John F Stott Ltd, trading as STOTTS., Stotts Opticians, Brown Opticians, Sutcliffes Opticians and Mr Jinkinsons, is a registered data controller.
This privacy notice explains how we collect, use, store and share your personal data when you use our services.
This includes eye care, hearing care, contact lenses, specialist clinics, membership services, appointment booking, recalls, aftercare and relevant communications.
When you use this website
Everything above describes how we handle your information as a patient of our practices. This section covers what happens when you use stottsopticians.co.uk, which is separate processing with its own legal bases.
The controller is John F. Stott Ltd, registered in England & Wales, company number 817224, registered office 137 Chorley Road, Swinton, Manchester, M27 4AE. Our contact for data protection is Jane Laval, janelaval@stottsopticians.co.uk, 01257 262445.
What the website collects, and why
| What you do | What we collect | Why | Our legal basis |
|---|---|---|---|
| Send an enquiry through the contact form | Your name, email address, telephone number if you give one, and whatever you write in the message | To read your enquiry and reply to it | Legitimate interests — answering someone who has asked us a question |
| Register interest in membership | Your name, email address, telephone number, preferred practice and the plan you asked about | To contact you about the membership you enquired about | Steps taken at your request before entering a contract |
| Complete the Lens Profile tool | Your answers about how you use your eyes day to day, your first name and, if you ask for the summary, your email address. Some answers touch on eye comfort and symptoms, so we treat the set as health-related information | To produce your profile, email you the summary you asked for, and prepare for your appointment | Consent, which you give by choosing to send it. For the health-related parts, our Article 9 condition is your explicit consent |
| Request a callback | Your name, telephone number and the best time to call | To call you back | Consent |
| Simply read a page | Standard server log information, including IP address, browser and the page requested | To keep the site running and secure | Legitimate interests — security and reliability |
| Accept cookies | Analytics and advertising measurement data, and chat conversations if you use the chat | To understand how the site is used and whether our advertising works | Consent, which you can withdraw at any time |
You never have to give us health information to use this website. The Lens Profile tool is optional, and you can use every other part of the site without it.
Who processes website data on our behalf
We use a small number of suppliers to run the website. They act on our instructions and may not use your information for their own purposes.
| Supplier | What they do for us | Where they process it |
|---|---|---|
| Vercel Inc. | Hosts the website and runs the code behind our forms | United States, with hosting regions in the EU |
| Twilio SendGrid | Delivers the emails our forms generate, to us and to you | United States |
| Google Ireland Limited | Analytics, advertising measurement, fonts and maps | Ireland, with support access from the United States |
| GPTMate | Runs the chat assistant, and records which pages you visit and in what order — both only if you have accepted cookies | United States |
| EyeClarity | Takes online appointment bookings | United Kingdom |
| Shopify International Limited | Runs our online shop and takes payment at checkout | Ireland, with processing in Canada and the United States |
When you book online you leave our website and continue on EyeClarity's booking system. What you enter there is covered by that booking, and we receive the appointment details.
The same applies to the shop. Your bag is held by Shopify, and when you press Checkout you leave our website and pay on a page Shopify hosts. Your card details are entered there and we never see or hold them. We receive the order — what you bought, and the name, delivery address, email address and telephone number you gave Shopify — so that we can fulfil it. What you enter on Shopify's pages is also covered by Shopify's own privacy policy.
Transfers outside the UK
Some of the suppliers above are based in the United States. Where information leaves the UK we rely on the UK Addendum to the European Commission's standard contractual clauses, or on the UK extension to the EU–US Data Privacy Framework where the supplier is certified under it. You can ask us for details of the safeguards that apply.
Information stored in your browser
This website stores two things on your own device. Neither is sent anywhere automatically, and neither is used to track you.
- Your cookie choice, with the date you made it, so we do not ask on every page. Kept for six months.
- Your Lens Profile answers, including your first name and email address if you entered them, so you can leave the tool and come back to it. This is kept on your device for 30 days and then deleted automatically. You can clear it sooner with the "Start again" control in the tool. It is only sent to us if you choose to send it.
Clearing your browser's site data for stottsopticians.co.uk removes both.
How long we keep website enquiries
Enquiries that do not lead to an appointment are kept for two years, so we can pick up a conversation you started and deal with any complaint. Once you become a patient, the information joins your clinical record and the retention periods earlier in this notice apply instead. Analytics data is kept for fourteen months.
Automated decision-making
The Lens Profile tool works out a suggested starting point from your answers. It is a preparation aid, not a decision about you: nothing is ordered, priced or refused on the strength of it, and an optometrist or dispensing optician reviews it with you in person before anything happens. It is not automated decision-making with legal or similarly significant effects under Article 22.
Marketing by email
We only send marketing emails to people who have asked for them or who are existing patients receiving information about similar services. Every marketing email identifies us as the sender, gives our postal address and carries a one-click unsubscribe link. Unsubscribing takes effect immediately and never affects your care, your appointments or your recalls.
Why we collect and process your personal data
We collect and process patients' personal data so that we can provide safe, effective and appropriate healthcare services.
This may include:
- Booking and managing appointments
- Providing eye examinations and clinical care
- Providing hearing care and related services
- Supplying spectacles, contact lenses, hearing aids and related products
- Managing recalls, reminders and aftercare
- Making referrals to other healthcare providers where needed
- Maintaining accurate clinical records
- Managing payments, invoices and patient accounts
- Communicating relevant information about our services
We may also use your personal data for marketing purposes, where we have your consent or where we have a legitimate interest in doing so. This may include contacting you about eye care, hearing care, eyewear, contact lenses, membership, events, offers or services that may be relevant to you.
You can opt out of marketing communications at any time by letting us know.
Our legal bases for processing your data
Our legal bases for processing personal data for healthcare purposes, including appointment reminders and recalls, are usually:
Public task — where we provide services under an NHS contract, such as NHS General Optical Services or other NHS-funded eye care services.
Legitimate interests — where we provide private healthcare services, manage appointments, operate our practice, provide reminders, maintain records and support your ongoing care.
Contract — where processing is necessary to provide products or services you have requested or purchased from us.
Consent — where required, including certain marketing communications.
Where we process health information, this is special category data. Our condition for processing this data is usually that it is necessary for the provision of health or social care.
The data we may collect and process
The personal data we may collect and process includes:
- Your name, address, contact details and date of birth
- Personal identifiers, such as NHS number, patient number or membership details
- Appointment history and communication preferences
- General health, ocular health and hearing health history
- Family medical, ocular or hearing history where relevant
- Symptoms, concerns and lifestyle information you tell us about
- Details of medicines or treatments you use
- Clinical examination results, prescriptions and test findings
- OCT scans, retinal images, visual field results or other clinical images where taken
- Details of spectacles, lenses, contact lenses, hearing aids or other products prescribed or supplied
- Information relating to specialist clinics, referrals, treatment plans and aftercare
- Payment, invoice and account information
- Information provided by other healthcare professionals, carers or relatives where relevant to your care
- Marketing preferences and records of communications with you
We only collect information that is relevant to providing, managing or improving your care and our services.
How we hold your personal data
We process your personal data in strict confidence.
We keep your data securely in our electronic systems and, where relevant, paper records. Access is limited to authorised team members, healthcare professionals working at the practice and those acting under their supervision.
We take appropriate steps to protect your personal data from unauthorised access, loss, misuse or disclosure.
How long we keep your personal data
We will usually keep adult patient records for 10 years after our last contact with you.
If we collected your data when you were under 18, we will usually keep it until your 25th birthday, or for 10 years after your last contact with us if that is later.
These periods reflect professional guidance and NHS record-keeping requirements.
In some circumstances, we may need to keep personal data for longer, for example where required by law, professional guidance, ongoing care needs, complaints, safeguarding matters or legal claims.
Who we may share your personal data with
We will only share your personal data where it is necessary and appropriate.
This may include:
- Healthcare professionals working at our practices and those under their supervision
- Your GP, ophthalmologist, audiologist or other healthcare provider where relevant to your care
- NHS bodies, commissioners or referral services where required for NHS-funded care or referrals
- Other optical or healthcare practices, but only where you have asked us to share information with them or where it is necessary for your care
- Suppliers of spectacles, lenses, contact lenses, hearing aids or related healthcare products
- Laboratories and manufacturers involved in fulfilling your prescription or order
- Software providers for patient records, booking, recall, communication, payment and invoicing systems
- Payment providers, finance providers or financial institutions where needed to process payments
- Professional advisers, insurers or regulators where required
- Authorities or organisations where disclosure is required by law or necessary to protect you or others from serious harm
We do not sell your personal data.
Marketing communications
We may contact you about services, products, events, offers or care reminders that may be relevant to you.
This may include information about eye care, hearing care, eyewear, contact lenses, membership, specialist clinics and related services.
We will only send marketing communications where we have your consent or where we have a legitimate interest and are permitted to do so.
You can opt out of marketing at any time by contacting us or using any unsubscribe option provided.
Even if you opt out of marketing, we may still contact you about your appointments, recalls, clinical care, orders, payments or important service information.
Your rights
You have legal rights in relation to the personal data we hold about you.
These include:
The right to be informed
This privacy notice explains how we use your personal data.
The right of access
You can ask us for a copy of the personal data we hold about you.
The right to rectification
You can ask us to correct personal data that is inaccurate or incomplete.
The right to object
You can object to us processing your personal data in certain circumstances, including for marketing purposes.
The right to erasure
You can ask us to delete your personal data where there is no compelling reason for us to continue processing it. Please note that we will not usually delete healthcare records before our usual retention period where we have a professional, legal or clinical duty to keep accurate records.
The right to restrict processing
You can ask us to restrict how we use your personal data in certain circumstances.
The right to data portability
In some circumstances, you can ask for your personal data to be provided in a structured, commonly used format.
Rights relating to automated decision-making
You have rights relating to decisions made solely by automated processing, where applicable.
We will respond to rights requests within one month, unless the request is complex or we are permitted by law to extend the timescale.
Contacting us about your personal data
Please contact us first if you have any questions or concerns about how we use your personal data.
You can contact:
Jane Laval
Email: janelaval@stottsopticians.co.uk
Telephone: 01257 262445
Via our Chorley practice.
Complaints
You have the right to complain to the Information Commissioner's Office if you are unhappy with how we handle your personal data.
The ICO can be contacted via: www.ico.org.uk
However, we would always appreciate the opportunity to resolve any concern with you first.
Updates to this privacy notice
We may update this privacy notice from time to time to reflect changes in our services, legal requirements or how we process personal data.
The latest version will be available on our website and in our practices.