Page content

This privacy notice is applicable to the following areas:

  • Faculty of Life and Health Sciences
  • School of Biomedical Science
  • Eye Clinic

This Privacy Notice explains how Ulster University (University) collects, uses and processes participants’ personal data as a data controller and explains individuals’ rights in relation to the personal data that the University processes during attendance at the eye/ optometry clinic.

The University actively seeks to preserve the privacy rights of those individuals that share information with the University.  The personal data which you provide to the University will be processed in accordance with UK data protection legislation, specifically UK GDPR and the Data Protection Act 2018.

What is the purpose and legal basis of the processing?

The Eye Clinic at Ulster University is an outfacing clinic dedicated to providing excellence in patient eye care, as well as being leaders in clinical education and research. The eye clinic is located in the Department of Optometry and Vision Science on Coleraine campus.

The eye clinic is a student lead clinic overseen by academic colleagues and external clinical supervisors; supporting students, staff and local populations.

Processing of data is required to ensure that any patients attending the eye clinic for treatment can be assessed and treated appropriately.  We collect and process patients' personal data for the purposes of healthcare and marketing.

We may use your personal data, such as your contact information, to send you marketing communications about our product offers, services, and events.  You can opt-out of receiving marketing communications from us at any time by contacting optometry@ulster.ac.uk to unsubscribe.

The following lawful basis that applies to this processing is:

UK GDPR Article 6.1(a) – the data subject has given consent to the processing of their personal data for specific purposes.

UK GDPR Article 6.1(e) – processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

For processing special category data, our legal basis for processing is:

UK GDPR Article 9(h) – Health or social care (with a basis in law).

Data Protection Act 2018, Schedule 1, Part 1, Paragraph 2 – Health or social care purposes

How the University collects your personal data

The University shall collect the personal data from you directly via telephone or email at the time of booking or in-person when attending the clinic.  Further information will be requested and confirmed during your attendance at the clinic to ensure that you receive appropriate treatment.

Change of Purpose

The University will only use your personal data for the purposes for which it collected in, unless the University reasonable considers that it needs to use the personal data for another reason and that reason is compatible with the original purpose.  If the University needs to use your personal data for an unrelated purpose it shall notify you and explain the legal basis for which allows the University to do so.

How long does the University hold your personal data?

Personal data collected as part of booking and receiving treatment at Ulster University Eye Clinic will be retained for a period of 10 years for patients over 16 years old and 25 years if a patient is under 16 years old. [Subject to Review]

The University’s Retention and Disposal Schedule includes guidance on retention and disposal periods.

Categories of personal data processed by the University

Personal Data

The University may collect, use, store and transfer the following types of personal data as part of this processing:

  • Name
  • Address
  • Email
  • Date of Birth
  • NHS Number
  • Telephone Numbers
  • GP Details

Special Category Data

“Special Categories” or particularly sensitive personal information, such as information about your health, racial or ethnic origin, sexual orientation require higher levels of protection.  The following categories of special category data will be processed:

  • Health Data (including Medical History/ Health/ Medications/ Prescriptions)
  • Racial or ethnic origin

Who does the University share your data with

The University shares personal data with third parties where necessary for the purposes of the processing and where there is a legal basis to do so.  Where information is shared with such third parties, the University will seek to share the minimum amount necessary.

As part of this processing the University may be required to share your personal data with the following third parties:

  • The healthcare professionals working at this practice and those under their supervision
  • Healthcare professionals and those under their supervision at other optical practices, (only if patients have specifically asked us to pass your personal data (such as your prescription)
  • GP, ophthalmologists and other healthcare providers and commissioners, and suppliers of optical appliances or similar products, in connection with your healthcare treatment
  • Software providers for our patient record and invoicing systems, and financial institutions

International Transfers

The University will not transfer your personal data outside of the United Kingdom.

Your rights as a Data Subject

As a University data subject you have the right to:

  • Access and obtain a copy of your personal data on request;
  • Require the University to change incorrect or incomplete personal data;
  • Require the University to delete or remove your personal data, for example where the data is no longer necessary for the purposes of processing.  Note, however that the University may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request;
  • Object to the processing of your personal data where the University is relying on its legitimate interests as a legal ground for processing;
  • Where the University is relying upon consent to process your personal data, you may withdraw your consent at any time; and ask the University to stop processing personal data for a period if the personal data is inaccurate or there is a dispute about whether or not your interests override the University’s legitimate grounds for processing the personal data.

Further information and your right to complain

Further information in respect of the University’s practice in respect of data protection and our Data Protection Policy.

If you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal data, or request the University transfer a copy of your personal information to another party, please contact the University’s Data Protection Officer,

Eoin Coyle, Data Protection & Information Compliance Manager, c/o Ulster University, Room L143, Coleraine, BT52 1SA, 02871 675525 gdpr@ulster.ac.uk

If you are not satisfied with how the University is processing your personal data, you can make a complaint to the ICO.  Further information about your data privacy rights are available on the ICO’s website.