Privacy Policy

Eyespot Optometrist ("we", "us", "our") is a professional optometry practice operating multiple branches across South Africa. We are registered with the Health Professions Council of South Africa (HPCSA) and are the Responsible Party in terms of POPIA for the personal information we process.

Our website is located at eyespotoptometrist.co.za and our online booking system is available at that same domain.

We collect personal information in the following ways:

When you make a booking:

• First and last name
• Date of birth and gender
• Email address and phone number(s)
• Next of kin name and contact number
• Any special requirements you voluntarily provide

When you contact us:

• Name, email address and phone number
• The content of your message
• IP address (collected automatically when you submit the contact form)

When you subscribe to our newsletter:

• Email address only

Automatically when you visit our website:

• Browser type, device type and operating system
• Pages visited and time spent on each page
• Referring website (how you found us)
• Approximate geographic location (country/city level only)

Automatic data is only collected via Google Analytics if you have given your consent through our cookie banner. See Section 6 for more detail.

We use the personal information we collect for the following purposes:

• Appointment management — to schedule, confirm, reschedule or cancel bookings and to prepare for your visit
• Patient care — to provide appropriate optometric services and maintain continuity of care
• Communication — to send booking confirmations, reminders, and respond to enquiries
• Newsletter — to send eye care tips, promotions and practice updates to subscribers who have opted in
• Website improvement — to understand how visitors use our site and improve the experience (analytics, with consent only)
• Fraud prevention and abuse detection — IP addresses from contact form submissions help to identify and block malicious or spam submissions
• Legal compliance — to meet our obligations under the Health Professions Act, POPIA and other applicable legislation

We do not use your information for automated decision-making or profiling.

Under POPIA, we are required to have a lawful basis for processing personal information. The grounds we rely on are:

• Performance of a contract — processing necessary to provide the appointment or service you have requested
• Consent — for newsletter subscriptions and non-essential cookies (Google Analytics)
• Legitimate interest — for contact form enquiries and general website security
• Legal obligation — where we are required to retain health-related records under applicable law

Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before the withdrawal.

We do not sell, rent or trade your personal information. We may share it only in the following limited circumstances:

• Service providers — third parties who assist us in operating our website and systems (e.g. web hosting, email delivery). These parties are contractually bound to handle your data securely and only for the purposes we specify.
• Google Analytics — aggregated, anonymised website usage data shared with Google, only with your consent. See Section 6.
• Legal requirements — if we are required to disclose information by law, court order or to protect the rights and safety of our patients and staff.
• Healthcare referrals — with your knowledge and consent, where a referral to another healthcare provider is clinically appropriate.

All third parties we work with are required to comply with POPIA.

We use two categories of cookies:

Essential cookies — required for the website to function (e.g. session management for the booking form). These cannot be disabled.

Analytics cookies (Google Analytics) — used to understand how visitors interact with our site. These are only loaded after you give explicit consent via our cookie banner.

Google Analytics data is processed by Google LLC and may be stored on servers outside South Africa. Google's privacy policy is available at policies.google.com/privacy.

We retain personal information for as long as is necessary for the purpose it was collected:

• Booking and patient records — retained for a minimum of 5 years after your last appointment, as required by HPCSA guidelines for clinical records
• Contact form messages and IP addresses — retained for 12 months and then deleted
• Newsletter subscriptions — retained until you unsubscribe or request deletion
• Analytics data — retained by Google Analytics for 14 months (our configured retention period)

When data is no longer needed, we securely delete or anonymise it.

Under POPIA, you have the following rights regarding your personal information:

• Right to access — you may request a copy of the personal information we hold about you
• Right to correction — you may request that inaccurate or incomplete information be corrected
• Right to deletion — you may request deletion of your information, subject to our legal retention obligations
• Right to object — you may object to processing based on legitimate interest
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time (e.g. newsletter unsubscribe, cookie settings)
• Right to lodge a complaint — you have the right to lodge a complaint with the Information Regulator of South Africa

To exercise any of these rights, contact us using the details in Section 12.

We take reasonable technical and organisational measures to protect your personal information against unauthorised access, loss, destruction or alteration.

Our online booking system may be used to book appointments for children. Where a patient is a minor (under 18), we require the booking to be made by a parent or legal guardian, whose contact details are collected. We do not knowingly collect personal information directly from children.

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we make material changes, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically.

Continued use of our website or services after a policy update constitutes your acknowledgement of the revised policy.

If you have any questions about this Privacy Policy, wish to exercise your rights, or have a concern about how we handle your data, please contact us: