Aspheric Limited privacy notice

Contact details

Company

Aspheric Limited, a company registered in England and Wales (company number 17269054).

Registered office

7 Vicar Street, Wymondham, NR18 0PL, United Kingdom

Email

tim@aspheric.co.uk

Phone

07838 222930

ICO registration

ZC205085 — view our entry on the ICO register

We are the data controller for the information described in this notice. We have not appointed a Data Protection Officer; data protection questions are handled by the company directors at the address above.

What information we collect, use, and why

People who visit this website

We collect or use the following information to run and secure aspheric.co.uk:

• IP address, and the date, time and page requested
• Browser type and version, and the page that referred you (if any)

This website is a set of static pages. It runs no analytics, no advertising, no tracking pixels and no third-party scripts, and it sets no cookies. The information above is recorded automatically in the standard server logs kept by our hosting provider, and we use it only to keep the site available and to investigate faults or abuse. We do not use it to identify individual visitors, and we do not combine it with anything else.

People who contact us for a demo, a quote or an answer

We collect or use the following information to respond to enquiries and to arrange and carry out demonstrations of Cyclos:

• Names and job roles
• Contact details, including email addresses and phone numbers
• The name and address of the practice or business you work for
• The content of your enquiry and our correspondence with you about it, including notes of calls and meetings

There is no form on this website. You reach us by emailing or phoning us directly, so the only information we hold about an enquiry is what you choose to send us.

Customers and suppliers

We collect or use the following information to supply, install and support Cyclos, and to buy in goods and services we need:

• Names, job roles and contact details of the people we deal with at a practice or supplier
• Business addresses and billing addresses
• Payment and bank details, and records of payments made and received
• Records of the contract, including quotes, orders, invoices and licence terms
• Records of meetings, decisions, support requests and the work we did in response
• Technical information needed to install, update and support the software on a practice’s own hardware, such as the usernames of the staff accounts we set up, and diagnostic logs

Where we take a diagnostic log or a copy of a database to investigate a support problem, we ask the practice to remove or mask patient information first wherever the fault can be reproduced without it. Where it cannot, we handle that information strictly as the practice’s processor (see Patient information held in Cyclos), and we delete it as soon as the problem is resolved.

Marketing

We collect or use the following information for marketing purposes:

• Names and business contact details
• Records of what we have sent you and whether you asked us to stop

We only send marketing to businesses and to people who have asked us about Cyclos, and every message tells you how to stop receiving them. You can ask us to stop at any time by replying to any message or emailing tim@aspheric.co.uk, and we will act on that straight away.

Patient information held in Cyclos

Cyclos is installed on a machine inside the practice, with the practice’s database beside it. Aspheric Limited does not host, mirror or hold a copy of patient records. Where a practice uses Cyclos to care for its patients, the practice is the data controller for those records and decides what happens to them. Aspheric acts only as a processor, on the practice’s written instructions, under a written contract that meets Article 28 of the UK GDPR.

In practice that means we only see patient information when a practice asks us to help with a specific problem and gives us access to do so. Patients who want to exercise their data protection rights over their clinical record should contact their optician, not us — the practice holds the record and is the right organisation to answer. If a patient contacts us instead, we will pass the request on to the practice and tell the patient we have done so.

This section describes the position generally. The specific terms for any one practice are set out in the contract between that practice and Aspheric Limited.

Lawful bases and data protection rights

Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO’s website.

Which lawful basis we rely on may affect your data protection rights, which are set out in brief below. You can find out more about your data protection rights and the exemptions which may apply on the ICO’s website:

• Your right of access — You have the right to ask us for copies of your personal information. You can request other information such as details about where we get personal information from and who we share personal information with. There are some exemptions which mean you may not receive all the information you ask for.
• Your right to rectification — You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete.
• Your right to erasure — You have the right to ask us to delete your personal information.
• Your right to restriction of processing — You have the right to ask us to limit how we can use your personal information.
• Your right to object to processing — You have the right to object to the processing of your personal data.
• Your right to data portability — You have the right to ask that we transfer the personal information you gave us to another organisation, or to you.
• Your right to withdraw consent — When we use consent as our lawful basis you have the right to withdraw your consent at any time.

If you make a request, we must respond to you without undue delay and in any event within one month.

To make a data protection rights request, please contact us using the contact details at the top of this privacy notice.

Our lawful bases for the collection and use of your data

Running and securing this website

• Legitimate interests — we have a legitimate interest in keeping our website available, working correctly and free from abuse. We keep the information to the minimum our host records automatically, we do not track visitors across sites, and we consider this has no meaningful impact on your privacy.

Responding to enquiries and demonstrating Cyclos

• Legitimate interests — when you contact us about our software, we have a legitimate interest in answering you, keeping a record of what was asked and agreed, and following up on the conversation. This is what you would expect us to do when you get in touch.
• Contract — where the enquiry becomes a quote or an order, we use your information to take steps at your request before entering into a contract.

Supplying and supporting Cyclos, and buying goods and services

• Contract — we need your information to do what we agreed to do: supply, install, licence and support the software, take payment, and deal with problems.
• Legal obligation — we must keep certain accounting and tax records, and we must comply with the duties UK data protection law places on us as a processor for our customers.
• Legitimate interests — we have a legitimate interest in keeping records that let us establish, exercise or defend legal claims, and in improving our software from the support problems we are asked to solve.

Marketing

• Legitimate interests — we have a legitimate interest in telling businesses in our industry about software we think is relevant to them. We only market to businesses, we tell you how to stop in every message, and we stop as soon as you ask.
• Consent — where the law requires your consent before we send a particular kind of message, we will ask for it first, and you can withdraw it at any time.

Where we get personal information from

• Directly from you — when you email us, phone us, ask for a demo, or become a customer or supplier
• Automatically, from your device, when you visit this website (see above)
• From the practice or business you work for, when a colleague gives us your details so we can set up or support your Cyclos installation
• From publicly available sources, such as a practice’s own website, Companies House and the General Optical Council register, where we need to confirm who we are dealing with

Who we share information with

We do not sell your personal information, and we do not share it for anyone else’s marketing. We share it only where we need to:

• Suppliers who work for us — our email, phone, accounting, payment and website hosting providers, each of which only handles the information needed to provide that service to us
• Our professional advisers — accountants and lawyers, where they need it to advise us
• Regulators, HMRC and law enforcement — where we are required by law to provide it, or where it is necessary to establish, exercise or defend legal claims

Where your information is stored

Our business records are held in the United Kingdom and the European Economic Area wherever we can arrange it. Some of the services we rely on — in particular website hosting, and the fonts this site loads from Google — are provided by companies based in the United States, and using them means some information (such as your IP address when you visit this website) is transferred outside the UK. Where that happens, the transfer is covered by the UK’s international data transfer agreement or the UK extension to the EU-US Data Privacy Framework, or by another safeguard approved under UK data protection law.

How long we keep information

• Website server logs — kept by our hosting provider for a short period only, and not retained by us separately
• Enquiries that do not become customers — 2 years from our last contact with you, then deleted
• Customer and supplier records, contracts and correspondence — 6 years from the end of our relationship with you, so that we can deal with any question or claim that arises afterwards
• Accounting and tax records — 6 years from the end of the accounting period they relate to, as required by law
• Marketing records — until you ask us to stop, after which we keep only the minimum needed to make sure we do not contact you again
• Support diagnostics containing patient information — deleted as soon as the support problem is resolved, and in any event within 30 days

Cookies and this website

This website does not use cookies. It sets nothing on your device, stores nothing in your browser, and runs no analytics or advertising. There is nothing here for you to accept or refuse, which is why you are not asked.

The one thing the site loads from elsewhere is its typefaces, from Google Fonts. Your browser requests those files directly from Google, which means Google receives your IP address as part of that request. Google states that it does not use these requests to build profiles or serve advertising. If you would rather not make that request at all, blocking fonts.googleapis.com and fonts.gstatic.com in your browser will leave the site fully readable in your system fonts.

How to complain

If you have any concerns about our use of your personal information, you can make a data protection complaint to us at tim@aspheric.co.uk, or by writing to us at the registered office address at the top of this notice. Please tell us what you think has gone wrong and what you would like us to do about it, and we will respond within one month.

If you remain unhappy with how we’ve used your data after raising a complaint with us, you can also complain to the ICO.

The ICO’s address:

Helpline number: 0303 123 1113
Website: https://www.ico.org.uk/make-a-complaint

We keep this notice under review and will update it when what we do with personal information changes. Any change takes effect from the “last updated” date at the top of the page.