Privacy Policy

Last Updated: This policy was last updated on 1 January 2025.

1. Who We Are

CR Eye Clinic is a private ophthalmic clinic based in Birmingham, UK. We are committed to protecting your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. For data protection enquiries, contact us at contact@creyeclinic.co.uk.

2. Information We Collect

We may collect: your name, email address, phone number, and postal address; date of birth and NHS number (where relevant); medical and ophthalmic history; consultation notes and treatment records; payment and insurance details; information you provide via our website forms.

3. How We Use Your Information

We use your data to: provide ophthalmic consultations and treatments; manage appointments and follow-up care; process payments and insurance claims; communicate with you about your care; respond to enquiries submitted through our website; improve our services and patient experience.

4. Legal Basis for Processing

We process your personal data under: Consent (for marketing communications); Contract (to provide requested services); Legal Obligation (medical record-keeping requirements); Legitimate Interest (improving services and patient safety). Medical data is processed under the additional condition of healthcare provision.

5. Data Sharing

We may share your data with: your GP or referring practitioner (with your consent); NHS services where clinically necessary; insurance providers for claims processing; regulatory bodies such as the CQC; IT service providers who support our systems (under strict data processing agreements). We never sell your personal data to third parties.

6. Data Retention

Medical records are retained for a minimum of 10 years (or 25 years for children) in line with NHS guidelines. Non-medical data is retained for as long as necessary for the purpose it was collected, then securely deleted.

7. Your Rights

Under UK GDPR, you have the right to: access your personal data; correct inaccurate data; request deletion of your data; restrict or object to processing; data portability; withdraw consent at any time. To exercise these rights, contact us at contact@creyeclinic.co.uk.

8. Cookies

Our website uses essential cookies to ensure functionality. We do not use tracking or advertising cookies. For details, see your browser settings.

9. Security

We implement appropriate technical and organisational measures to protect your data, including encrypted data storage, access controls, and staff training.

10. Changes to This Policy

We may update this policy from time to time. Any changes will be posted on this page with an updated revision date.

11. Contact

If you have questions about this policy or wish to make a complaint, contact us at contact@creyeclinic.co.uk or write to: CR Eye Clinic, Corporation St, Birmingham B2 4LP, UK. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.