Privacy notice for J R Lane Opticians
This privacy notice describes the processing activity undertaken by J R LANE OPTICIANS (“we”).
Who we are
When you use our services or where you are employed or engaged by us, we are data controller for your personal data. This means that we are responsible for ensuring your personal data is processed in line with data protection law, including the UK General Data Protection Regulation and Data Protection Act 2018. We are registered with the Information Commissioners Office. Our registration number is ZB179613
What we do
As an optometry practice, if you visit us in order to use our services, we will use your personal data for the following purposes:
1. To provide Optometry services to our patients
The personal data of patients that we may collect and process includes:
Your name, contact details and personal identifiers (such as date of birth, NHS number)
Your general and ocular health history, your medical and ocular history and relevant symptoms
Details of spectacles, contact lenses and medicines prescribed for you
Details of examinations and healthcare checks performed
Payment details for products and services provided for you
Information relevant to your continued care from other people who care for you, such as other health care professionals, practice staff and relatives
In order to use your personal data for these purposes, we must have a lawful basis in data protection law. Where that personal data concerns special characteristics including your health, sex or ethnicity we must also have an exemption to process.
For these purposes, we therefore rely on:
Article 6(1)(b) – processing is necessary for performance of a contract
Article 6(1)(e) – processing is necessary for a public task undertaken in the public interest (where you are an NHS patient)
Article 6(1)(f) – processing is in our legitimate interests* (where you are a private patient)
*our legitimate interests are providing you the healthcare service you have requested
Article 9(2)(h) – processing is necessary to provide health and care
2. Managing the employment of practice staff
If we are your employer, we will use your personal data for the following purposes:
To keep staff records. Information kept includes full name, address, contact details, date of birth, NI number, bank details
Information relating to payment of wages including wages paid, hours worked, PAYE, NI and pension payments
Staff health and wellbeing
Staff recruitment
For these purposes, we rely on the following lawful bases:
Article 6(1)(a) – processing is carried out under consent
Article 6(1)(b) – processing is carried out for contract purposes
Article 6(1)(f) – processing is necessary for our legitimate interests*
*our legitimate interests are managing your employment with us
Article 9(2)(a) – based on explicit consent
Article 9(2)(b) - processing is necessary for purposes in the field of employment
Article 9(2)(h) – processing is necessary to provide health and care
Who we share data with
We will share your personal data with healthcare professionals where necessary in order to support your care including your GP and ophthalmologists involved in your care.
Suppliers of optical appliances in connection with your ongoing treatment.
Software providers for our invoicing systems.
Financial Institutions to arrange payment for services provided for you.
Whether you are a private or NHS patient, we will not share your personal data with anyone outside the provision of your care, unless we have a legal obligation to do so.
Your personal data will not be transferred outside the UK.
Depending on the purpose of processing, we will keep your personal data for a defined period of time, after which it will be deleted. For the purposes described above, the following retention periods will apply:
Delivery of service to our patients - Patient records are retained for 10 years from last contact with you
Employment - Summary until up to retirement age
Salary payments, PAYE, NI, Pension payments - Retained for 7 years
Payments for products and services - Retained for 7 years
Your rights
Under data protection, you have a number of rights in relation to data protection. The application of these is dependent on the lawful basis being used. These include:
· Right to be informed
· Right of access
· Right to rectification
· Right to object
· Right to erasure
You may exercise these rights free of charge except in limited certain circumstances, however, you will always be informed if there is a cost associated. We will provide a response to your request within a month.
If you wish to exercise any of your rights, please contact us at the address below.
Contact Us
We have appointed a Data Protection Officer who advises monitors our compliance against data protection law. You can contact the DPO, Jason Lane on 02920 568885 or jrlaneopticians@yahoo.co.uk
To contact us, please email jrlaneopticians@yahoo.co.uk
Our postal address is 96B STATION ROAD, LLANDAFF NORTH, CARDIFF, CF14 2FG
Complaints
If you have any complaints regarding our use of personal data, please contact us by one of the above means. In the event we cannot resolve your complaint, you have the right to complain the Information Commissioners Office, the UK data protection regulator.
They can be contacted at:
Information Commissioner's Office (www.ico.org.uk)
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Tel: 0303 123 1113
Document reviewed (including version number):
VERSION #2
Reviewer: JASON LANE
Date: 20.01.2026
Comments on gaps, next actions, etc. Review as necessary
This document was produced by Kaleidoscope Consultants Ltd (2021)
for Cardiff and Vale University Health Board to support the Eye Care Digitalisation Programme.