Privacy Policy

We take the data we collect from you very seriously and ensure all the information you share with us is relevant and necessary to ensure we deliver the highest standard of care for our patients.
We adopt the six core principles of data protection which are:

Lawfulness, fairness and transparency – we process personal data lawfully, fairly and in a transparent manner in relation to you, the data subject.
Purpose limitation – we only collect personal data for a specific, explicit and legitimate purpose. We clearly state what this purpose is in this Privacy Notice, and we only collect data for as long as necessary to complete that purpose.
Data minimisation – we ensure that personal data we process is adequate, relevant and limited to what is necessary in relation to the processing purpose.
Accuracy – we take every reasonable step to update or remove data that is inaccurate or incomplete. You have the right to request that we erase or rectify erroneous data that relates to you, and we will complete this task as soon as possible but guarantee to do so within a month.
Storage limitation – we delete personal data when we no longer need it. Whilst the timescales in most cases aren’t set, we outline our retention strategy within this Privacy Notice.
Integrity and confidentiality – we keep personal data safe and protected against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.

Why we collect and process your personal data

All the practices under Valli Holdings Limited are registered data controllers. We collect and process patients’ personal data for the purposes of healthcare and marketing.
In this privacy notice any reference to you is the person whose personal information we collect, use and process. This will include anyone who contacts us in connection with the products and services we provide or who interacts with us via our website www.valliopticians.co.uk, via our on-line booking system, telephone or face to face engagement in practice.
Our legal bases for processing personal data for healthcare purposes – including appointment reminders – include public task or legitimate interests.

When we provide services under the NHS General Optical Services contract (such as a sight test funded by the NHS), our legal basis for processing personal data in respect of that service is public task
Otherwise our legal basis is legitimate interests
Our condition for processing special category data is the provision of health or social care.

We process our patients’ personal data for marketing purposes with their consent or to meet a legitimate interest. This means we can tell you about eye care products and services that may be relevant to you. If you do not want us to process your personal data for marketing purposes, please let us know and we will stop.

The data we may collect and process

The personal data of patients that we may collect and process includes:

Your name, contact details and personal identifiers (such as date of birth and NHS number)
Your general and ocular health history, your family medical and ocular history, and any relevant signs or symptoms you tell us about
Details of medicines, spectacles and contact lenses prescribed for you
Details of examinations and other healthcare checks and treatments we provide
Information relevant to your continued care from other people who care for you or know you well, such as other health professionals and relatives
We collect financial information where appropriate including banking details for Direct Debit mandates
Information you provide by filling in forms on the Valli Opticians website
Details of your visit to the website and any other information voluntarily provided by you.

Why we collect and process your personal data and how is it used

The information we collect about you is for the purposes of healthcare to ensure we provide you with the very best and appropriate advice, care, products and services you’ve requested and other purposes, including.:

To confirm your identity and address
To respond to queries from you
To remind you when your next appointments are due and to book them
Occasionally we may contact you to ask your feedback on the products and services we have provided to make continual improvements
To suggest other relevant products and services we believe would be of interest and benefit you
For banking, payment and order details purposes to fulfill an order, deal with queries or refunds and collect direct debit payments for care plans, contact lens products and services, eye health products and hearing care products and services
To notify you about changes to our products and services
To offer you the opportunity to trial new products and services
To ensure that content from our website is presented in the most effective manner for you and your computer
To improve our service through survey and feedback requests to you, and to make our services and products more relevant to you
For our legal basis in processing your personal data
For the provision of health care – a special category of data is processed Article 9(2)h (for examination records and appointment reminders)
Meeting a legitimate interest – to inform you of eye and hearing health products and services which may be relevant to you
For contract purposes – carrying out an agreement we have with you
To fulfil a legal obligation
When we have your consent to it
For a public task – when we provide services under the NHS for a funded sight test
To improve the products and services we provide you – via the use of customer surveys, cookies, research and analysis.

How we hold and share your personal data

We process your personal data in strict confidence. We keep your personal data securely in our filing and electronic systems. Patient records are only accessible to the healthcare professionals working at the practice and those under their supervision.
We will usually keep any personal data we hold about you for ten years after our last contact with you before we delete it. This is the period recommended as good practice by the College of Optometrists. If we collected the data when you were aged under 18 we will keep it until your 25th birthday, in line with NHS requirements. In exceptional cases we may need to retain personal data for a longer period, and will explain our reasons for doing so on request.
In the course of processing your personal data we may share it with:

The healthcare professionals working at this practice and those under their supervision
Healthcare professionals and those under their supervision at other optical practices, but only if you have specifically asked us to pass your personal data (such as your prescription) to them
Your GP, ophthalmologists and other healthcare providers and commissioners, and suppliers of optical appliances or similar products, in connection with your ongoing healthcare treatment
Software providers for our patient record and invoicing systems, and financial institutions, so that we can keep patient records up to date and arrange payment for services provided to you.

Your rights

You have certain legal rights under The Data Protection Act 2018 in respect of the personal data we hold about you. The rights that are most relevant to the way in which we use your personal data include:

The right to be informed about how we use personal data – this privacy notice gives that information.
The right of access – if you ask us for the personal data we hold about you we will provide it within a month, free of charge (unless we have already provided it to you, in which case we may have to charge you the administrative cost of providing it again)
The right to rectification – if you ask us to correct personal data about you that is inaccurate or incomplete, where possible we will do so within a month (unless we need longer, in which case we will discuss this with you). It’s important to keep us up-to-date with your latest contact details.
The right to object – if you object to us processing your data for marketing purposes, or for healthcare purposes or where our legal basis is legitimate interests (see ‘why we collect and process your personal data’, above), we will then stop doing so, unless we are processing the data in respect of a legal claim or can otherwise show that our legitimate interest in processing the data overrides your rights and interests.
The right to erasure – also known as the ‘right to be forgotten’. If you ask us to delete your personal data, we will do so if there is no compelling reason to continue processing the data. We will not usually delete healthcare data before our usual time limit (see ‘how we hold and share your personal data’ above) where we have a duty to keep accurate records – for example, to comply with a legal obligation, or in connection with a legal claim. If you ask us to delete such data we will discuss this with you.
Data Portability – allows individuals to obtain and reuse their personal data for their own purposes across different services.

Updating your contact details and preferences

To ensure we can continue to provide you with excellent eye and hearing healthcare, we are required to send you ‘clinically necessary’ non-marketing material such as appointment reminders, notification when your prescription is due to expire, and when your products are available for collection.

Data security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.
Modern physical and electronic security systems are not entirely secure and we cannot guarantee the complete security of our database. The transmission of information through the internet is not completely secure. We will do our best to protect your personal data, but we cannot guarantee the security of your data transmitted to the website through the internet; any such transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to prevent unauthorised access.
We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

Closed-circuit television

CCTV is installed in all reception areas for the safety and security of staff and patients. Video recordings are accessed in the event further clarification is needed following any incident in practice involving staff or patients that requires investigation by Senior Management.
Where CCTV cameras are used on our premises for security purposes we reserve the right to use this as evidence where necessary. We will ensure all personal data obtained in this way is processed in line with the current Data Protection Act.

Call Recording

All of our calls are recorded for quality and training purposes:

Quality Assurance: Recordings help the organisation assess the quality of service provided by our staff. This allows us to identify areas for improvement and ensure consistent customer experience.
Training: Recordings are used to train new staff and provide existing staff with training opportunities. By reviewing real-life interactions, our staff can learn effective communication methods and problem-solving techniques.
All data is stored in line with our privacy policy and GDPR.

Privacy policy updates

We reserve our right to make any changes and updates to this privacy policy without giving notice as and when we need to. Our up-to-date privacy policy is always available on our website and takes immediate effect.
Please speak to us first if you have any questions or concerns about the way in which we process personal data.

Contacting us and the ICO about your personal data

Please speak to the Practice Manager if you have any questions or concerns about the way in which we process personal data, or contact the Data Protection Champion on info@valliopticians.co.uk or in writing to Valli Holdings Limited, 262-264 Lockwood Road Lockwood HD1 3TG
You have the right to complain to the ICO if you have a concern about our handling of your personal data which you do not think we can resolve.
You can contact the ICO at: The Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
Web: https://ico.org.uk
Tel. Number: 0303 123 1113