Privacy Policy

Who We Are

OCL Vision Group Ltd trading as "OCL Vision" ('we' or 'us' or 'our') gather and process your personal information in accordance with this privacy notice and in compliance with UK data protection law. This notice provides you with the necessary information regarding your rights and our obligations, and explains how, why and when we process your personal data.

Our registered office is at 55 New Cavendish Street, London, W1G 9TF. We are a company registered in England and Wales under company number 11353298. We are registered with the Information Commissioner's Office (ICO) for data protection and privacy matters. Our ICO registration number is ZA473865.

We act as the data controller for the personal data described in this notice. Our Data Protection Officer / designated Appointed Person for consent and privacy related queries is Vanessa Fernandis, who can be contacted at OCL Vision, 55 New Cavendish Street, London, W1G 9TF, telephone +44 20 3369 2020, or by email at dpo@oclvision.com.

We are registered with the Care Quality Commission (CQC).

The Laws That Apply

We process your personal data in accordance with:

• the UK General Data Protection Regulation (UK GDPR)
• the Data Protection Act 2018
• the Privacy and Electronic Communications Regulations 2003 (PECR), which govern electronic marketing and cookies
• the common law duty of confidentiality, which applies to information you share with us in the course of your care
• the Health Service (Control of Patient Information) Regulations 2002, where relevant
• professional guidance issued by the General Medical Council and other regulators

We also follow the NHS Records Management Code of Practice as best practice for retention of health records, and complete the annual Data Security and Protection Toolkit assessment.

Our Commitment to Data Protection by Design and by Default

We are committed to upholding the highest standards of data protection and privacy, embedding the principles of "Data Protection by Design and by Default" into all of our operations. Before introducing any new system, technology, or process that involves personal data, we systematically identify and minimise risks. This is achieved by conducting a Data Protection Impact Assessment (DPIA) at the early stages of any new project or significant change, in accordance with guidance from the ICO.

Furthermore, we operate on the principle of data protection by default. This means we only collect, use, and share the minimum amount of personal data necessary for any given purpose. We enforce strict access controls to ensure that data is only available to authorised individuals who have a legitimate need, and we will not store your data for any longer than is required.

Information That We Collect

We process your personal information to meet our legal, statutory and contractual obligations and to provide you with our products and services. We will never collect any unnecessary personal data from you and do not process your information in any way other than as specified in this notice.

The personal data that we collect from you is:

• Contact details: including name, email, telephone number and physical address.
• Personal details: including gender and date of birth.
• NHS number: where available. We may use your NHS number to check whether you have registered a national data opt-out, and to communicate with other organisations involved in your care.
• Medical eye data: specific eye history, including prescriptions and previous eye surgery. These are collected during your appointment with our consultant, after becoming a patient of ours, to provide your treatment plan.
• Other health data: general health conditions and allergies. These are collected to provide your treatment plan.
• Payment or credit card information: this is taken when paying for your appointment or surgery. We use a secure card processing terminal and a secure online payment portal to process payments, and your card details are stored via tokenisation for future payment processing.
• Special category data: including race and ethnicity. We collect this because some eye conditions are more common in certain ethnicities, such as Keratoconus. This data is taken at the stage of an individual becoming a patient.
• Technical data: when you interact with our website or app, data is automatically collected by the technology platforms providing that experience. For example, your web browser or mobile device may share certain data with us as those devices interact with our sites. More information is set out in our Cookies Policy.

We collect information in the following ways: registration form (electronic or paper), website contact form, from your GP, optometrist or doctor by way of referral, and from notes made during your consultations, appointments and treatments. We may also collect and process telephone call recordings, call transcripts, call summaries, AI-assisted consultation notes, appointment-related communications, CRM interaction history, website form submissions and patient communication preferences.

Our Lawful Bases for Processing

We rely on the following lawful bases under the UK GDPR:

Purpose	Lawful basis (Article 6)	Additional basis for health and special category data (Article 9)
Providing your consultation, treatment and ongoing care	Contract, and legitimate interests	Article 9(2)(h), provision of health care and treatment
Clinical record keeping and clinical governance	Legal obligation, and legitimate interests	Article 9(2)(h)
Billing, accounting and tax	Legal obligation	Not applicable
Responding to complaints and claims	Legitimate interests, and legal obligation	Article 9(2)(f), legal claims
Patient safety, incident reporting and regulatory reporting	Legal obligation	Article 9(2)(h) and 9(2)(i), public health
Patient surveys and PROMs	Legitimate interests	Article 9(2)(h), management of health care services
Direct marketing by email or SMS	Consent	Not applicable. We do not use health data to target marketing without your explicit consent
Website analytics and non-essential cookies	Consent	Not applicable

Where we rely on consent, you may withdraw it at any time and we will act on that promptly. Withdrawing consent for marketing will not affect your care.

Separately from data protection law, information you give us in the course of your care is subject to the common law duty of confidentiality. We will only use or disclose confidential patient information where you have consented, where it is necessary for your direct care, where there is a legal requirement or court order, where there is an overriding public interest, or where disclosure is supported by approval under Regulation 5 of the Health Service (Control of Patient Information) Regulations 2002.

How We Use Your Personal Data

We only retain your data for as long as is necessary and for the purpose or purposes specified in this notice. The purposes and reasons for processing your personal data are:

• We collect your personal data to provide services related to your medical care (vision related) and to ensure that we provide relevant ongoing care.
• We collect and store your personal data as part of our legal and professional obligations, including to the General Medical Council, and for business accounting and tax purposes.
• We may send you marketing information about our services where you have consented to receive it. You can withdraw that consent at any time using the unsubscribe link in any marketing message, or by contacting dpo@oclvision.com.

How we communicate with you

We are likely to communicate with you by telephone, SMS, email and post. If we call a telephone number you have provided and the call directs to a voicemail or answering service, we may leave a voice message.

We may use AI-assisted telephone services to help route calls, provide appointment information, capture messages, support out-of-hours enquiries and create call summaries. Where an enquiry requires clinical judgement, it will be escalated to an appropriate member of the OCL Vision team.

In particular:

• To provide you with timely updates and reminders about your care, we may send you SMS messages or email.
• To provide you with your medical information, including test results and other clinical updates, or invoicing information, we may communicate with you by encrypted email.
• The first time we send you an important encrypted email, for example one that we are not also sending by post or which requires you to take an action, we will try to contact you separately to ensure that you are able to access it.
• If we have your mobile number or email address, we may use them to ask you to complete patient surveys.

Patient surveys, audits and service improvement

We may contact you to ask you to participate in patient surveys regarding your care, usually by email or SMS.

These surveys are not marketing. They do not try to sell you any further products or services. They are solely to get your feedback on your experience, and to improve the quality and safety of the healthcare services we offer to future patients. It is entirely up to you whether you participate, and you can unsubscribe from receiving further survey requests. You may also opt in to receive a call back to discuss your responses.

We may also invite you to participate in online surveys regarding the clinical outcomes of your care, called Patient Reported Outcome Measures (PROMs). These are also not marketing. We may send you an initial invitation before you receive your care, by post, SMS, email or in person. If you choose to complete a PROMs survey you will also receive subsequent surveys after your care to help establish the benefit you have gained from treatment.

Survey and PROMs responses are used to review and improve our services. Where we share this information outside OCL Vision, we do so in anonymised form.

We do not use your survey responses or health data for marketing purposes.

National Data Opt-Out

The national data opt-out gives you the ability to stop health and adult social care organisations in England from sharing your confidential patient information for purposes beyond your individual care and treatment, such as research and planning.

It does not affect information used to provide your own care. Your records will always be available to the clinicians and staff involved in treating you.

How to set or change your choice

You can set, change or check your national data opt-out choice at any time:

• online at nhs.uk/your-nhs-data-matters
• through the NHS App
• by calling 0300 303 5678
• by requesting a paper form by phone or online

Your choice is recorded against your NHS number on the national NHS record and applies to all health and adult social care organisations in England, not just OCL Vision. You can change your mind as often as you like, and doing so will not affect the care you receive from us.

If you would like help understanding the opt-out or how it differs from other choices, such as a type 1 opt-out held by your GP practice, please speak to a member of our team or contact dpo@oclvision.com.

How we apply the national data opt-out

OCL Vision reviews all of its data processing at least annually to assess whether the national data opt-out applies to any of our uses or disclosures of confidential patient information. This assessment is documented and overseen by our Caldicott Guardian and Data Protection Officer.

Where we disclose confidential patient information for a purpose beyond individual care and the national data opt-out applies, we check for registered opt-outs and remove the records of anyone who has an opt-out registered before the information is used or disclosed.

The national data opt-out does not apply in all circumstances. It does not apply where:

• the information is used or shared to provide your individual care and treatment
• the information has been effectively anonymised so that you can no longer be identified from it
• there is a separate legal mandate or direction requiring the disclosure, such as a statutory notice or court order
• there is an overriding public interest in the disclosure, for example to respond to a serious public health threat
• you have given your explicit consent to the specific use of your information, for example when you agree to take part in a particular research study

Where we conclude that the opt-out does not apply to a particular disclosure, we record the reason and will explain it to you on request.

Our current position

Having completed this assessment, OCL Vision does not currently disclose confidential patient information for research or planning purposes in a way that engages the national data opt-out. Should this change, we will apply registered opt-outs and update this notice.

National clinical audit and mandatory reporting

Where a national clinical audit relies on approval from the Confidentiality Advisory Group under Regulation 5 of the Health Service (Control of Patient Information) Regulations 2002, the national data opt-out applies and we check for registered opt-outs before submitting your data.

We are also required by an Order of the Competition and Markets Authority to submit information about privately funded care to the Private Healthcare Information Network (PHIN), which publishes performance and fee information to help patients make informed choices. Because this is a legal mandate, the national data opt-out does not apply to these submissions. Further information is available at phin.org.uk.

Use of Artificial Intelligence

OCL Vision uses approved Artificial Intelligence (AI) technologies to support administrative, operational, telephony, customer relationship management and clinical documentation processes.

AI may be used within approved systems including Claude, Microsoft Copilot, HubSpot AI, Tandem Health and NoraVoice.

AI is used to assist with activities such as document preparation, meeting summaries, patient communications, customer relationship management, consultation transcription, draft clinical documentation, call routing, call summaries and out-of-hours telephone support.

AI does not make clinical decisions, diagnose patients, determine treatment plans or replace professional judgement. All significant AI-generated outputs are reviewed by an appropriately trained member of staff before being relied upon.

Where AI processes personal information, OCL Vision ensures that appropriate contractual, technical and organisational safeguards are in place in accordance with UK data protection legislation. In particular, our agreements with AI providers prohibit the use of your personal data to train their models.

Where consultation transcription is used during your appointment, we will tell you and you may ask us not to use it. Declining will not affect your care.

AI Governance

Before introducing AI-enabled systems, OCL Vision assesses data protection, information security, supplier risk, clinical safety and operational impact. Where appropriate, a Data Protection Impact Assessment is completed.

AI systems are reviewed periodically to ensure they remain appropriate, secure and compliant with applicable legal and regulatory requirements.

Automated Decision Making

OCL Vision does not use AI or automated processing to make decisions that produce legal or similarly significant effects on patients or prospective patients.

AI technologies may assist our staff with administrative tasks, communication, documentation and workflow support, but significant decisions remain subject to human review and professional judgement.

Sharing and Disclosing Your Personal Information

We do not share or disclose your personal information except for the purposes specified in this notice, where there is a legal requirement, or where you have consented. All processors acting on our behalf process your data only in accordance with our instructions and under a written contract requiring compliance with UK data protection law and appropriate confidentiality and security measures.

Hospitals and medical centres

We use external hospitals and medical centres to perform your surgeries or treatments, for example HCA The Clementine Churchill Hospital, Spire Harpenden Hospital, King Edward VII's Hospital and Spire London East. We share your information with them if you are booked in for treatment. They are required to record your personal and health data on their own systems in order for us to provide you with treatment and care at their facilities, and they act as separate data controllers for the records they hold.

Schwind

Schwind supply our diagnostic and laser equipment. Where necessary for your individual treatment, we may share your scan data with them for evaluation or to produce a specific treatment plan. This is part of providing your care.

We do not share your identifiable data with Schwind for product development, research or the training of algorithms.

Trustpilot, Doctify, Bing and Google

We use Trustpilot, Doctify, Bing and Google to gather independent feedback about our services and your experience with us. These providers may process personal data such as your name and email address in order to obtain your review. We do not share your medical data with them.

For more information, see the Trustpilot privacy notice, the Google privacy policy and the Doctify privacy notice.

Telephone and AI-assisted call handling services

We use approved telephone and AI-assisted call handling services to answer calls, route enquiries, capture messages, support out-of-hours services and assist with administrative workflows. These services may process your name, contact details, appointment information, call recordings, transcripts and call summaries where necessary to manage your enquiry.

AI-assisted telephone services do not provide clinical advice or make clinical decisions. Where clinical input is required, the enquiry will be escalated to an appropriate member of OCL Vision staff.

Other third-party service providers

We use third-party organisations who provide support that enables our organisation to operate effectively and safely. These include:

• AI and productivity providers, including Anthropic (Claude) and Microsoft (Copilot)
• CRM and marketing automation providers, including HubSpot
• Clinical documentation providers, including Tandem Health
• AI telephony providers, including NoraVoice
• IT, hosting, security, payment processing, analytics and communications providers
• Providers who collect patient experience and outcome data on our behalf
• Auditors and professional advisers

Insurers and other funders

Where your care is funded by a private medical insurer or another third party, we will share the information necessary to arrange authorisation and payment for your treatment. This is done with your authority as part of your claim.

International transfers

Some of our providers process data outside the UK, including in the United States and the European Economic Area. Where personal data is transferred outside the UK, we ensure an appropriate safeguard is in place, such as UK adequacy regulations, the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU-US Data Privacy Framework. We complete a transfer risk assessment where required.

You can request further information about the safeguards applying to a specific provider by emailing dpo@oclvision.com.

Safeguarding Measures

OCL Vision takes your privacy seriously and takes every reasonable measure and precaution to protect and secure your personal data. We comply with UK data protection law and all applicable medical confidentiality guidelines issued by professional bodies such as the General Medical Council. Your confidential medical information will only be disclosed to those involved with your treatment or care, or in accordance with UK law and guidelines from professional bodies.

Our safeguards include:

• SSL and TLS encryption for data in transit, and encryption of data at rest
• email encryption for clinical and financial correspondence
• pseudonymisation where practicable
• role-based access controls and restricted access on a need-to-know basis
• multi-factor authentication
• audit logging and monitoring
• firewalls, anti-virus and anti-malware protection
• approved business accounts and supplier due diligence
• mandatory staff information governance training
• data protection impact assessments
• contractual controls with third-party processors

Consequences of Not Providing Your Data

You are not obliged to provide your personal information to OCL Vision. However, this information is required for us to provide you with our services, and we will not be able to offer all of our services without it. We will tell you if a particular piece of information is optional.

Data Minimisation and Data Retention

We aim never to collect or store any information that is not required for the delivery of our services. Any information that we do collect is and will always be accounted for in this privacy notice. We will take reasonable steps to securely destroy or de-identify personal information we hold once it is no longer needed for the purposes set out above, in accordance with the UK GDPR and the Data Protection Act 2018.

Where you have consented to us using your details for direct marketing, we will keep such data until you notify us otherwise or withdraw your consent.

Below is a guide to how long we retain records:

Record type	Retention period	Justification
Adult ophthalmic medical records	8 years after the conclusion of treatment or last contact	NHS Records Management Code of Practice for adult health records
Medical records of deceased patients	8 years after the date of death	Aligns with the limitation period for potential legal claims
Patient complaints and claims	10 years after the complaint or claim is fully resolved	To ensure a full record is available in case of further action or query
Enquiries from non-patients	2 years after the last communication	Data minimisation. Data kept only while there is a realistic prospect of providing a service
Financial records, for example invoices	6 years plus the current financial year	UK statutory requirement for financial and tax records (HMRC)
Staff records	6 years after employment ends	Limitation periods for employment claims
Telephone recordings, call transcripts and AI-generated call summaries	Up to 1 year	Data minimisation. Data kept only while there is a realistic prospect of providing a service

We may retain records for longer where required by law, where they are relevant to an ongoing complaint, claim, investigation or inquiry, or where a public inquiry or litigation hold applies.

Special Category Data

We process special category data, including health data and information about your race and ethnicity, in order to provide episodes of treatment and ongoing medical care. Where we collect such information, we will only request and process the minimum necessary for the specified purpose.

We usually rely on Article 9(2)(h) of the UK GDPR, the provision of health care and treatment, together with Schedule 1 of the Data Protection Act 2018, rather than on your consent. This means your rights are protected by professional confidentiality obligations rather than depending on a consent you might later withdraw.

Where we do rely on your consent for a specific use of special category data, we will obtain your explicit consent and make clear what it covers. You can modify or withdraw that consent at any time and we will act on it promptly, unless there is a legal or other legitimate reason for not doing so, in which case we will explain that reason to you.

Your Rights

You have the right to access any personal information that we process about you, and to be told:

• what personal data we hold about you
• the purposes of the processing
• the categories of personal data concerned
• the recipients to whom the personal data has been or will be disclosed
• how long we intend to store your personal data
• if we did not collect the data directly from you, information about the source

You also have the right to:

• have inaccurate or incomplete data corrected or completed
• request erasure of your personal data, where applicable
• restrict our processing of your data, where applicable
• object to processing based on legitimate interests
• object to direct marketing at any time, which is an absolute right
• data portability, where applicable
• withdraw consent where we rely on it
• be informed about any automated decision-making, and not to be subject to solely automated decisions with legal or similarly significant effects

Some of these rights are qualified. For example, we cannot usually delete your clinical records while we are required to retain them for patient safety and legal reasons. Where we cannot comply with a request, we will explain why.

To exercise any of these rights, contact dpo@oclvision.com. We may ask you to verify your identity before acting on the request, to ensure that your data is protected. We will respond within one month, and will tell you if we need to extend that period, which we may do by up to two further months for complex requests.

Making a request is free of charge.

Lodging a Complaint

We only process your personal information in compliance with this privacy notice and in accordance with the relevant data protection laws. If you wish to raise a complaint regarding the processing of your personal data, or you are unsatisfied with how we have handled your information, please email dpo@oclvision.com.

You also have the right to lodge a complaint with the ICO, although we would ask you to contact us first so we have the opportunity to put things right.

Our Supervisory Authority

Information Commissioner's Office Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF Telephone: 0303 123 1113 ico.org.uk

Changes to This Notice

We review this privacy notice at least annually and whenever we introduce a significant new use of personal data. Where changes are material, we will take reasonable steps to bring them to your attention. The date at the top of this notice shows when it was last updated.