Privacy Notice for Patients 

Our contact details

Name: Brignall Opticians Ltd.
Address: 33 New Road, Chippenham, Wiltshire, SN15 1HP
Phone Number: +44 (0) 1249653292
E-mail: contact@brignallopticians.co.uk

Brignall Opticians Ltd. is a registered data controller. Our Information Commissioner’s Office registration number is Z3509352. This privacy notice sets out our privacy policy for patient data.

The type of personal information we collect

We currently collect and process the following information:

  • Your name, contact details and personal identifiers (such as date of birth and NHS number)

  • Your general and ocular health history, your family medical and ocular history, and any relevant signs or symptoms you tell us about

  • Details of medicines, spectacles and contact lenses prescribed for you, either by us or another provider

  • Details of examinations and other healthcare checks and treatments we provide

  • Information relevant to your continued care from other people who care for you or know you well, such as other health professionals and relatives

  • Information required to accept payments, either in person or if you buy using our website’s ‘Order Online’ service.

  • Information required to process orders placed using ‘Order Online’, such as a delivery address.

  • Your browser information when you visit our website

How we get the personal information and why we have it

Most of the personal information we process is provided to us directly by you for one of the following reasons:

  • Registering as a patient at our practice

  • Having a sight test with us

  • Purchasing vision correcting or other products from us

We also receive some information from other healthcare professionals who:

  • may have referred you to us or have seen you in connection with your treatment or diagnosis

We use this information in order to:

  • perform sight tests

  • provide you with the right glasses and contact lenses

  • contact you or other health professionals about your eye health

We may share this information with:

  • the healthcare professionals working at this practice and those under their supervision

  • healthcare professionals and those under their supervision at other optical practices, but only if you have specifically asked us to pass your personal data (such as your prescription) to them

  • your GP, ophthalmologists and other healthcare providers and commissioners (such as the NHS), and suppliers of optical appliances or similar products, in connection with your healthcare treatment

  • financial institutions, so that we can arrange payment for products or services provided to you

Under the UK General Data Protection Regulations (UK GDPR), the lawful bases we rely on for processing personal data for healthcare purposes, including appointment reminders, include public task or legitimate interests.

  • When we provide services under the NHS General Optical Services contract (such as a sight test funded by the NHS), our legal basis for processing personal data in respect of that service is ‘public task’

  • Otherwise our legal basis is ‘legitimate interests’

  • Our condition for processing special category data is the provision of health or social care

We process our patients' personal data for marketing purposes with their consent or to meet a legitimate interest. This means we can tell you about eye care products, services and treatments that may be relevant to you. If you do not want us to process your personal data for marketing purposes, please let us know and we will stop.

How we store your personal information

Your information is securely stored in:

  • our practice filing system

  • our electronic practice management systems. Electronic data is stored both on our premises and with our software providers

Patient records are only accessible to the healthcare professionals working at the practice and those under their supervision. All electronic data (including backups) are stored at rest within the United Kingdom.

We will usually keep any personal data we hold about you for ten years after our last contact with you before we delete it. This is the period recommended as good practice by the College of Optometrists. If we collected the data when you were aged under 18, we will keep it for ten years, or until your 25th birthday if that is later, in line with NHS requirements. In exceptional cases we may need to retain personal data for a longer period and will explain our reasons for doing so on request.

Electronic records are erased from our databases and paper records (if present) are securely shredded.

‘Order Online’

If you make a purchase using our ‘Order Online’ service, information essential to processing your order is stored with our e-commerce provider. This includes your name, delivery address and details of items purchased. Our e-commerce provider (Sqaurespace Inc.) processes this data so that we can provide this service to you. This data may be stored in the United States. As you go through the checkout, this site may auto-complete your shipping and billing address by sharing what you type with the Google Places API and returning suggestions to you to improve your checkout experience.

Your data protection rights

You have legal rights in respect of the personal data we hold about you. The Information Commissioner’s Office (ICO) has published guidance on the full range of rights. The rights that are most relevant to the way in which we use your personal data include:

  • The right to be informed about how we use personal data – this privacy notice gives that information.

  • The right to object – if you object to us processing your data for marketing purposes, or for healthcare purposes where our legal basis is legitimate interests (see ‘How we get the personal information and why we have it’, above), we will then stop doing so, unless we are processing the data in respect of a legal claim or can otherwise show that our legitimate interest in processing the data overrides your rights and interests.

  • The right of access – if you ask us for the personal data we hold about you we will provide it within a month, free of charge (unless we have already provided it to you, in which case we may have to charge you the administrative cost of providing it again).

  • The right to rectification – if you ask us to correct personal data about you that is inaccurate or incomplete, we will do so within a month (unless we need longer, in which case we will discuss this with you).

  • The right to erasure – also known as the ‘right to be forgotten’. If you ask us to delete your personal data, we will do so if there is no compelling reason to continue processing the data. However, this right does not apply to patient data that we process for healthcare purposes, such as patient records. We will not usually delete healthcare data before our usual time limit (see ‘How we store your personal information’ above) where we have a duty to keep accurate records – for example, to comply with a legal obligation, or in connection with a legal claim. If you ask us to delete such data we will discuss this with you.

Please contact us at the details at the top of this document if you wish to make a request.

How to contact us or the ICO about your data

Please speak to us first if you have any questions or concerns about the way in which we process personal data. You can contact us using the details at the top of this document.

You have the right to complain to the ICO if you have a concern about our handling of your personal data which you do not think we can resolve. You can contact the ICO using the details below:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline number: 0303 123 1113
ICO website: https://www.ico.org.uk