GDPR Data processing modelComputer processing for managing the professional activity of opticians
Purposes (7)
A purpose is the objective pursued by the setting up of your file. It indicates what the processing of personal data will be used for, its purpose. This purpose must be clear and understandable
Data categories (6)
Personal data is any information relating to an identified or identifiable natural person. A natural person can be identified either directly (eg surname and first name) or indirectly (eg phone number, social security number, email or postal address, but also voice or image)
customer relationship
Data details
Data conservation rules
Active base:
For the duration of the customer relationship (prospects: no statutory period; the controller should set a short period after the last contact, e.g. 2 to 3 years, and document it).
Limitation Act 1980, s.5
Intermediate archiving:
Non-clinical customer data: up to 6 years after the last purchase, to deal with contractual claims (Limitation Act 1980, s.5). Clinical data follows the 'health data' rule.
Destruction
Completion of NHS GOS forms and submission of claims
Data details
Data conservation rules
Active base:
Until the GOS claim has been paid and any query from the NHS payment service has been closed.
General Ophthalmic Services Contracts Regulations 2008, Schedule 1, paragraph 11
Intermediate archiving:
At least 7 years (General Ophthalmic Services Contracts Regulations 2008, Schedule 1, paragraph 11, England); devolved nations apply their own GOS rules.
Destruction
Prescribers
Data details
Definition
medical specialty
Data conservation rules
Active base:
For the duration of the professional relationship with the prescriber.
Limitation Act 1980, s.5
Intermediate archiving:
Prescriber details recorded in a patient record are kept for as long as that record (see 'health data' rule). Other prescriber data: no statutory period; up to 6 years after the end of the relationship (Limitation Act 1980, s.5).
Destruction
billing
Data required for invoicing in the context of optician activity
Data details
Data conservation rules
Active base:
Until payment and closure of the financial year.
Intermediate archiving:
6 years from the end of the financial year.
Accounting records: Companies Act 2006, s.388 (3 years for a private company, 6 years for a public company); 6 years to cover contractual claims (Limitation Act 1980, s.5) and HMRC enquiries.
Destruction
customer identity
Data details
Definition
person's date of birth
Data conservation rules
Active base:
For the duration of the customer relationship.
Limitation Act 1980, s.5
Intermediate archiving:
Identity data linked to a clinical record: kept as long as that record (see 'health data' rule). Other customer identity data: up to 6 years after the last purchase (Limitation Act 1980, s.5).
Destruction
health data
Data details
Definition
Products issued by the optician
Data conservation rules
Active base:
For the duration of care (until the patient is last seen).
College of Optometrists guidance on patient records; General Ophthalmic Services Contracts Regulations 2008, Schedule 1, paragraph 11
Intermediate archiving:
10 years after the patient was last seen, even if the patient has since died; for children, 10 years after they were last seen or until their 25th birthday, whichever is later (College of Optometrists guidance on patient records). For NHS sight tests under a General Ophthalmic Services contract in England, records must be kept for at least 7 years (General Ophthalmic Services Contracts Regulations 2008, Schedule 1, paragraph 11). Then secure destruction.
Destruction
Data subject (1)
A data subject is any person whose data is collected, retained or processed by the data processing. e.g. In a recruitement process, any candidate for a position proposed in recruitement management process
- Customers
Attribution / Pas d'utilisation commerciale
CC-BY-NC
