This Privacy Notice explains how Sight Care Optical Limited, trading as Darlington Opticians, collects, uses, stores and protects personal data when you use our optical services, contact us, visit our practices or use our website.

How We Use Your Information

Who We Are

Sight Care Optical Limited, trading as Darlington Opticians, provides optical services from the following locations: 66 High Street, Merthyr Tydfil, CF47 8AE; and 37 Commercial Street, Tredegar, NP22 3DJ.

We are the Data Controller for the personal information we collect and use.

How to Contact Us

If you have any questions about this Privacy Notice or how we use your personal data, please contact our Information Governance / Data Protection Officer: paul@darlingtonopticians.co.uk or 01685 723785.

The Information We Collect

We collect information so we can provide safe, effective eye care. This may include:

• Name, address, date of birth, contact details

• NHS number

• Health and clinical information

• Appointment details

• Referral information

• CCTV images

• Staff employment and training information

• Communications (emails, letters, calls)

How We Collect Information

We collect information:

• Directly from you

• From healthcare professionals involved in your care

• From NHS Wales systems

• From referral organisations

• From CCTV for safety and security

• From staff as part of employment

Why We Use Your Information

We use personal data to:

• Provide eye examinations, clinical care, and treatment

• Manage appointments

• Make referrals to hospitals, GPs, and specialist services

• Improve our services

• Handle complaints and incidents

• Meet legal and regulatory requirements

• Ensure safety through CCTV

• Manage staff employment and training

Our Legal Basis

Under UK GDPR:

Article 6

• Public task

• Legal obligation

• Consent (only when required)

Article 9 (Special Category Data)

• Health or social care

• Substantial public interest

• Explicit consent (rare)

Who We Share Information With

We only share the minimum necessary information with:

• NHS Wales organisations

• GP practices and hospitals

• Laboratories and diagnostic services

• Digital Health and Care Wales (DHCW)

• Local authorities

• IT system providers

• Regulators (ICO, HIW)

• Police or courts when legally required

Website, Cookies and Wix

Our website is hosted on Wix. When you visit or interact with our website, Wix and any connected website tools may process personal data on our behalf. This may include technical information such as your IP address, device information, browser type, pages visited, form submissions, booking requests, contact details and cookie preferences.

We use cookies and similar technologies to keep the website working, support security, remember your preferences, understand how visitors use the website and, where enabled, support marketing or communication features. Cookies that are not strictly necessary should only be used where you have given consent through the website cookie banner. You can change your cookie choices using the cookie settings available on the website.

Before publishing this notice on Wix, ensure your website cookie banner reflects the cookies and tracking tools actually used on the site, including any analytics, booking, contact form, marketing or social media tools.

International Transfers

We do not routinely transfer data outside the UK. If a system provider stores data internationally, we ensure safeguards such as:

• UK International Data Transfer Agreement (IDTA)

• Adequacy decisions

How Long We Keep Information

We follow the NHS Wales Records Management Code of Practice, including:

• Adult health records: 8 years

• Children’s health records: until age 25

• HR records: 6 years after employment ends

• CCTV: 30–60 days

A full retention schedule is available on request.

Your Rights

You have the right to:

• Access your information

• Request corrections

• Request deletion (in limited circumstances)

• Restrict or object to processing

• Data portability

• Challenge automated decision‑making

To exercise your rights, contact our DPO.

Consent

Where we rely on consent (e.g., marketing):

• You can withdraw consent at any time

• Withdrawal does not affect previous lawful use

Children’s Information

We use clear, age‑appropriate language and involve parents/guardians where appropriate.

How We Protect Your Information

We use:

• Access controls

• Encryption

• Secure NHS Wales systems

• Staff training

• Policies and procedures

• Audit and monitoring

Concerns or Complaints

If you are unhappy with how your data is used, you can contact:

Information Commissioner’s Office (ICO) www.ico.org.uk 0303 123 1113

Updates to This Notice

We review this notice regularly. The latest version will always be available on our website.

Last updated: September 2026