Zacks Eye Clinic – Data Management Policy

Zacks Eye Clinic understands that your privacy is important to you and is committed to protecting the privacy of your personally-identifiable information. The scope of our commitment and how we use and protect any information that you give us will comply with the EU General Data Protection Regulation (GDPR) and is described in this document.

This policy describes the personal data that Zack Eye Clinic Ltd hold, how we use it and how we protect it. The personal data we collect includes names, addresses, e-mail addresses, phone numbers and IP addresses of visitors to our practice and our website. The data is held for the provision of health care eg as patient records, for legitimate interests eg direct marketing to existing customers and for the performance of a contract with the data subject eg employee records.

• The practice is registered with the Information Commissioner, Registration No. ZA016491
• The practice is registered with Companies house: Company number: 06039870
• The business address is: 30c Warren Street, London W1T 5NF
• The registered office address: 2nd Floor, 201 Haverstock Hill, Belsize Park, London, NW3 4QG
• Our optometrists and dispensing opticians are all registered with the General Optical Council and will follow the guidance from the College of Optometrists and the Optical Confederation.

Patient Records and Clinical Scans

We hold various information about our patients including name, address, and clinical details such as the state of health of your eyes, your spectacle and/or contact lens prescription, and copies of any letters we have written about you or received from other professionals, such as your doctor.

Clinical records, including spectacle prescriptions, and dispensing information are stored electronically in our practice management software and recall dates and reminders are processed by our software. Clinical scans, photographic records and visual fields records are held on separate data-bases within the practice.

If you have a sight test you will be given a copy of your spectacle prescription. If you are referred to a doctor, we will offer you a copy of the referral letter. If you are fitted with contact lenses you will be given a copy of your contact lens specification when the fitting process has been completed.

If you would like a copy of your clinical record or a report on any other data we hold, there may be an administrative charge for providing it. If you wish to see your records, please submit a written request FAO: Jonathan Cohen and we will respond as quickly as possible, within one month.  If you require independent advice, you can contact the Information Commissioners Office at www.ico.gov.uk.

We adhere to the guidelines of the College of Optometrists, the Optical Confederation and Information Commissioners Office and will not pass any of your personal information to a third party without your consent unless there is a clear public interest duty to do so.  You will need to provide us with your consent if you wish us to pass your information to another optometrist.

If you are an NHS patient, we are obliged to provide the portion of your record that relates to NHS services to authorised persons within the NHS (who are in turn are subject to a duty of confidentiality) if they request this. This is usually to confirm that we have provided the NHS services that we have been paid for, and to improve the quality of care. It is also possible that the NHS may contact you to ask if you have received services (such as a sight test or spectacles) as part of this monitoring.

Within the practice we may use the information to analyse trends, or to audit our performance. This enables us to monitor and improve the quality of care that we offer you. Wherever possible (i.e. if we do not need to know who an individual patient is) we will only analyse trends from anonymised information. If you have any queries about this, please contact us and we will be happy to help.

How we protect clinical information

• All practice staff have a confidentiality clause within their contracts.
• All personal information contained on practice records, whether paper or electronic, is considered confidential.
• We will not discuss your personal information with anyone other than you or, if you are under 16 and not Gillick competent, your parent or guardian without your permission.
• Care is taken that records are not seen by other people in the practice
• All staff are aware of the importance of ensuring and maintaining the confidentiality of patients’ personal data and that such data must be processed and stored in a secure manner.
• Electronic data is protected by suitable back-up procedures and software is updated regularly.
• When computers are replaced, old hard drives are securely erased or physically destroyed.
• Clinical records are retained for periods as agreed by the optical bodies (at least 10 years).
• Confidential paper information requiring destruction is shredded.
• If the need arises to transfer information we have procedures that include consent and secure transfer.
• Any suspected breaches of security or loss of information are reported immediately and are dealt with appropriately.
• Paper records are kept secure and away from access by the public.

How we use and process the information we hold

To discharge our legal and contractual duties:

• We make sure that staff who help in the provision of ophthalmic services and dispensing are appropriately trained and supervised for the tasks that they undertake.
• We may also use the information we hold to remind you when check-ups are due and we may send you eye care and eyewear information. If you do not want us to do this please let us know.

How we transfer personal data

• We transfer personal information (data) securely.
• Will not ask your permission for our IT support contractors (who in turn are subject to a duty of confidentiality) to support, service, maintain, update, or recover any aspect of our hardware or software systems that contain your data. If a copy of your data is made by our support contractors for any reason, it will be restored to our system and deleted elsewhere.
• We will normally ask your permission if we want to transfer personal information about you to someone else.
• We may not ask your permission if we transfer the information to another healthcare professional who is responsible for your care and who needs that information to help to care for you.
• We may not ask your permission if we need to use a third party employed by us (who in turn are subject to a duty of confidentiality) to provide a service such as printing recall letters or mailshots. In this case the third party would only see your name and address data, which would subsequently be deleted.
• We may also not ask your permission if we are ordered by law to transfer the information. This may be if a court asks us for the information.

Payment Data and Direct Debits

Invoices, credit card payments, direct debit details and other financial data are held securely and separately to patient records for at least 6 years as recommended by HMRC and are restricted to the relevant staff on a need to see basis.

Direct Debits are processed by external providers via password protected secure servers. Organisations using the Direct Debit Scheme go through a careful vetting process before they’re authorised and are closely monitored by the banking industry. The efficiency and security of Direct Debit is monitored and protected by your own bank or building society. Your Bank details are stored securely on our supplier’s password protected server and your transactions are protected by the Direct Debit Guarantee. It protects you in the rare event that there is an error in the payment of your Direct Debit.

Employment Records and Data

Employee records and data are held and processed for the following reasons:

• For performance of employment contracts
• To comply with our legal obligations on processing tax payments and pensions.
• To protect the vital interests of our employees or their dependants
• For the legitimate interests of the business.

Employee records are kept for at least 5 years and payroll records for at least 3 years from the date of termination. Employee records are stored securely within the practice and by our accountants who run the payroll and in turn are subject to a duty of confidentiality.