Privacy Policy
Last updated: October 2026
This policy explains how I collect, use, share and protect your personal information when you contact me, attend a consultation, have treatment, or visit this website. I am committed to keeping your information confidential and secure, in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and my professional duty of confidentiality as a doctor.
1. Who I am
Miss Gemma Manasseh, Consultant Ophthalmologist and Oculoplastic Surgeon, is the data controller for the personal information described in this policy. This means I am responsible for deciding how your information is used and for keeping it safe.
- ICO registration number: ZB787055
- GMC registration number: 7411434
- Contact: office@theeyeunit.co.uk, 0117 369 1179
I see patients at Nuffield Health Bristol Hospital. The hospital is a separate data controller for the records they keep about you, such as hospital admission, nursing and billing records, and has its own privacy notice.
2. What information I collect
Personal details
- Name, date of birth, gender and title
- Address, telephone number and email address
- GP details, and next of kin or emergency contact where relevant
- Insurance details (insurer, policy and authorisation numbers) or payment information for self-funding patients
Health information
As a doctor, I collect health information, which is a "special category" of personal data under data protection law. This includes:
- Your symptoms, medical history, medications and allergies
- Examination findings, test results and scans (for example vision, eye pressure, OCT scans and visual field tests)
- Clinical photographs, taken only with your consent, to document your condition and the results of treatment
- Correspondence about your care, including clinic letters, referral letters and operation notes
3. How I collect your information
- Directly from you, when you book an appointment, complete forms, attend a consultation or contact my secretary
- From the professionals who refer you, such as your GP, optometrist or another specialist
- From the hospitals where I practise, and from other clinicians involved in your care
- From your insurer, when they authorise your treatment
- From booking platforms such as Doctify, if you book an appointment through them
4. How I use your information and the legal basis for doing so
| Purpose | Legal basis |
|---|---|
| Assessing, diagnosing and treating you, and keeping accurate medical records | Article 6(1)(b): to provide the service you have requested. Article 9(2)(h): for the provision of health care. |
| Communicating with your GP and other clinicians involved in your care | Article 6(1)(b) and Article 9(2)(h) |
| Arranging appointments and theatre bookings, and contacting you about your care | Article 6(1)(b) |
| Invoicing you or your insurer, and managing payments | Article 6(1)(b) and 6(1)(c): legal obligation (tax and accounting) |
| Clinical audit, to monitor and improve the quality of care | Article 6(1)(f): legitimate interests. Article 9(2)(h) |
| Responding to complaints, legal claims and regulatory requests | Article 6(1)(c) and 6(1)(f). Article 9(2)(f): legal claims. |
| Contributing to national audits and registries, such as the Private Healthcare Information Network (PHIN) | Article 6(1)(c): legal obligation. Article 9(2)(i): public health. |
| Using clinical photographs or anonymised information for teaching, research or publication, including before and after photographs on this website | Your explicit consent, Article 9(2)(a), unless the information is fully anonymised |
I will never sell your information. Clinical photographs are only shown on this website with your separate, explicit written consent. You can withdraw this consent at any time, and the photographs will be removed from the website.
5. Who I share your information with
I only share your information when it is necessary for your care or required by law, and only share what is needed. This may include:
- Your GP, and the optometrist or clinician who referred you
- Other healthcare professionals involved in your care, such as anaesthetists, NHS teams or specialists I refer you to
- The hospitals where you are seen or treated
- Your private medical insurer, to obtain authorisation and payment
- My medical secretary and practice administration services
- Trusted service providers who support my practice, such as secure IT, email, practice management software and accountants. They act on my instructions and are bound by confidentiality and data protection agreements.
- Regulators, courts, my professional indemnity provider or law enforcement, where required by law
If you would prefer that I do not write to your GP, please let me know. I will respect your wishes wherever it is safe to do so, and will discuss with you any situation where sharing is important for your safety.
6. International transfers
Your information is stored and processed within the UK wherever possible. If a service provider stores data outside the UK, I make sure appropriate safeguards are in place, such as a UK adequacy decision or approved contractual clauses.
7. How long I keep your information
I keep medical records in line with the NHS Records Management Code of Practice, which is the recognised standard for private practice:
- Adults: 8 years after the conclusion of treatment
- Children: until their 25th birthday, or 26th if they were 17 at the end of treatment, or 8 years after the conclusion of treatment, whichever is longer
- Financial records: 6 years, as required by HMRC
Records may be kept for longer where there is a legal or clinical reason to do so. They are then securely destroyed.
8. How I keep your information secure
Your records are stored securely, with access restricted to those who need it to provide your care. Electronic records are kept on encrypted, password-protected systems, and paper records are kept securely. Everyone who works with me is bound by confidentiality.
9. Your rights
Under data protection law, you have the right to:
- Access your information and receive a copy of your medical records, usually free of charge
- Correct information that is inaccurate or incomplete
- Ask for your information to be deleted, although medical records usually need to be kept for the periods above
- Restrict or object to certain uses of your information
- Data portability, to receive information you provided in a commonly used format
- Withdraw your consent at any time, where I rely on consent, such as for clinical photographs used in teaching
To make a request, please contact me using the details below. I will respond within one month.
10. This website
This website does not use cookies, analytics or tracking. It loads fonts from Google Fonts, which means your browser sends your IP address to Google to download them. See Google's privacy policy for details. Links to external sites, such as Doctify, are covered by those sites' own privacy policies.
11. Contact and complaints
If you have any questions about this policy or how your information is used, please contact:
Leighana, Medical Secretary to Miss Gemma Manasseh
Telephone: 0117 369 1179
Email: office@theeyeunit.co.uk
If you are unhappy with how your information has been handled, you have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, telephone 0303 123 1113. I would be grateful for the chance to address your concerns first.
12. Changes to this policy
I may update this policy from time to time. The latest version will always be available on this page.