Staff Privacy Notice
ONE SPECIALIST CLINICS LTD / ONE ORTHODONTICS

1. About this notice

This notice explains how ONE Specialist Clinics Ltd ("the Company", "we", "us") collects and uses personal data about you as a member of our staff, and your rights in relation to that data. It applies to employees, and (where relevant) to workers, contractors, trainees, locums and associates. It does not apply to patient data, which is covered by our separate main Privacy Notice, or to job applicants, who are covered by our separate Recruitment Privacy Notice.

We are the data controller for the personal data described here. This means we are responsible for deciding how your data is held and used.

If you have any questions about this notice or how we handle your data, please contact Dr Chris David Donaldson.

2. The data we hold about you

In the course of your employment we collect and process the following categories of personal data:

Identity and contact details: name, address, telephone number, personal email, date of birth, emergency contact details.
Right-to-work and identity verification: passport, visa or other right-to-work documentation; National Insurance number.
Recruitment information: application, references, interview records (transferred from the recruitment process where relevant).
Professional registration and qualifications: GDC registration number and status, professional indemnity details, qualifications, CPD records, and training records (including any qualification undertaken with a training provider).
Employment records: contract, job role, hours, start date, probation and performance records, absence records, disciplinary and grievance records, correspondence relating to your employment.
Payroll and financial data: salary, bank account details, tax code, pension contributions, statutory payments.
Pension data: auto-enrolment status and contributions.

We also process the following special category data, which is subject to additional protection:

Health data: occupational-health and immunisation records (including Hepatitis B and other immunisations relevant to a clinical role), and sickness-absence information.
Separately, criminal records data: the outcome of Disclosure and Barring Service (DBS) checks, as required for a regulated clinical role. This is not special category data but is subject to its own safeguards under the Data Protection Act 2018.

We may also process equality and diversity information (such as ethnicity) where you choose to provide it, for equal-opportunities monitoring. This is special category data and is used only in anonymised or aggregated form.

3. Where we get your data from

Most of the information we hold comes directly from you. We also obtain information from third parties in the course of your recruitment and employment, including:

Referees and previous employers, when we take up references.
Recruitment and locum agencies, where you were introduced to us or previously supplied through an agency.
Our occupational-health provider, for immunisation evidence and fitness-to-work assessments.
The Disclosure and Barring Service, for criminal-records check outcomes.
Professional registers and training providers, for example the General Dental Council, General Medical Council register and course providers, to verify registration, qualifications and training progress.
Government departments and public bodies, for example HMRC and the Department for Work and Pensions, in connection with tax, National Insurance and statutory payments.
Publicly available sources, for example professional registers and professional networking profiles, where relevant to your role.

4. Why we process your data, and our lawful bases

We process your personal data on the following lawful bases under the UK GDPR:

Performance of your employment contract. To administer your employment, pay you, manage your work, and provide the role you are employed to do.
Compliance with a legal obligation. For example, to meet our duties on tax and National Insurance (HMRC), pension auto-enrolment, right-to-work checks, and health-and-safety and clinical-governance requirements.
Our legitimate interests. To run the clinic efficiently and safely, maintain records, manage performance, and protect the Company, our patients and our staff. Where we rely on legitimate interests, we have considered the impact on you and do not process your data in a way that overrides your interests.
Your consent, in the limited cases where we ask for it (for example, certain equality-monitoring information). Where we rely on consent, you may withdraw it at any time.

For special category and criminal records data, we additionally rely on the following conditions in the UK GDPR and Data Protection Act 2018:

health information: employment, social security and social protection purposes (for example, occupational-health clearance and sickness absence);
health information: the assessment of your working capacity (occupational health);
criminal records data (DBS checks): the conditions in Schedule 1 to the Data Protection Act 2018 for employment and safeguarding purposes appropriate to a regulated clinical role; and
equality and diversity information: the condition for equality-of-opportunity monitoring in Schedule 1 to the Data Protection Act 2018, together with your consent where you choose to provide it.

We hold an appropriate policy document for the processing of special category and criminal-records data, as required by the Data Protection Act 2018.

5. Who we share your data with

We share your data only where necessary, and with appropriate safeguards, including:

HM Revenue & Customs (HMRC); for tax and National Insurance.
Our payroll provider; to process your pay.
Our pension scheme provider; for auto-enrolment and contributions.
Our occupational-health provider; for immunisation and fitness-to-work assessments.
The Disclosure and Barring Service for criminal-records checks.
Training providers, where you are undertaking a qualification, in line with the relevant training agreement.
Our professional and regulatory bodies, where required (for example, in connection with GDC matters).
Our IT, practice-management and cloud-storage providers for example Microsoft 365, which store records securely on our behalf under written data-processing agreements.
Providers of AI-assisted drafting and administrative tools, which process documents and correspondence on our behalf under written data-processing agreements that do not permit them to use our information to train their systems.
Our professional advisers, for example HR, legal or accountancy advisers, where necessary.

Where we use a third party to process your data on our behalf, we have a written agreement in place requiring them to keep it secure and to process it only on our instructions.

We do not sell your data, and we do not transfer it outside the UK except where appropriate safeguards are in place.

6. Automation and artificial intelligence

The Company uses automation and artificial intelligence (AI) tools to support the running of the clinic, for example in scheduling, drafting documents and correspondence, and administrative workflows. Where these tools process staff personal data, for example to draft a contract, letter or rota, they do so under the same lawful bases, safeguards and processor agreements described in this notice, and only by staff authorised to use them under our internal policy.

These tools assist our work; they do not replace human judgement. We do not make any decision that has a legal or similarly significant effect on you (for example decisions about recruitment, pay, discipline or dismissal) based solely on automated processing. Any such decision always involves meaningful human review by an appropriate person.

If we ever introduce decisions of that kind, we will apply the safeguards required by Articles 22A - 22D UK GDPR (as amended by the Data (Use and Access) Act 2025): we will tell you that the decision has been made and explain how, and you will be able to make representations, obtain meaningful human intervention, and contest the decision. Stricter rules apply, and will be followed, where any such decision would involve your special category data (such as health information).

7. How long we keep your data

We keep your personal data only as long as necessary:

Most employment records: for the duration of your employment and for six years after it ends, in line with limitation periods and HMRC requirements.
Payroll, tax and pension records: as required by HMRC and pension regulations (generally at least six years).
Occupational-health and immunisation records: in line with relevant guidance for clinical roles
DBS check outcomes: we retain only a record that a satisfactory check was obtained and its date, in line with DBS retention guidance; we do not retain the certificate itself beyond the period necessary.

Retention periods are set out in our retention schedule, which we review periodically.

8. Your rights

Under data protection law you have the right to:

be informed about how we use your data (this notice);
access the personal data we hold about you;
request rectification of inaccurate or incomplete data;
request erasure of your data in certain circumstances (note that some data must be kept for legal reasons);
request restriction of processing in certain circumstances;
object to processing based on our legitimate interests;
data portability in certain circumstances;
withdraw consent where we rely on it; and
safeguards in relation to any decision based solely on automated processing that has a legal or similarly significant effect on you, including being told about the decision, making representations, obtaining human intervention, and contesting the decision (see section 6).

To exercise any of these rights, please contact Dr Chris David Donaldson at pm@oneorthodontics.co.uk We will respond within one month.

You also have the right to complain to us about the way we handle your personal data. Our Data Protection Complaints Policy explains how to do this and what we will do in response. We will acknowledge your complaint within 30 days and aim to resolve it within one month.

If you remain dissatisfied, or you do not feel able to raise the matter with us, you may complain to the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF (0303 123 1113, ico.org.uk). We would, however, appreciate the chance to address your concerns first.

9. Your responsibilities

Please keep us informed if your personal details change (for example, your address, contact details or bank details), so that our records remain accurate.

10. Changes to this notice

We may update this notice from time to time. Where we make significant changes, we will bring them to your attention.

This notice should be read alongside your contract of employment and the Company's data protection and information-governance policies.

Version: 1.2

Effective date: 29.09.26

Review date: 01.11.27

Staff Privacy Notice ONE SPECIALIST CLINICS LTD / ONE ORTHODONTICS