Privacy Policy

Last updated: 22 September 2026

Who we are

Eva Clinic is a trading name of MEDLABDENT LTD, a company registered in England and Wales (company number 13919640), registered office 6 Hampton Court Road, Birmingham, England, B17 9AE. MEDLABDENT LTD is the data controller for the personal information described in this policy and is registered with the Information Commissioner’s Office (ICO) under registration reference ZC214129. For anything about your information, contact us at info@evaclinic.co.uk, on 0121 406 5128, or by post to the address above, marked “Data protection”. We are not required to appoint a Data Protection Officer; data protection questions are handled by the clinic’s management.

The information we collect

• Contact details you give us when you call, email or message us on WhatsApp: your name, phone number, email address and what you tell us in your message.
• Health information you choose to share when you contact us and, once you become a patient, your clinical records — medical and dental history, examination findings, X-rays and scans, treatment notes, prescriptions, test results and letters about your care.
• Appointment and payment records once you are a patient.
• Website information: a record of your cookie choice and — only if you accept optional cookies — Google Analytics statistics about how the site is used (pages viewed, approximate location, device and browser). We do not use advertising cookies.
• If you choose to load the map, Google receives information from your browser, as explained in Google’s own privacy policy.

Why we use it and our lawful basis

• To reply to you and arrange appointments — our legitimate interest in answering people who contact us, and steps you ask us to take before becoming a patient (UK GDPR Article 6(1)(f) and 6(1)(b)).
• To provide your care, keep accurate clinical records and share information with others involved in your care — our contract with you (Article 6(1)(b)) and, for health information, the provision of health care (Article 9(2)(h), with Schedule 1, Part 1, paragraph 2 of the Data Protection Act 2018).
• To meet our legal and professional obligations, such as record keeping, safeguarding and answering regulators — legal obligation (Article 6(1)(c)) and, for health information, Article 9(2)(h) and, where the law requires it, Article 9(2)(g) and (i).
• To keep the website secure and working — our legitimate interests (Article 6(1)(f)).
• Website statistics — your consent (Article 6(1)(a) and the Privacy and Electronic Communications Regulations), which you can withdraw at any time using “Cookie settings” at the bottom of every page.

Who we share it with

We never sell your information. We share it only where necessary:

• service providers who help us run the clinic and this website — for example our email and office software provider, our website hosting and database provider, our practice management and booking system, and the messaging service you choose to contact us on (WhatsApp is operated by Meta). They act on our instructions and must keep your information secure;
• laboratories and diagnostic services that process your tests, and other clinicians such as your NHS GP or a specialist, when this is needed for your care and, where appropriate, with your agreement;
• regulators and public bodies — for example the General Dental Council, the General Medical Council, the police or the courts — where the law requires it;
• Google, for website statistics, only if you accept optional cookies.

Transfers outside the UK

Some of our providers (for example Google and Meta) may process information outside the UK, including in the United States. Where this happens we rely on UK adequacy regulations (including the UK–US Data Bridge) or on the ICO’s International Data Transfer Agreement or Addendum to protect it.

How long we keep it

• Enquiries that do not lead to an appointment: up to 12 months after our last contact, then deleted.
• Dental records: at least 11 years after your last visit; for children, until their 25th birthday or for 11 years, whichever is longer.
• Medical records: at least 8 years after your last treatment; for children, until their 25th birthday (or 26th if they were 17 when treatment ended).
• Website statistics: no longer than 14 months. Your cookie choice: 12 months, then we ask again.

Your rights

You have the right to be informed about how we use your information; to access it (including a copy of your records); to have inaccurate information corrected; to have it erased or its use restricted in some circumstances (we must still keep clinical records for the periods above); to object to uses based on legitimate interests; to data portability; and to withdraw consent at any time. We do not make decisions about you based solely on automated processing. To use any of these rights, contact us at info@evaclinic.co.uk. We reply within one month and there is normally no charge.

Children

Parents or guardians usually act for younger children. Older children who understand their care can use their own rights.

Keeping your information safe

Only staff who need your information can access it, through secure, password-protected systems. Please do not send detailed medical information by WhatsApp or email before your appointment; we will go through it with you in person.

Complaints about your information

If you are unhappy with how we have handled your information, please contact us first. You also have the right to complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint, 0303 123 1113, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

Changes to this policy

We update this policy when our services or the law change. The date at the top shows the current version.