What we record about you as a patient, why, who we share it with, and how long we keep it.
Last updated: 12 September 2026
This notice explains what we do with the information we hold about you as a patient of Vale Eye Surgeons: what we record, why, who we share it with, and how long we keep it.
If you are just browsing our website or have sent us an enquiry but are not yet a patient, our separate website privacy policy covers that.
We have tried to keep this readable. If anything is unclear, please ask.
Vale Eye Surgeons is the trading name of Vale Eye Surgeons Limited, which is the data controller for your clinical records.
| Company number | 13891633 |
| Registered office | 7 Ash Tree Court, Woodsy Close, Pontprennau, Cardiff, CF23 8RW |
| ICO registration | ZB353792 |
| [email protected] | |
| Telephone | 07979 825075 |
| Clinics | Cowbridge and Cardiff |
We are regulated by Healthcare Inspectorate Wales.
Questions about your information, and requests to see or correct it, are handled by our practice manager. Email [email protected] and mark your message for their attention.
Your record with us may include:
Some of this is information about your health, and some of it may reveal other sensitive things about you. Data protection law calls this special category data and gives it extra protection. We treat it accordingly.
Most of it comes from you, at your appointments or on the forms you complete. We may also receive information about you from:
Our telephone and text messaging service is provided by a specialist telecoms supplier, so calls and messages between you and the practice pass through their systems. We keep a record of the fact that we spoke, and a note of anything clinically relevant, as part of your record.
We do not currently record telephone calls. If we introduce call recording in future, we will tell you at the start of the call, explain your options, and update this notice before we begin.
We use your information to provide and manage your care: to assess you, plan and carry out treatment, keep an accurate record, arrange follow-up, and communicate with you and with others involved in your care. We also use it to run the practice properly, which means billing, handling complaints, meeting our regulatory obligations, and making sure the care we provide is safe and of good quality.
Under UK data protection law we need two things to be satisfied, and here is what we rely on:
For using your personal information at all, we rely on Article 6(1)(b) of the UK GDPR, because it is necessary to perform our contract with you for your treatment, and Article 6(1)(c), where the law requires us to do something.
For using information about your health, we rely on Article 9(2)(h) of the UK GDPR, which permits processing that is necessary for the provision of health care and treatment and for the management of health care services. The associated condition in UK law is paragraph 2 of Schedule 1 to the Data Protection Act 2018.
Your information is handled by, or under the responsibility of, people who owe you a duty of confidentiality. That duty sits alongside data protection law and is not replaced by it.
We do not use your clinical information for marketing, and we do not sell it.
We share your information only where there is a proper reason to. In practice that means:
Your optometrist or optician. Where an optometrist or optician referred you to us, or continues to look after your general eye care, we write to them about the outcome of your appointment so that your care joins up properly. We will normally discuss this with you.
Your GP. We write to your GP where there is a clinical reason to do so, for example where your treatment affects your wider care or your GP needs to know about medication or follow-up. We will normally discuss this with you.
Other clinicians involved in your care. Where you need tests, imaging, anaesthetic or onward referral, we share what those clinicians need in order to treat you safely.
Your insurer. If your treatment is funded through private medical insurance, we share the information your insurer needs to authorise and settle the claim, such as your policy details, the treatment provided and the associated codes. If you are paying for yourself, no insurer receives your information.
Our IT and software suppliers. We use specialist suppliers to provide our clinical records system and our business systems. They act only on our written instructions, are bound by confidentiality and security obligations, and are not permitted to use your information for their own purposes.
Our regulators. Healthcare Inspectorate Wales may see records as part of its inspection function.
Our professional advisers and insurers, where necessary, for example if there is a claim or a legal question about your care.
Where the law requires it, for example a court order, or a legal duty to report certain matters.
We will not share your information with anyone else without your agreement, unless we are required or permitted to by law.
You can ask us for more detail about the categories of supplier we use and the contracts we have with them.
We keep clinical records in line with the Records Management Code of Practice for Health and Social Care in Wales.
In general that means:
Some categories are kept longer where the Code requires it. When a retention period ends, records are securely destroyed.
Enquiries that never became appointments are handled differently and are covered by our website privacy policy.
Your clinical record is held in a secure clinical records system provided by a specialist healthcare software supplier. Scans and images are held there too, and also remain on the diagnostic equipment used to take them, from where they are backed up to our secure cloud storage. Related information, such as appointment scheduling, correspondence and supporting documents, is held in our business systems.
Our suppliers are based in the UK and in other countries. Where your information is transferred outside the UK, we rely on the UK Government's adequacy regulations, or on the International Data Transfer Agreement or the Addendum to the EU Standard Contractual Clauses, so that it continues to receive an equivalent level of protection. You can ask us for more detail about the safeguards that apply.
Access to your record is limited to the clinicians and staff who need it for your care, controlled by individual accounts, and logged.
Information is encrypted both in transit and at rest, and correspondence containing clinical information is sent by secure means. Our systems are configured to recognised security standards and reviewed regularly.
Paper documents are stored securely at our clinics.
Everyone at the practice is bound by confidentiality obligations, both as a term of their engagement and as a professional duty.
We do not publish the detail of our security arrangements, because doing so would itself be a risk. If you have a specific concern, contact our practice manager.
You have the right to:
A note on deletion. People often ask whether they can have their medical records erased. Generally you cannot, and neither can we. We are required to keep an accurate clinical record for the retention periods above, both for your safety if you need care again and to meet our professional and legal obligations. The right to erasure does not override that.
To exercise any of these rights, email [email protected] for the attention of the practice manager. We may ask you to confirm your identity first.
If you are unhappy with how we have handled your information, please tell us first at [email protected] so we have the chance to put it right.
You can also complain to the Information Commissioner's Office, the UK's data protection regulator:
Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
ico.org.uk
Complaints about the care you received, rather than about your information, are handled under our complaints policy, and can be escalated to Healthcare Inspectorate Wales.
We review this notice regularly and will update it when our practices change. The date at the top shows when it was last revised.