Optical Express Limited (SC161469) is the controller and responsible for your personal data (collectively referred to as "we", "our", "us" or "Optical Express"). We are committed to protecting and respecting your privacy, being transparent about the personal information we hold and giving you control over how it is used. This Privacy Policy sets out the type of personal information we collect about you, why we collect it and how we use it. It also provides you with information about your rights and who to contact if you have any questions or queries. Your trust is important to us.
Please read the following carefully and contact our Data Protection Officer below, if you have any queries about our privacy practices or policy.
How do we collect your personal information
We collect personal information from you:
• When you fill in forms on our website www.opticalexpress.co.uk. This includes at the time of registering to use our website, subscribing to our service or requesting further services including when you request a call back or book an appointment, and when you enter a competition or promotion sponsored by Optical Express, or when applying for a career with Optical Express.
• When you apply and use our products or services such as information collected when booking any form of eye examination or appointment.
• When you visit our website (including, but not limited to, traffic data, location data, weblogs and other communication data, whether this is required for our own billing purposes or otherwise) and the resources that you access. We also set cookies on our website which may collect your IP addresses, browser type, device type, operating system, your city and country. We use Google Analytics cookies but these cookies collect information in an anonymous form and provide us aggregated statistics about our website. For more information on how we use cookies, please read our Cookie Notice.
• When you report a problem with our website.
• When you fill in electronic or hard copy documents or forms in our clinics and stores associated with the performing of any form of ophthalmic examination, such as an eye examination (sight test), a contact lens related consultation, a pre-operative consultation to assess suitability of surgery, to conduct a surgical procedure or in the provision of any post-operative care.
• When you complete an application form for a credit agreement.
• By completing feedback surveys/forms.
• Should you make a complaint, either verbally or by another form of communication such as letter or email.
• Through transactions (complete and incomplete orders) you carry out through any medium, such as on our website, in a clinic or store and by telephone.
• Via telephone calls with you.
• Via video recording systems such as CCTV operating at our premise.
• Any other information you voluntarily share with us.
We may record telephone calls with you in order to check facts, for ensuring compliance with regulatory practices and improving the quality of our customer service. With the exception of clinician-led consultations, we delete call recordings after 14-days.
Where we have a pre-surgery clinician discussion call we keep the audio and a written record of the call for 10 years as part of your patient file.
We also collect your personal information from different sources:
• From social media.
• Via third parties such as external medical professionals (to include your General Practitioner or another Opticians practice), hospitals, and your family members.
• Companies that provide consumer classification, audience analytics, profiling, and data matching services to evaluate our adverts, for advertising and marketing purposes.
What personal information do we collect?
The personal information we collect will depend on the relationship we have with you. We may collect the following categories of personal information:
· Contact / demographic details such as name, email address, postal address and telephone number.
· Identification information such as date of birth.
· Special category personal data such as health and lifestyle information relating to current or historic eye conditions, medications and health conditions, ethnicity, current visual or ocular symptoms or concerns, clinical outcomes of examinations, assessments or diagnostic tests.
· Occupation, hobbies, and if you are a driving licence holder.
· Your visual motivations and current vision correction solutions.
· Your consent to undertake diagnostic imaging, ophthalmic examinations or surgical procedures.
· Your prescription and other information relating to your eyes or eye health forming part of your clinical care.
· Diagnostic images and data / measurements captured using diagnostic equipment during your eye examination, contact lens examination, preoperative and / or postoperative consultation.
· Your patient reported outcomes through our patient experience questionnaires.
· Your marketing preferences.
· Financial information such as bank details, credit and/or debit card details.
· Employment information including your income.
· Information obtained via our cookies as detailed in our cookie policy.
· Images obtained from video recording systems such as CCTV.
· Voice recordings from telephone calls with us.
· Details of your next of kin.
How do we use your personal information?
We may use the personal information we hold about you in different ways for different purposes. We have listed below the personal information we collect, how we use this information and our legal basis for processing this information. We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances where:
· We need to perform the contract we are about to enter into or have entered into with you.
· It is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests (e.g. to record and keep calls).
· We need to comply with a legal obligation.
· You have given us your consent. However, we generally do not rely on consent as a legal basis for processing your personal data although we will get your consent before sending third party direct marketing communications to you via email or text message. You have the right to withdraw consent to marketing at any time by contacting us.
We may monitor the effectiveness of our marketing activities using our existing customer data to understand how audiences respond to our online and TV advertising campaigns. The information we use for analysis includes customer postcodes and email addresses. To enable us to better understand our audience, we may share this information securely with third parties who we partner with to identify opportunities to improve how we advertise Optical Express. We carry out this activity on the basis of legitimate interest. If you do not wish for your personal data to be used for this purpose, please contact dpo@opticalexpress.com.
When we process special category personal data, in addition to the above legal bases, the additional bases for processing that we rely on are:
· Where it is necessary for the purposes of the provision of health or social care or treatment or the management of health and for ‘Health or Social Care Purposes’ under Schedule 1, Part 1(2) of the Data Protection Act 2018.
· In limited circumstances, with your explicit written consent.
· Where it is necessary to protect you or another person from harm.
· Less commonly, we may process this type of information where it is needed in relation to legal claims, or where it is needed to protect your interests (or someone else's interests) and you are not capable of giving your consent, or where you have already made the information public.
1. Regulatory compliance
We will use your personal data where it is required to meet our regulatory requirements or to comply with the law.
This will include where the use of your personal data is:
· Necessary to meet a legal or regulatory obligation set by our regulators, such as the General Optical Council (GOC), General Medical Council (GMC), CORU, Irish Medical Council (IMC), Care Quality Commission (CQC), Health Improvement Scotland (HIS), Health Inspectorate Wales (HIW), Regulation and Quality Improvement Authority (RQIA) and our data protection supervisory authorities, the Information Commissioner’s Office (ICO) or the Data Protection Commission (DPC).
· Required the prevention, investigation, detection of criminal conduct, and in order to protect our premises, our customers and staff.
· Required for reasons of substantial public interest such as fraud protection and credit risk reduction.
2. To fulfil our Contractual Obligations
We will use your personal data as it is necessary for our contract with you or to potentially enter into a contract with you.
This would apply when:
· we need to use your personal information to provide you with a service and/or vision correction solution/product, such as to fulfil orders for glasses, contact lenses, ocular lubricants or medications and contact lens cleaning solutions, to undertake an eye examination (sight test), to complete a pre-operative consultation to assess your suitability of surgery or to undertake a surgical procedure such as laser treatment or lens replacement.
· we need to share your personal information to a retail bank to process your application for a credit agreement.
3. Legitimate interest
Where we have a legitimate business reason we will process your personal data for the following reasons to:
· Transmit and use personal information within the Group and (our Other Subsidiary Company (each defined below)) we are part of for internal administrative tasks, to resolve any complaints, and develop and improve our products and services. This may include details of your visits to our website and the resources you access, and recording telephone calls for training purposes. At all times we will ensure our business needs do not result in harm to you by impacting on your privacy rights and freedoms.
· Audit and analyse the clinical or patient reported outcomes of vision correction solutions (surgical and non-surgical, to include information obtained at eye examinations, contact lens consultations or pre- or post-operative refractive surgery consultations and during ophthalmic procedures) provided by Optical Express. We carry out internal audits our records as a quality improvement exercise for our diagnostic scans.
We will never publish any research data which allows you to be identified.
· To share existing personal data with companies we engage to provide use with adverts in order to receive audience insights and evaluation services from them to monitor the effectiveness of our marketing activities, to understand how audiences respond to our online and TV advertising campaigns, and to identify opportunities to improve how we advertise Optical Express.
· Establish, exercise or defend our legal rights. This will include our right to defend any legal claim or to pursue a legal claim.
· Send you direct marketing communications and advertising.
· Send you eye sight test, contact lens or surgical procedure related reminders. At your eye test, your optometrist will recommend the date of your next eye test. This is normally at least once every two years, unless your optometrist recommends otherwise. To help you look after your eye health, we will contact you to remind you to book an eye sight test shortly before your test is due. If we don’t hear from you, we will follow up to remind you to book an appointment.
· Send you service related reminders, such as to remind you of an upcoming appointment.
4. Consent
We may require either your verbal or written consent from you to process your personal data in the following circumstances to:
· Provide your personal information with someone you have would like to act on your behalf, for example, a member of your family.
· Share your personal data with another optometrist, your General Practitioner or hospital.
· Set cookies on our website.
· Provide you with our direct marketing communications by email or text.
5. Vital interest of the data subject
We may need to share your personal information without your consent to protect your vital interests. This would only apply in exceptional circumstances, for example, if a hospital required information about your eye health and you were unable to give your consent to the transfer of the information.
6. Who do you share my information with?
We may share your personal information within the Group and our Other Subsidiary Company or with third parties. Third parties that we may share your personal information with include:
· The NHS, for example, to make a referral to your local hospital.
· Relevant regulators such as such as the General Optical Council (GOC), General Medical Council (GMC), CORU, Irish Medical Council (IMC), Care Quality Commission (CQC), Health Improvement Scotland (HIS), Health Inspectorate Wales (HIW), Regulation and Quality Improvement Authority (RQIA) and our data protection supervisory authorities, the Information Commissioner’s Office (ICO) or the Data Protection Commission (DPC).
· Our legal advisors and insurance providers.
· Opposing solicitors to establish, exercise, or defend our legal rights. This will include our right to defend any legal claim or to pursue a legal claim against us.
· Our clinical services team, to include our in-house optometrists and ophthalmologists.
· Your private health care provider if they are funding your treatment with Optical Express.
· The police or other law enforcement agencies if the sharing is required to prevent and detect fraud or criminal activity.
· Third parties who provide us with services such as mail or email services, marketing or advertising services. If so, we will ensure that adequate arrangements are in place to protect your personal data.
· Retail banks who provide credit agreements should you choose to submit an application. Third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy policy.
We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.
How long do we keep records for?
We will only keep your personal information for as long as reasonably necessary for the purpose of:
· Maintaining a record of your eye examination or treatment.
· Providing you with services that you have requested.
· To meet obligations set by our regulators.
· To defend or support ourselves in legal proceedings or to comply with the law.
If you receive an eye sight test, we are required by our regulators to retain a copy the results for a minimum period of 10 years.
If you are interested in receiving laser or lens treatments with us, we will request that you attend one of our clinics for a consultation to assess your suitability for surgery. At the consultation, we will gather information from you including your contact details, information relating to your health and lifestyle to assess your suitability for surgery and complete an eye examination (sight test). Information we collect during your laser or lens consultation or treatment is considered by our regulators to form part of your medical record and must be retained for a minimum period of 10 years.
International Transfers
We share your personal data within the Group and our Other Subsidiary Company. This will involve transferring your data outside the UK and European Economic Area (EEA).
Many of our external third parties are based outside the UK/EEA so their processing of your personal data will involve a transfer of data outside the UK/EEA.
We also transfer personal data to and from Ireland and the UK.
Whenever we transfer your personal data out of the UK and EEA, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:
· We will transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data. Where your personal data is transferred to and from the EEA and UK this is done on the basis of the adequacy decisions for the UK and EU.
· Where we use certain service providers, we may use specific contracts approved for use in the UK and/or EEA which give personal data the same protection it has in the UK and/or the EEA.
Please contact us if you want further information on the specific mechanism used by us when transferring your personal data out of the UK and/or the EEA.
Your Rights
Under certain circumstances, Data Protection law provides you with rights to the personal information we hold about you. Please contact our Data Protection Officer at DPO@opticalexpress.com to exercise these. These rights are:
· The right to be informed
You have the right to be informed about how we collect and what we do with your personal data. We provide this information through this Privacy Policy.
· The right to access your personal information
You are entitled to access your personal information we hold. This means you can request a copy of the personal information held by us. There is not usually a charge for dealing with your request. For any additional copies however we will charge a reasonable fee for administrative costs. We will usually provide your information in writing, unless otherwise requested, or where you have made the request electronically we will strive to provide you with your data by electronic means where possible.
· The right to object to processing
In certain circumstance you can object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.
· The right to rectification
We strive to keep your personal information accurate and complete. However if you do believe this is not the case you can ask us to update or amend it. Details on how to contact us are provided in this Privacy Policy.
· The right to erasure
In certain circumstances you have the right to ask us to erase your personal information, for example when the personal information is no longer necessary in relation to the purposes for which it was collected or where you have withdrawn your consent. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see above), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. However we may not fulfil such a request if there are legal or regulatory obligations that mean we cannot erase your personal information or where it is necessary to continue eye care services or treatment.
· The right to restriction of processing
In certain circumstances you have the right to ask us to limit or suppress the use of your personal information, for example where you believe the information we hold about you is inaccurate. However we may not fulfil such a request if there are legal or regulatory obligations that means we cannot do so or where it is necessary to continue eye care services or treatment.
· The right to data portability
In certain circumstances you have the right to ask us to transfer personal information, that you have provided to us, to another third party where this is technically feasible. Once your personal information has been transferred to a third party, of your choice, they are responsible for safeguarding your personal information.
· Rights related to automated decision making including profiling
You have the right not to be subjected to solely automated decision making, including those based on profiling, that would have a legal or significant effect on you.
You also have the following rights under Data Protection law:
· Your rights in relation to marketing
You can ask us to stop sending you marketing at any time. Each of our marketing communications clearly carries an unsubscribe option in the event that such information is not welcomed.
· The right to withdraw consent
We will ask for your consent for certain uses of your personal information, for example, if you have authorised a family member to act on your behalf. Where we process your personal information based on your consent, you can withdraw consent at any time.
· The right to lodge a complaint
You have a right to lodge a complaint with the relevant supervisory body at any time in circumstances where consider your personal information has been used by us in a way that does not comply with data protection law. The supervisory body for data protection matters in the UK is the Information Commissioner’s Office (ICO). The contact details for the ICO are contained in the ‘Contact’ section of this Privacy Policy.
The supervisory body for data protection matters in Ireland is the Data Protection Commission (www.dataprotection.ie).
Contact
Questions, comments and requests regarding this Privacy Policy are welcomed and our Data Protection Officer can be contacted by writing to:
Address: Optical Express, 200 St Vincent Street, Glasgow, G2 5RQ
Email: DPO@opticalexpress.com
We aim to directly resolve all complaints about how we handle personal information. However, you also have the right to lodge a complaint with the relevant supervisory body.
If you would like to contact the UK’s Information Commissioner’s Office directly write to:
Address: the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow,Cheshire,SK95AF.
Telephone: 0303 123 1113.
Email: ico.org.uk/global/contact-us/email/
Optical Express Group Details
Optical Express is the trading name of the following legal entities:
Optical Express Ltd SC161469
Optical Express (Westfield) Ltd SC161695
Optical Express (Gyle) Ltd SC150432
The Frame Zone Ltd SC182069
The above limited companies are registered at: The Ca'd'oro, 45 Gordon Street, Glasgow G1 3PE
Other Subsidiary Company
Anglia Community Eye Service Ltd 05632363
Registered at: Cromwell Road, Wisbech, Cambridgeshire PE14 0SN
Lorena Cosmetics Holdings SPV Limited SC817369
Registered at: 200 St. Vincent Street, Glasgow, Scotland, G2 5SG
Changes to our Privacy Policy
We reserve the right to amend our privacy policy. If we make changes we think are important, we will inform you by placing a notice on the relevant service/website and/or contact you by other methods of communication, such as email.
Last updated: September 2024