How we use your personal information
At Enhanced Optometry Services Ltd, we take your privacy seriously. We are committed to protecting your personal information and handling it responsibly and securely.
We collect and use personal information to provide eye care, manage your patient record, arrange appointments and provide the products and services you request. This may include personal details, contact information, payment information and information about your health and eye care.
This notice explains who is responsible for your information, how and why we use it, where it is held, when it may be shared and the rights you have.
Who is responsible for processing my data?
The organisation responsible for deciding how and why your personal information is processed (the Data Controller) is:
Enhanced Optometry Services Ltd
15 Market Hill
Coggeshall
Essex
CO6 1TS
What is the legal basis for processing my data?
We process personal information in accordance with UK data protection law.
Depending on the purpose, this may include processing that is necessary to:
- Provide eye care, diagnosis, treatment and related healthcare services.
- Fulfil our contractual obligations to you.
- Meet legal and regulatory obligations.
- Pursue legitimate interests, where these interests do not override your rights and freedoms.
Health information is classed as special category personal data and is subject to additional legal protections. We only process this information where the relevant conditions under data protection law are met.
Where is my information held and processed?
Patient and practice information is held and processed using the EyeBooked platform, provided by Enhanced Optometry Services Ltd, together with individual items of clinical and diagnostic equipment used within the practice.
Information relating to referrals and the Minor Eye Conditions Service (MECS) is processed through the Primary Eyecare Services OPERA platform. This platform is authorised locally for these purposes.
For patient information processed through OPERA, Referral Management Services Ltd acts as a data processor on behalf of Primary Eyecare Services Ltd. Primary Eyecare Services Ltd is responsible for the patient-data processing arrangements covered by its own privacy policy.
You can read further information in the Primary Eyecare Services Privacy Policy.
How long do you keep my data?
We retain patient records in accordance with professional guidance from the College of Optometrists and applicable data protection requirements.
Our patient record retention periods follow the College’s guidance:
- Adult patients: 10 years after their last visit to the practice.
- Children and young people: 10 years after their last visit, or until their 25th birthday, whichever is later.
- Children and young people who have died: 10 years after their last visit.
Before records are securely destroyed, we ensure that there is no further need to retain them.
For further information, please refer to the College of Optometrists’ guidance on patient records.
Who will use or process my data?
Your information is accessed only by authorised members of our practice team and other individuals or organisations who need it to provide or support your care and the operation of our services.
This may include authorised healthcare professionals and organisations operating systems used by the practice, including EyeBooked and Primary Eyecare Services.
Anyone handling your information on our behalf is required to protect its confidentiality and security.
Do you share or transfer my data to anyone else?
We treat your personal information as confidential. We do not sell your personal information.
Information may be shared where necessary and lawful, including:
- Where you have asked us to share it or given your permission.
- With your GP, hospital or other healthcare professionals involved in your care, where appropriate.
- Through referral arrangements and the Minor Eye Conditions Service, where information is required to support your care.
- Where disclosure is required by law or permitted in the public interest.
- With organisations providing services that support the operation of the practice, such as IT systems, secure data storage and communications services.
Where information is shared with another healthcare professional or organisation, they also have a responsibility to protect its confidentiality, subject to applicable legal requirements and recognised exceptions.
Your rights
Under UK data protection law, you have a number of rights in relation to your personal information. These include:
The right to be informed
You have the right to understand how your personal information is collected and used. This privacy notice explains our main purposes for processing your information.
The right of access
You can request a copy of the personal information we hold about you, including your health records. This is known as a Subject Access Request.
We will normally respond within one month of receiving your request, although this period may be extended in certain circumstances permitted by law.
There is generally no charge for making a Subject Access Request. A reasonable fee may only be charged in limited circumstances, such as where a request is manifestly unfounded or excessive.
Please send your request in writing to the practice address listed below, explaining what information you are seeking. Providing relevant details can help us locate the information you need.
The right to rectification
You can ask us to correct personal information that is inaccurate or incomplete. Please contact us in writing and explain what you believe is incorrect. We may ask for further information to help us assess your request.
The right to erasure
In certain circumstances, you can ask us to delete your personal information. This right is not absolute, and we may need to retain certain information to meet legal, professional or healthcare record-keeping obligations.
The right to restrict processing
In certain circumstances, you can ask us to restrict how we use your personal information while a matter is being considered.
The right to object
You can object to certain types of processing, including processing based on legitimate interests. Whether we must stop processing will depend on the circumstances and the legal basis involved.
The right to complain
If you have concerns about how we use your personal information, please contact us so that we can try to resolve them.
You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s independent data protection regulator.
Information Commissioner’s Office – Make a complaint
Contacting us about your personal information
For all enquiries or requests relating to your personal information, including Subject Access Requests, requests for correction and other data protection matters, please write to:
Enhanced Optometry Services Ltd
15 Market Hill
Coggeshall
Essex