Privacy & Cookie Policy

1. About this policy

Eyecare Heston Ltd ("we", "us", "our") is committed to protecting your privacy and handling your personal information securely, lawfully and transparently.

This policy explains what personal information we collect about you, why we collect it, who we share it with, how long wekeep it, and what rights you have. It applies to patients and customers of the practice, to visitors to our premises, and to visitors of www.eyecareheston.co.uk.

We are the data controller for the information described in this policy.

Eyecare Heston Ltd

329 Vicarage Farm Road, Heston, Middlesex, TW5 0DR
Telephone: 0208 569 6520
Email: eyecare329@gmail.com
Registered in England & Wales, company number 10999454
Registered office: 329 Vicarage Farm Road, Heston, TW5 0DR
Information Commissioner's Office registration number: ZA292169

If you have any questions about this policy, or about how we use your information, please contact Mr Harvinder Jaswal, Optometrist and Director, using the details above.

2. The information we collect

2.1 Information you give us

• Your name, date of birth, home address, telephone numbers and email address
• Your NHS number and, where relevant, your entitlement to NHS-funded services (for example benefits, tax credits orHC2/HC3 certificates)
• Your GP's name and practice details
• Details of your general health, medication, allergies and family history where these are relevant to your eyes, vision or hearing
• Your occupation, hobbies and visual or listening requirements, where these affect the advice we give you

We do not store your card details. Card payments are taken through our payment provider's terminal, and your card numberis never held on our systems. We do keep a record of the goods and services supplied to you and the amounts paid, becausewe are required to keep proper accounting and VAT records.

2.2 Information we create when we care for you

• Clinical records of your eye examinations, contact lens fittings and aftercare, and any minor eye conditions assessments
• Prescriptions, statements of visual fitness to drive, and referral correspondence
• Retinal photographs, OCT scans and other clinical images
• Records of hearing assessments, wax removal procedures, hearing aid fittings, programming data and aftercare
• Records of spectacles, contact lenses, hearing aids and other products supplied to you
• Notes of appointments, recalls, telephone calls and correspondence with you

2.3 Information we receive from others

• Referrals and correspondence from your GP, from hospital eye services, from audiology departments and from other healthcare professionals
• Information from NHS bodies relating to your eligibility for NHS services

2.4 Information we collect automatically from our website

When you visit our website we may collect your IP address, device and browser type, the pages you view, and how you arrived at the site. This is described in section 8 below.

3. Why we use your information, and our lawful basis

Most of the information we hold about you is health information, which is a "special category" of personal data under theUK GDPR and is given extra protection in law. What we use it for:

Everyone working at the practice also owes you a duty of confidence at common law, which applies in addition to data protection law.

Where we rely on legitimate interests, we have considered whether our interests are outweighed by your rights, and we are satisfied that they are not. You may object to this processing at any time – see section 7.

4. Marketing

We will send you recall reminders by post, email, text message or telephone to let you know when your next sight test, contact lens check or hearing review is due. This is part of the clinical care we provide and is a professional expectation placed upon us. You can ask us to stop sending these at any time, and we will respect that, although we may remind you that doing so is not in the best interests of your eye or hearing health.

We will only send you promotional messages about offers, products and practice news where you have given us your consent, or where the law otherwise permits it. Every promotional message will contain a simple way to unsubscribe.

We do not sell your information, and we do not share it with third parties for their own marketing purposes.

5. Who we share your information with

We share your information only where we need to, and only with organisations that are required to keep it secure and confidential. These may include:

• Your GP, hospital eye services, audiology departments and other healthcare professionals, where we refer you or where sharing is necessary for your care.
• NHS England and Primary Care Support England (PCSE), and other NHS bodies that commission or administer GeneralOphthalmic Services and Minor Eye Conditions Services, for the purpose of processing and auditing claims
• The NHS Business Services Authority and NHS Counter Fraud Authority, where they are entitled to check the validity of NHS claims
• Spectacle lens laboratories, contact lens suppliers and hearing aid manufacturers, to order, fit, programme and service the products we supply to you
• Our practice management, IT, website and data hosting providers, who process information on our behalf under written contract
• Our professional indemnity insurers, solicitors and accountants, where necessary
• Regulators, including the General Optical Council, the Health and Care Professions Council, the Care Quality Commission and the Information Commissioner's Office, where we are required to co-operate with them
• The courts, the police and other public bodies, where we are required to disclose information by law, or where disclosure is necessary to prevent serious harm

If you are being seen under an NHS-commissioned service, we are required to record and submit certain information about your care. You can discuss this with us if you have concerns.

Occasionally we may use anonymised information – from which you cannot be identified – for audit, training or service improvement. Anonymised information is not personal data.

6. How long we keep your information

We keep your records for as long as we are required to, in line with professional guidance from the College of Optometrists and the NHS Records Management Code of Practice.

When records reach the end of their retention period, they are securely destroyed or permanently deleted.

7. Your rights

Under the UK GDPR you have the right to:

• Be informed about how we use your information – which is the purpose of this policy
• Access the information we hold about you, by making a subject access request
• Have inaccurate information corrected. Please note that where a clinical record reflects a professional opinion recorded at the time, we may add a note of your disagreement rather than delete the original entry
• Ask us to delete your information, although this right is limited where we are legally or professionally required to retain clinical records
• Ask us to restrict how we use your information in certain circumstances
• Object to processing that we carry out on the basis of legitimate interests
• Data portability, in certain circumstances, allowing you to receive information you have given us in a machine-readable format
• Withdraw your consent at any time, where we rely on consent

You are also entitled, separately, to a copy of your spectacle or contact lens prescription at the end of your examination or fitting, free of charge.

To exercise any of these rights, please write to the practice at the address in section 1, or email us. We will not charge you a fee unless your request is manifestly unfounded or excessive. We will respond within one month, and will tell you if we need longer because your request is complex. We may ask you to confirm your identity before we release any information.

8. Cookies and our website

Our website is built and hosted using Webflow. Cookies are small text files placed on your device when you visit a website.

Essential cookies. These are necessary for the website to work – for example, to keep the site secure and to remember your cookie preferences. They cannot be switched off.

Analytics cookies. We use Google Analytics to understand how visitors find and use our site, so that we can improve it. Thistells us things like which pages are most visited and how long people spend on them. We use this information in aggregateand do not use it to identify you.

Advertising and conversion cookies. We advertise through Google Ads, and we use Google's conversion tracking tounderstand which advertisements lead people to contact the practice. This may include recording that you clicked atelephone number or submitted a form after arriving from an advertisement.

We will ask for your consent before setting analytics or advertising cookies. You can withdraw that consent at any time byadjusting your cookie settings, and you can block or delete cookies through your browser settings, although parts of the sitemay not then work as intended.

Some of these providers are based outside the United Kingdom. Where information is transferred overseas, it is protected by safeguards approved under UK data protection law, such as the UK International Data Transfer Addendum or an adequacy decision.

Our website may contain links to other websites. We are not responsible for the privacy practices of those sites, and we encourage you to read their own policies.

9. How we keep your information secure

We hold clinical records electronically on a practice management system with access restricted to authorised members ofthe practice team, and any paper records are held in a secure area of the practice. Our systems are password protected and access is limited to what each member of staff needs in order to do their job. All members of the practice team are trained in confidentiality and data protection, and are bound by contractual confidentiality obligations.

We have procedures in place to deal with any suspected personal data breach, and we will notify you and the Information Commissioner's Office where we are legally required to do so.

10. Making a complaint

If you are unhappy with how we have handled your personal information, please tell us first so that we have the opportunityto put it right. Contact Mr Harvinder Jaswal using the details in section 1.

You also have the right to complain to the Information Commissioner's Office at any time:

Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
Website: www.ico.org.uk

11. Changes to this policy

We keep this policy under review and will update it when our practice or the law changes. Any updated version will be published on this page, and the "last updated" date at the top will be revised. Please check this page from time to time.