Privacy Notice

PRIVACY NOTICE FOR PATIENTS OF GLASGOW CALEDONIAN UNIVERSITY VISION CENTRE

Why we collect and process your personal data

Glasgow Caledonian University (GCU) is the Data Controller for your personal information which is processed as you are using the services of GCU Vision Centre. This privacy notice sets out our arrangements for handling your personal information.

 We collect and process patients’ personal data for the purposes of healthcare and marketing.

 Our legal bases for processing personal data for healthcare purposes, including appointment reminders, include public task or legitimate interests.

  • When we provide services under the NHS General Optical Services contract (such as a sight test funded by the NHS), our legal basis for processing personal data in respect of that service is public task
  • Otherwise our legal basis is legitimate interests

 Our condition for processing special category data is the provision of health or social care or treatment.

We process our patients' personal data for marketing purposes with their consent or where there is a legitimate interest to do so. This means we can tell you about eye care products and services that may be relevant to you. If you do not want us to process your personal data for marketing purposes, please let us know and we will stop.

 The data we may collect and process

We obtain information directly from patients or from healthcare professionals and service providers.

The personal data of patients that we may collect and process includes:

  • Your name, contact details and personal identifiers (such as date of birth and NHS number)
  • Your general and ocular health history, your family medical and ocular history, and any relevant signs or symptoms you tell us about
  • Details of medicines, spectacles and contact lenses prescribed for you
  • Details of examinations and other healthcare checks and treatments we provide
  • Information relevant to your continued care from other people who care for you or know you well, such as other health professionals and relatives

 How we hold and share your personal data

We process your personal data in strict confidence. We keep your personal data securely in our filing and electronic systems. Patient records are only accessible to the healthcare professionals working at the practice and those under their supervision.

 We will usually keep any personal data we hold about you for ten years after our last contact with you before we delete it. This is the period recommended as good practice by the College of Optometrists. If we collected the data when you were aged under 18 we will keep it for ten years, or until your 25th birthday if that is later, in line with NHS requirements. In exceptional cases we may need to retain personal data for a longer period, and will explain our reasons for doing so on request.

 In the course of processing your personal data we may share it with:

  • The healthcare professionals working at this practice and those under their supervision
  • Healthcare professionals and those under their supervision at other optical practices, but only if you have specifically asked us to pass your personal data (such as your prescription) to them
  • Your GP, ophthalmologists and other healthcare providers and commissioners, and suppliers of optical appliances or similar products, in connection with your healthcare treatment
  • Software providers for our patient record and invoicing systems, and financial institutions, so that we can keep patient records up to date and arrange payment for services provided to you

Keeping your information updated

GCU strives to keep your information accurate and up to date. You should inform the GCU Vision Centre of any changes to your personal information. You can do this by contacting the Visions Centre on 0141 331 3377 or by emailing visioncentre@gcu.ac.uk

Your rights

You have legal rights in respect of the personal data we hold about you. The Information Commissioner’s Office (ICO) has published information on rights at: guidance on the full range of rights. https://ico.org.uk/global/privacy-notice/your-data-protection-rights/ The rights that are most relevant to the way in which we use your personal data include:

  • The right to be informed about how we use personal data
  • The right to object The right of access
  • The right to rectification
  • The right to erasure

Contacting us and the ICO about your personal data

Please speak to us first if you have any questions or concerns about the way in which we process personal data. You can contact the Data Protection Officer via dataprotection@gcu.ac.uk or by post to: Data Protection Officer, Department of Governance, Britannia Building, Glasgow Caledonian University, Cowcaddens Road, Glasgow, G4 0BA

If you are unhappy with the University’s response you have the right to complain to the Information Commissioner’s Office (ICO). You can contact the ICO at https://ico.org.uk/concerns/