Security & data protection
How this website and our patient data are protected, which suppliers process data on our behalf, and how to report a vulnerability.
Last reviewed 2026-09-23 · Cadbury Dental Practice, 29 Sycamore Road, Bournville, Birmingham B30 2AA
This page describes the measures actually in place for this website and the systems it connects to. It is a factual description, not a certification.
About compliance frameworks
A website cannot itself be 'SOC 2 certified' — SOC 2 is an independent audit of an organisation's controls, issued to a company after an examination period. Cadbury Dental has not undergone a SOC 2 examination, and we will not claim one. What we can and do state is how this site aligns with UK GDPR, EU GDPR and PECR, and which of our suppliers hold their own independent certifications.
Technical measures
- All traffic served over HTTPS with modern TLS; no page accepts data over plain HTTP.
- Patient enquiries and uploaded photographs are stored in a managed Postgres database with row-level security, so a record can only be read by an authenticated, authorised service.
- The staff content portal requires an individual account with a verified email address and an explicit administrator role; the role is re-checked on the server for every action, not just in the browser.
- The content API used by the practice portal is authenticated with a rotatable key and every write is recorded in an audit log with the actor and payload.
- Uploaded images are stored in access-controlled object storage rather than in the public site bundle.
- No advertising or analytics trackers are embedded, so no visitor behaviour is exported to third parties.
Organisational measures
- Access to patient records is limited to practice staff who need it for care or administration.
- All clinicians are registered with the General Dental Council and bound by its confidentiality standards.
- Personal data breaches that risk people's rights are reported to the ICO within 72 hours, and affected patients are told directly where the risk is high.
Subprocessors
| Supplier | Purpose | Region |
|---|---|---|
| Supabase (managed Postgres, auth and storage) | Enquiry records, uploaded photographs, staff portal accounts | EU |
| Cloudflare | Website delivery, TLS termination, content delivery network | Global edge, EU/UK origin |
| Google (Fonts, Maps embed) | Typefaces; optional location map shown only after functional consent | Global |
Reporting a vulnerability
If you believe you have found a security issue with this website, email reception@cadburydental.co.uk with the subject 'Security'. Please give us a reasonable period to investigate before disclosing publicly. We will acknowledge your report and tell you what we have done.