Privacy Policy

Data controller: Clinica Tafur Ltd

Trading name: Tafur Dental Clinic Gibraltar

Clinic address: Main Street 91, Offices 3 & 4, Gibraltar

Telephone: +350 54015331

Privacy contact: jennifer@clinicatafur.com

We may collect personal information:

• directly from you during an enquiry, consultation or treatment;
• when you complete a registration, medical-history or consent form;
• when you contact us by telephone, email, website form or WhatsApp;
• when you book or attend an appointment;
• from a parent, guardian or person with parental responsibility;
• from a referring dentist, healthcare professional, clinic or laboratory;
• from an insurer or another organisation involved in arranging or funding your treatment, where applicable; and
• automatically through cookies and similar website technologies, subject to your consent choices.

We may use your personal information to:

• respond to enquiries and consultation requests;
• register you as a patient;
• assess your dental health and provide appropriate care;
• prepare diagnoses, treatment plans and quotations;
• provide dental treatment and monitor treatment outcomes;
• manage appointments, reminders and treatment follow-ups;
• communicate with you about your care;
• obtain and record informed consent;
• refer work to dental laboratories or other healthcare professionals where necessary;
• process payments, invoices and insurance information;
• maintain accurate clinical and administrative records;
• manage complaints, concerns and legal claims;
• protect the security of our patients, staff, systems and website;
• comply with professional, legal, regulatory and safeguarding obligations;
• understand and improve website performance and patient communication; and
• send marketing communications where you have provided the required consent.

The legal basis we rely upon depends on the information involved and the reason it is being used.

Health and clinical information

Health information is a special category of personal data and receives additional protection.

We process health and clinical information where necessary for dental diagnosis, the provision and management of dental treatment, preventive care and related healthcare services. This information is handled by, or under the responsibility of, healthcare professionals and authorised staff who are subject to professional or contractual duties of confidentiality.

We may also process health information where necessary to establish, exercise or defend legal claims, comply with applicable law, protect vital interests or for another condition permitted under data-protection legislation.

We may process personal and health information relating to children and young people when providing dental care.

Information may be provided by a parent, guardian or another person with parental responsibility. We may also communicate directly with a young person where this is appropriate, lawful and consistent with their age, understanding and clinical circumstances.

We do not sell or rent personal information.

Where necessary and lawful, personal information may be shared with:

• dentists, dental nurses, hygienists and other authorised clinic personnel;
• dental laboratories and suppliers involved in producing items required for your treatment;
• specialist dentists, doctors or other healthcare professionals involved in your care;
• another dental practice or healthcare provider where you request or authorise a referral or transfer;
• insurers, funding providers or payment service providers where applicable;
• professional advisers, including legal, accounting and insurance advisers;
• trusted service providers supporting patient-record management, appointment administration, communications, email, website enquiries, hosting, analytics, security and consent management;
• regulators, courts, law-enforcement bodies or public authorities where disclosure is required or permitted by law; and
• another organisation in connection with a restructuring, sale or transfer of the clinic, subject to appropriate confidentiality and data-protection safeguards.

Service providers are given access only to the information reasonably required for the relevant service and are expected to process it under appropriate confidentiality, security and data-protection arrangements.

Some organisations providing communications, website, hosting, security, analytics or administrative services may process information outside Gibraltar.

Where personal information is transferred internationally, we take reasonable steps to ensure that the transfer is lawful and that appropriate safeguards are used where required. These safeguards may include an adequacy decision, approved contractual protections or another transfer mechanism permitted under the Gibraltar GDPR.

We retain personal information only for as long as it is reasonably necessary for the purpose for which it was collected and to meet applicable clinical, professional, legal, accounting, regulatory and insurance requirements.

The appropriate retention period depends on factors including:

• the nature and sensitivity of the information;
• whether the information forms part of a clinical record;
• the patient’s age;
• the duration and nature of the treatment provided;
• professional and legal record-keeping requirements;
• applicable limitation periods for complaints or legal claims; and
• whether the information remains necessary for patient safety or continuity of care.

Website enquiries and general contact information that do not lead to treatment will not normally be kept for longer than reasonably necessary to respond to the enquiry, manage follow-up communication and meet any applicable legal requirements.

Information used only for marketing will be retained until you withdraw your consent, unsubscribe or the information is no longer required, subject to keeping a limited record where necessary to respect your request not to be contacted.

When information is no longer required, it will be securely deleted, anonymised or otherwise disposed of where reasonably possible.

We use appropriate technical and organisational measures designed to protect personal information against accidental loss, unauthorised access, misuse, alteration or disclosure.

Access to clinical records is restricted to authorised personnel who require access for treatment, administration or another legitimate purpose. Staff and relevant service providers are subject to confidentiality and data-protection obligations.

Although we take reasonable precautions, no method of electronic storage or transmission can be guaranteed to be completely secure.

Depending on the circumstances and applicable law, you may have the right to:

• request confirmation of whether we process your personal information;
• request access to the personal information we hold about you;
• request correction of inaccurate or incomplete information;
• request deletion of information where there is no lawful reason for us to retain it;
• request restriction of processing in certain circumstances;
• object to processing based on legitimate interests;
• object at any time to the use of your information for direct marketing;
• request the transfer of certain information in a structured, commonly used and machine-readable format where the right to data portability applies;
• withdraw consent at any time where processing relies on consent; and
• raise a concern or lodge a complaint with the Gibraltar Regulatory Authority.

These rights are not absolute. For example, we may be required to retain clinical records or other information to comply with legal, professional or patient-safety obligations.

To exercise a right, contact: jennifer@clinicatafur.com.

We may need to request information reasonably necessary to confirm your identity before responding. We will not normally charge a fee, although a reasonable fee may apply where permitted by law for requests that are manifestly unfounded or excessive.

We will send electronic marketing communications only where we have an appropriate lawful basis and any consent required by law.

You can withdraw your consent or ask us to stop sending marketing messages at any time by using the unsubscribe option provided, replying to the communication or contacting jennifer@clinicatafur.com.

Opting out of marketing will not prevent us from sending necessary administrative or clinical communications concerning appointments, treatment, payments or patient care.

Our website uses cookies and similar technologies for security, consent management, website functionality and, where permission has been provided, analytics and embedded content.

You can accept, reject or manage non-essential cookies through the cookie banner and can change your preferences later using the cookie-settings control available on the website.

For further information, please read our Cookie Policy.

Our website may contain links to third-party websites or provide access to external communication services. Those organisations are responsible for their own privacy practices, and we encourage you to review their privacy information before providing personal data.

Please avoid sending detailed medical information through general website forms, social-media messages or other non-clinical communication channels unless requested by an authorised member of the clinic team.

Please contact us first if you have a concern about how we have handled your personal information. We will take your concern seriously and try to resolve it.

Contact: jennifer@clinicatafur.com

You also have the right to lodge a complaint directly with the Gibraltar Regulatory Authority, acting as the Information Commissioner:

Gibraltar Regulatory Authority
2nd Floor, Eurotowers 4
1 Europort Road
Gibraltar
Telephone: +350 20074636
Email: info@gra.gi

We may update this Privacy Policy when our services, systems, legal obligations or data-processing practices change.

The latest version will be published on this page and identified by the “Last updated” date shown at the top.