

9. Your responsibilities

 

Please keep us informed if your personal details change (for example, your address, contact details or bank details), so that our records remain accurate.

 

10. Changes to this notice

 

We may update this notice from time to time. Where we make significant changes, we will bring them to your attention.

This notice should be read alongside your contract of employment and the Company's data protection and information-governance policies.

​

Version: 1.1

Effective date: 05.07.26

Review date: 01.11.27