Privacy policy

Privacy and Cookie Policy

Last updated: 7 September 2026

Who we are

Harcourt Dental Clinic Limited, trading as Harcourt Dental Clinic, is the controller of the personal data described in this notice.

Registered office and postal address: 14 Harcourt Street, Dublin 2, D02 KD21, Ireland.

Data Protection Contact: reception@harcourtdentalclinic.ie, telephone 01 475 1313.

This notice applies to patients, prospective patients, parents or guardians, referrers and people who contact us or use our website.

Information we may hold

We may hold:

• identity and contact details;
• appointment and attendance information;
• medical and dental history;
• clinical notes, diagnoses, treatment plans, consent records and prescriptions;
• radiographs, clinical photographs, study models, DTX dental images and CT/CBCT scans;
• referrals, laboratory information and correspondence with you and relevant healthcare professionals;
• billing, payment and insurance or claim information;
• complaints, incidents and related communications; and
• website enquiry details, IP address, device/browser data and cookie-consent preferences.

Health information is special-category personal data and is protected accordingly. Clinical records have been maintained electronically since 2009. Relevant communications received through Microsoft Outlook or the website are added to the patient record where appropriate. Some older or supporting records may also be retained securely in paper form.

How we obtain information

We receive information directly from you, including through appointments, telephone calls, email, online forms and the booking portal. We may also receive relevant information from a parent or guardian, a referring dentist, another healthcare professional, a laboratory, an insurer or another person authorised by you. Our website may collect limited technical information through essential security logs and, where you consent, analytics or marketing technologies.

Why we use information and our legal bases

• Enquiries and appointments: to respond to you, arrange appointments and take steps at your request before treatment. We rely on Article 6(1)(b) GDPR and, where appropriate, our legitimate interest in efficient practice administration under Article 6(1)(f). Where necessary health information is involved, we rely on Article 9(2)(h).
• Dental care and clinical records: to assess, plan and provide care, maintain an accurate record and meet professional or legal duties. We rely on Articles 6(1)(b) and 6(1)(c), and Articles 9(2)(h) and 9(3).
• Billing, accounting, card payments and insurance claims: to administer fees, meet accounting obligations and, at your request or with your authority, assist with Laya Healthcare or Vhi benefits and claims. We rely on Articles 6(1)(b) and 6(1)(c), and Article 9(2)(h) where health information is necessary.
• Complaints, incidents, regulatory matters and legal claims: to investigate and respond fairly, protect patients and staff, meet legal or professional duties and establish, exercise or defend legal claims. We rely on Articles 6(1)(c) and 6(1)(f), and Articles 9(2)(f) or 9(2)(h) as applicable.
• Website operation and security: to operate, troubleshoot and protect the website and our systems. We rely on Article 6(1)(f) for essential security and administration.
• Optional analytics, advertising and direct marketing: we rely on consent. You may withdraw consent at any time without affecting earlier lawful processing.

Who may receive information

We share only information that is reasonably necessary with:

• authorised members of the Harcourt Dental Clinic team;
• dental laboratories, referring dentists, other dentists, general medical practitioners, hospitals and other healthcare professionals involved in your care;
• practice-management, dental-imaging, CT/CBCT, secure backup, IT support, website hosting, online booking and form providers acting under appropriate arrangements;
• Microsoft 365/Outlook and other communications providers;
• payment and card-processing providers;
• accountants, legal advisers, professional indemnity providers and other professional advisers;
• Laya Healthcare or Vhi where you ask or authorise us to check benefits or support a claim;
• the Dental Complaints Resolution Service where you have provided the appropriate authority or consent; and
• courts, regulators, law-enforcement bodies or public authorities where disclosure is required or permitted by law.

Laya Healthcare, Vhi and other independent recipients process information under their own privacy notices where applicable. Service providers acting for the clinic may use personal data only for the agreed service and subject to contractual confidentiality and security obligations.

International transfers

Some technology providers may process limited personal data outside the European Economic Area. Where this happens, we use a lawful transfer mechanism, such as an applicable European Commission adequacy decision or standard contractual clauses, together with appropriate safeguards. Further information is available from our Data Protection Contact.

How long we keep information

• Adult clinical records, including relevant practice-management data, radiographs, DTX images, CT/CBCT scans, photographs, correspondence and patient financial entries, are retained for at least eight years after the patient was last seen.
• Records for children and young adults are retained until at least the patient’s 25th birthday, or 26th birthday if the patient was 17 when last seen. If a patient dies before their 18th birthday, records are retained for at least eight years.
• Separate accounting and tax records are normally retained for six years. If an item also forms part of the clinical record, the longer clinical period applies.
• Enquiries that do not lead to treatment are retained only for as long as reasonably necessary to respond and manage appropriate follow-up. If information becomes part of a clinical record, the clinical retention periods apply.
• Marketing details are retained until consent is withdrawn or the information is no longer required, subject to periodic review.
• Complaints, incidents or legal material may be retained longer where genuinely necessary for an active regulatory matter or legal claim.

When a retention period expires, records are securely deleted or destroyed in accordance with our documented retention procedure and applicable professional requirements.

Security and confidentiality

We use appropriate organisational and technical safeguards, access controls and backup procedures. Access is restricted to people who need the information for their work. Members of the dental team and relevant service providers are subject to confidentiality obligations. No internet or email system is completely risk-free, but we take reasonable measures appropriate to the sensitivity of health information.

Your rights

Subject to the GDPR and applicable limits, you may request access, correction, erasure, restriction or portability of your personal data, object to certain processing, and withdraw consent where consent is the legal basis. The right to erasure is not absolute where a clinical record must be retained for safe care, professional or legal duties, or legal claims.

Requests should be sent to reception@harcourtdentalclinic.ie. We may need to verify your identity. A copy of a patient’s complete dental record is normally provided free of charge and without undue delay, generally within one month. Where a request is particularly complex, the GDPR permits an extension of up to two further months; we will tell you and explain why.

You may complain to Ireland’s Data Protection Commission, 6 Pembroke Row, Dublin 2, D02 X963, or through www.dataprotection.ie. We would appreciate the opportunity to address your concern first.

Cookies and similar technologies

Cookies are small files stored on or accessed from your device. The website’s current Cookie Settings panel groups cookies as:

• Essential: required for core website and consent functions;
• Statistics: used to understand how visitors use the website; and
• Marketing: used for advertising or measuring advertising activity.

Essential cookies may operate without consent where strictly necessary. The site uses Google Consent Mode so analytics and advertising storage are denied until you make an affirmative choice. Google tagging code may load while consent remains set to denied, but non-essential cookies and storage should not be enabled until you consent. The cookie banner allows you to accept, decline or open Settings, and you can change or withdraw your choices later through Cookie Settings in the website footer.

The Cookie Settings panel provides the current cookie/provider information. Cookie names and durations may change when website services are updated, so the panel should be kept under regular review. You can also delete cookies through your browser, although browser settings do not replace the website consent choices.

Third-party websites and embedded services have their own privacy and cookie notices. We are not responsible for their content or privacy practices.

Changes to this notice

We may update this notice when our services, systems or legal obligations change. The current version and update date will be published on this page.