Why we collect and process your personal data
We collect and process patients’ personal data for the purposes of healthcare and marketing.
Our legal bases for processing personal data for healthcare purposes, including appointment reminders, include public task or legitimate interests.
Our condition for processing special category data is the provision of health or social care.
We process our patients' personal data for marketing purposes with their consent or to meet a legitimate interest. This means we can tell you about eye care products and services that may be relevant to you. If you do not want us to process your personal data for marketing purposes, please let us know and we will stop.
The data we may collect and process
The personal data of patients that we may collect and process includes:
How we hold and share your personal data
We process your personal data in strict confidence. We keep your personal data securely in our filing and electronic systems. Patient records are only accessible to the healthcare professionals working at the practice and those under their supervision.
We will usually keep any personal data we hold about you for ten years after our last contact with you before we delete it. This is the period recommended as good practice by the College of Optometrists. If we collected the data when you were aged under 18 we will keep it until your 25th birthday, in line with NHS requirements. In exceptional cases we may need to retain personal data for a longer period, and will explain our reasons for doing so on request.
In the course of processing your personal data we may share it with:
You have legal rights in respect of the personal data we hold about you. The Information Commissioner’s Office (ICO) has published guidance on the full range of rights. The rights that are most relevant to the way in which we use your personal data include:
The right to erasure – also known as the ‘right to be forgotten’. If you ask us to delete your personal data, we will do so if there is no compelling reason to continue processing the data. We will not usually delete healthcare data before our usual time limit (see ‘how we hold and share your personal data’ above) where we have a duty to keep accurate records – for example, to comply with a legal obligation, or in connection with a legal claim. If you ask us to delete such data we will discuss this with you
Contacting us and the ICO about your personal data
Please speak to us first if you have any questions or concerns about the way in which we process personal data.
You have the right to complain to the ICO if you have a concern about our handling of your personal data which you do not think we can resolve.