Privacy notice: Eye Health Clinic

This privacy notice tells you what to expect us to do with your personal information when you use the services of UCLan’s Eye Health Clinic. Personal information (or personal data) is any information which relates to and identifies you. Data protection legislation (the General Data Protection Regulation (GDPR) and the Data Protection Act 2018 (DPA)) set out how we should handle your personal information. 

The University of Central Lancashire Higher Education Corporation is the data controller for the personal information we process unless otherwise stated. We are registered with the Information Commissioner’s Office and our registration number is Z5512420.

There are many ways you can contact us, including by phone, email, social media and post. See our main contact details.

You can contact the Eye Health Clinic on eyeclinic@uclan.ac.uk and find more information on the Eye Health Clinic web pages. 

UCLan’s Information Governance Manager & Data Protection Officer can be contacted on DPFOIA@uclan.ac.uk. Further information and contact details can be found on this webpage.

The Eye Health Clinic is a fully functioning clinic designed to meet all your eye health needs while providing essential, fully supervised practical training to UCLan’s final-year Optometry students.

Eye Health Clinic practitioners, students and the academic team will use information you provide directly to us when you contact us to make an appointment, undergo consultations and receive treatment, diagnoses, prescriptions and purchase products, as well as any information we generate as a result of providing our services.

The information we will collect about you includes your name, contact details and personal identifiers; your general and ocular health history; your family medical and ocular history; any relevant signs or symptoms you tell us about; details of medicines, spectacles and contact lenses prescribed for you; details of examinations and other healthcare checks and treatments we provide; and information relevant to your continued UCLan Eye Health Clinic Patient privacy notice FINAL v1.0 October 2020 Page 2 of 6 care from other people who care for you or know you well, such as other health professionals and relatives.

We will use your personal data to provide the services offered by the Eye Health Clinic, as well as for teaching and research purposes

.Personal data will be used for administrative purposes associated with Clinic management, such as booking appointments, billing, communicating with patients and managing purchases of products such as contact lenses and spectacles.

We will use your information to deliver clinical services such as undertaking consultations and examinations, making diagnoses, providing treatment, issuing prescriptions, dispensing spectacles and making referrals.

Personal data will also be used for regulatory purposes including handling complaints about our staff and students, and ensuring our continued compliance with the General Optical Council’s (GOC) Standards for optical businesses, Standards for optical students, and Standard for optometrists and dispensing opticians. The GOC is the regulator for the optical professions in the UK, protecting the public by promoting high standards of education, performance and conduct amongst optical professionals.

We will also use your personal data for teaching and research purposes. UCLan’s Eye Health Clinic provides essential practical training to our final year Optometry students, who will undertake patient examinations as part of their programme of study under the supervision of fully qualified and experienced members of staff. Patient data will also be used for research purposes where appropriate measures are in place to safeguard patient confidentiality, in compliance with data protection legislation.

The University can only process personal data about you if there is a lawful basis from the GDPR which allows us to do so.

From the point you initially contact the Eye Health Clinic, information will be collected, and records will be created and maintained, for the purposes set out in this notice. The lawful bases on which we rely for processing information for those purposes are as follows:

Article 6(1)(b), which allows us to process personal data when it is necessary for the performance of a contract. You enter into a contract with us when you use our services. Under that contract, we deliver our clinical services and undertake associated administrative services, among other things. We require you to provide any information we reasonably request for these purposes otherwise we cannot deliver your contract.

Article 6(1)(c), which allows us to process personal data when it is necessary to comply with a legal obligation.

We are legally required to provide eye and eyesight tests on request, and spectacles with special corrective lenses if needed, to employees who are regular users of display screen equipment (DSE). This requirement arises from the Health and Safety (Display Screen Equipment) Regulations 1992. If you are a UCLan employee and attend the Clinic for a DSE sight test, we rely on this lawful basis to process the personal data associated with your test.

We also rely on this lawful basis to process personal data for some regulatory purposes, such as investigating complaints against staff or students delivering clinical services, or for conducting Fitness to Practise investigations. If the GOC investigates a complaint, we may be legally required to share patient data with it for the purposes of its investigations, as set out in the Opticians Act 1989.

Article 6(1)(e), which allows us to process personal data where it is necessary to perform a task in the public interest. The University’s public tasks are the provision of education and the carrying out of research, and related activities. One of the functions of our Eye Health Clinic is to provide essential practical training to students in their final year of our Optometry course. Where your examination is undertaken by one of our students, your personal data will be processed for the purposes of providing their education as well as providing clinical services.

We also rely on this condition to process personal data for the purposes of research in the public interest.

Article 6(1)(f), which allows us to process personal data where it is in our, or someone else’s, legitimate interests to do so and it does not unduly prejudice your rights and freedoms. We rely on this condition to, among other things:

• Process your personal data for regulatory purposes to ensure we are meeting all of the applicable standards set out by the GOC. It is in patients’ interests to ensure we are providing our clinical and educational services to a high standard as expected by the GOC.
• Send information about our services to you, unless you tell us not to. It is in the University’s legitimate interests to promote its services to those who may be interested.
• Produce some internal reports, research, market research, surveys and statistics, including in relation to equal opportunities monitoring. It is in our legitimate interests to use these to evaluate, plan and assess how the University’s Vision Sciences courses and Eye Health Clinic are operating and make any changes we think are appropriate and will benefit current and future students, patients and employees.

We also process some information only if you provide your consent. In this case, Article 6(1)(a) applies, and Article 9(2)(a) applies where the information is special category data (special category data is information about your race, ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data used for ID purposes, health, sex life or sexual orientation). It will be clear where we are relying on your consent to collect and use your information because consent will be requested at the time you provide the information. When you are asked for consent, we will explain why we are asking for the information and how we will use it if you choose to provide it. Consent can be withdrawn at any time and we will explain how you can do this in each individual case.

Where we process special category data for the purposes set out in this notice, we rely on the following additional lawful bases from the GDPR and DPA:

Article 9(2)(g) GDPR, which allows us to process special category data if the processing is necessary in the substantial public interest and there is a basis to do so in law. The law which allows us to rely on Article 9(2)(g) is section 10 and Schedule 1 DPA. The specific conditions from Schedule 1 DPA on which we rely for this type of processing are as follows:

• Schedule 1(6), which allows us to process special category data to comply with a statutory or legal obligation. Such obligations include, but are not limited to, those set out in the Opticians Act 1989, the Health and Safety (Display Screen Equipment) Regulations 1992 and the Equality Act 2010.
• Schedule 1(8), which allows us to process special category data to monitor equality of opportunity or treatment.
• Schedule 1(11), which allows us to process special category data to protect the public against dishonesty, such as when we provide information to assist regulators to carry out their functions e.g. providing information to the GOC in relation to Fitness to Practise investigations.

When processing special category data in reliance on the above conditions from Schedule 1 DPA the University must have an appropriate policy document: Data Protection: Processing special category data and criminal convictions data.

We also process special category data in reliance on the following additional lawful bases:

Article 9(2)(h) GDPR and Schedule 1(2) DPA which enable us to process special category data for the purposes of occupational medicine, medical diagnosis and the provision of health care or treatment when the data is processed by or under the responsibility of a professional who is subject to professional secrecy obligations, such as those set out by the GOC in relation to patient confidentiality.

Article 9(2)(j) GDPR, which allows us to process special category data for archiving, scientific or historical research purposes or statistical purposes, where there is a basis to do so in law. The law which allows us to rely on this basis is section 10 and Schedule 1(4) DPA.

We share your information with some external organisations and bodies, some of which are processing personal data on our behalf. We only share your personal data with another person or organisation where the law allows us to and we consider it to be appropriate under the circumstances. The external parties we will share information with include the following:

• Professional and regulatory bodies such as the GOC. Information is shared for staff and students‘ fitness to practise’ purposes and for the accreditation of courses, among other things, although we will always anonymise patient data where possible.
• Your GP if you have diabetes or glaucoma. We will share the outcome of your sight test.
• Other health professionals who are, or need to, be involved in the provision of healthcare to you.
• External debt collection agencies to recover unpaid debts owed to us.
• University insurers: information, including accident forms, is shared with our insurers to provide insurance cover and to enable us to make insurance claims.
• Government agencies and authorities, including the police for the prevention and detection of crime, apprehension and prosecution of offenders, the collection of tax or duty and safeguarding national security, among other things.
• Executive agencies or non-departmental public bodies such as the Health and Safety Executive.
• Internal and external auditors to provide assurance that the University is following its risk management, governance and internal control processes and to independently inspect our financial statements and records.
• External examiners and assessors for student assessment and examination purposes, although we will always anonymise patient data where possible.
• Third parties carrying out research or surveys where there is a lawful basis to share information and they are carrying out their statutory tasks in the public interest.
• Companies or organisations acting on our behalf: We use data processors who are third parties who provide elements of services for us. We have contracts in place with our data processors. This means that they cannot do anything with your personal information unless we have instructed them to do it. They will hold it securely and retain it for the period we instruct. 

Occasionally we may need to send your personal information outside the European Union/European Economic Area (EU/EEA) e.g. to obtain a service from a data processor. We only transfer personal data outside the EEA if there is a lawful basis to do so and appropriate safeguards are put in place to protect your information and ensure it remains secure.

We will retain your patient records for 10 years following your last contact with the Clinic, as recommended by the College of Optometrists. If you were under 18 years of age when we collected your information, we will retain your patient records until your 25th birthday.

If you attend the Clinic as a UCLan employee for the purposes of a DSE sight test, we will retain records of your test for 10 years, as required by the Health and Safety (Display Screen Equipment) Regulations 1992.

Where information is used for other, related purposes, such as communicating with you about the activities of the Clinic, requests for feedback about our services, teaching and research purposes, it may be retained for shorter periods. All information will be retained and disposed of in line with the University’s retention schedule.

Under data protection law, you have rights we need to make you aware of. The rights available to you depend on our reason for processing your information. Further information about each of these rights can be found on the Information Commissioner’s Office website.

Your right of access

You have the right to ask us for copies of your personal information. This right always applies. There are some exemptions, which means you may not always receive all the information we process. For further information or to make a request, please see our Data Protection webpage.

Your right to rectification

You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. This right always applies.

Your right to erasure

You have the right to ask us to erase your personal information in certain circumstances.

Your right to restriction of processing

You have the right to ask us to restrict the processing of your information in certain circumstances.

Your right to object to processing

You have the right to object to any processing we carry out, if we carry it out on the basis that it forms part of our public task or is in our legitimate interests. You also have the right to object to your personal information being used for direct marketing purposes.

Your right to data portability

This only applies to information you have given us. You have the right to ask that we transfer the information you gave us from one organisation to another, or give it to you. The right only applies if we are processing information because we have your consent or because it is necessary for a contract you are a party to, and the processing is automated.

We work to high standards when it comes to processing your personal information. If you have queries or concerns, please contact the Vision Sciences course team and we will respond. Alternatively, you can contact the Information Governance Manager & Data Protection Officer.

If you remain dissatisfied, you can make a complaint about the way we process your personal information to the Information Commissioner’s Office, which is the UK supervisory authority for data protection. Further information can be found on the data protection pages of our Data Protection webpage.