Privacy Policy

Who we are

Firstsight Opticians is a family-run, independent group of opticians and hearing care providers in the West of Scotland ("the Group", "we", "us"). We are the data controller for the personal information described in this policy — that means we decide how and why your information is used, and we are responsible for looking after it.

The Group operates seven practices under four trading names:

• Firstsight Opticians — Johnstone (7b Houstoun Square, Johnstone PA5 8DT) and Renfrew (44–46 High Street, Renfrew PA4 8QP)
• Bonellie Opticians — Irvine (20 Eglinton Street, KA12 8AS), Largs (101 Main Street, KA30 8JJ) and Stewarton (20 Main Street, KA3 5AE)
• J. Lindsay Opticians — Kilmarnock (59 The Foregate, KA1 1LU)
• Aitchison Opticians — Greenock (32 Ardgowan Square, PA16 8NJ)

This single policy covers all seven practices and all four of our websites — firstsightopticians.co.uk, bonellieopticians.co.uk, jlindsayopticians.co.uk and aitchisonopticians.co.uk — which are one website system presented under four brand names.

Our optometrists are regulated by the General Optical Council, and we handle personal information in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

How to contact us about your information

• Email: enquiries@web.firstsightopticians.co.uk
• Post or phone: your usual practice, or Firstsight Opticians, 7b Houstoun Square, Johnstone PA5 8DT — telephone 01505 321190, email johnstone@firstsightopticians.co.uk

Contact details for every practice are on the contact pages of our websites.

The information we collect

Depending on how you use our services, we may collect:

• Identity and contact details — name, date of birth, address, phone number and email address.
• Health information — your optical and audiology (hearing) records, including your eye examination and hearing assessment results, prescriptions, clinical images such as OCT scans, relevant medical history and medication. Health information is "special category data" under the UK GDPR, and we give it extra protection.
• NHS details — including your CHI number and eligibility information, where you have an NHS-funded eye examination.
• Appointment and purchase details — bookings, orders for spectacles, contact lenses and hearing aids, and payment records.
• Website form details — the information you enter into our booking-request, enquiry and check-up reminder forms.

Customer reviews shown on our websites are quotes from reviews already published publicly on Google.

How we collect it

We collect information directly from you: when you book or attend an appointment, complete a form on our websites or in practice, phone or email us, or buy spectacles, contact lenses or hearing aids. We may also receive information about you from your GP, a hospital, or another eye or hearing care provider involved in your care.

How we use your information, and our legal grounds

We use your information to:

• Provide optical and hearing care — eye examinations, hearing assessments, contact lens and myopia management appointments, home visits, emergency eye care, and dispensing spectacles, lenses and hearing aids. Our lawful basis is that this is necessary to provide you with our services (UK GDPR Article 6(1)(b)) and, for some clinical duties, to comply with our legal and professional obligations (Article 6(1)(c)). For your health information, we rely on Article 9(2)(h): processing necessary for medical diagnosis and the provision of health care, carried out by or under the responsibility of regulated health professionals bound by a duty of confidentiality.
• Manage appointments and orders — bookings, confirmations, order updates and payments (Article 6(1)(b)).
• Claim payment for NHS eye examinations — see the next section (Articles 6(1)(c) and 9(2)(h)).
• Send check-up reminders — where you have asked us to, or as part of the ongoing care we provide (Article 6(1)(b) and, for reminders you sign up to online, Article 6(1)(a) — consent).
• Respond to enquiries and run our websites and practices — including keeping records accurate and secure (Article 6(1)(f) — our legitimate interest in running the business well, balanced against your rights).

We do not use your information for automated decision-making, and we do not sell it to anyone.

NHS eye examinations

Eye examinations are NHS-funded and free for people ordinarily resident in Scotland under NHS General Ophthalmic Services. To be paid for this work, we submit claims — which include your personal and NHS details — to NHS National Services Scotland (Practitioner Services). This is a normal part of NHS care in Scotland.

Who we share your information with

We only share your information where there is a proper reason to. Recipients fall into two groups.

Clinical recipients, who receive information as part of your care:

• Your GP or hospital eye services, when a referral or urgent report is clinically needed.
• NHS National Services Scotland (Practitioner Services), for NHS eye examination claims.
• Manufacturing laboratories, who receive the details needed to make your spectacles, lenses or hearing aids to prescription.

Service providers (processors), who handle information on our behalf under contracts requiring them to keep it secure and use it only on our instructions:

• Xeyex — our online booking system provider. When you book online, the booking widget on our sites is provided by Xeyex (from pxportal.xeyex.co.uk) and your booking details are processed in their system.
• Vercel — our website host — and Neon, which hosts our website database (in a London, UK region). Booking-request, enquiry and reminder form submissions are stored here.
• Resend — sends our transactional emails, such as booking confirmations to you and notifications to the practice.
• Microsoft 365 — runs our practice email mailboxes (our Greenock practice currently uses its own mail server).
• Google — practice pages include embedded Google Maps (see the cookies section below).

We may also share information where the law requires it — for example with regulators, or to protect someone's vital interests in an emergency. We never sell your personal information.

International transfers

Most of your information is stored in the UK — our website database is hosted in a London region. Some of our suppliers may process limited data outside the UK as part of running their services. Where that happens, we make sure appropriate safeguards required by UK data protection law are in place, such as recognised international data transfer agreements.

How long we keep your information

We follow College of Optometrists guidance on record retention:

• Adults — optical records are kept for at least 10 years after your last contact with us.
• Children — records are kept until the patient's 25th birthday, or for 10 years after last contact if that is longer.
• Audiology records — kept on the same basis.

Website form submissions, emails and business records are kept only as long as needed for the purpose they were collected for, then securely deleted.

Check-up reminders

If you use our reminder service, we store your name, contact details and preferred reminder interval so we can let you know when your next eye or hearing check is due. You can opt out at any time by contacting your practice or emailing enquiries@web.firstsightopticians.co.uk, and we will stop the reminders.

Cookies and similar technologies

Our websites deliberately use very little. We use no analytics and no advertising trackers. The complete list is:

• Admin session cookie — used only by staff members signing in to the site's admin area. It is essential for that purpose and is not set for ordinary visitors.
• Brand-preview cookie — a functional cookie lasting 24 hours, used to preview the site under a particular brand.
• Text-size preference — if you use the accessibility control to change the text size, your choice is saved in your browser's localStorage so the site remembers it. This stays on your device and is not sent to us.
• Google Maps — practice pages embed Google Maps so you can find us. Google may set its own cookies when the map loads; this is governed by Google's privacy policy.
• Xeyex booking widget — the online booking pages load Xeyex's booking widget, which may use its own cookies or similar storage to make booking work; this is governed by Xeyex's privacy policy.

How we protect your information

We use appropriate technical and organisational measures to protect your information — including access controls, encrypted connections to our websites, and contracts with our service providers — and we limit access to those who need it for your care or to run the business. Clinical records are held in our practice systems and handled by staff bound by professional duties of confidentiality.

Children

We care for children — for example through NHS eye examinations and myopia management — and we hold children's records with the same care as adults', for the longer retention period described above. A parent or guardian will normally act for a young child. In Scotland, a young person aged 12 or over is generally presumed able to exercise their own data protection rights, and we will consider each request individually.

Your rights

Under the UK GDPR you have the right to:

• Access — ask for a copy of the information we hold about you.
• Rectification — ask us to correct inaccurate or incomplete information.
• Erasure — ask us to delete information (this is limited where we must keep clinical records).
• Restriction — ask us to limit how we use your information in certain circumstances.
• Object — object to processing based on our legitimate interests.
• Portability — receive certain information in a portable format.
• Withdraw consent — at any time, where we rely on your consent (for example, online reminder sign-ups), without affecting processing already carried out.

To exercise any of these rights, contact your practice or email enquiries@web.firstsightopticians.co.uk. We may need to verify your identity. We will respond within one month, and there is normally no charge.

Changes to this policy

We may update this policy from time to time — for example if our services or suppliers change. The latest version, with its effective date, will always be published on our websites.

Complaints

If you are unhappy with how we have handled your information, please raise it with your practice first, or email enquiries@web.firstsightopticians.co.uk — we would welcome the chance to put things right. You also have the right to complain to the UK's data protection regulator:

Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow SK9 5AF
Helpline: 0303 123 1113
Website: ico.org.uk