Privacy Policy

This explains what we do with your family's information

This website, kidseyes.co.za, including all sub-domains and the booking, course and shop functionality offered on or through it, is operated by Kids Eyes LLC.

Kids Eyes operates as a group of related companies that work together to deliver our services to you and your child. Throughout this policy, "the Kids Eyes group" means Kids Eyes LLC together with its sister companies, each described below.

It applies to information we collect on the Website, through our forms and surveys, through email, SMS and WhatsApp, through virtual and in-person consultations, through school vision screenings, and through the systems we use to run the practice, whether you engage with us as a guest, a registered user, a customer or a patient.

This Privacy Policy is an addendum to our Terms of Service and should be read together with it. By using the Website, completing any form, booking a consultation, or purchasing anything from us, you accept and agree to be bound by it.

Six commitments, before any of the detail

The rest of this page is the detail. These are the commitments that detail is built on, and they are the short version if you read nothing else.

• We never sell your information. Not yours, and never your child's. We do not rent it, trade it, or hand our lists to anyone.
• Clinical information stays in the practice. Your child's record lives in our practice systems and is used for their care. It is never sent to a marketing tool, an advertising platform or an analytics provider.
• We collect only what we need for the service you have asked for, or what the law requires us to keep. Not more, in case it is useful later.
• We tell you who else sees it, and why, and we share the minimum that provider needs to do its one job.
• You stay in control. You can ask to see your information, correct it, or have it deleted, and you can tell us to stop marketing to you at any time, without it affecting your child's care.
• We protect it, and we own up. We use the security measures the law requires, and if they ever fail we will tell you and the regulator where that duty applies.

The Kids Eyes group, and who holds what

Different companies within the group are responsible for different information, depending on what you are doing with us.

• Kids Eyes LLC operates the Website and everything transacted through it: course purchases, resource downloads, email subscriptions, and the booking of consultations. It is responsible for the information held in our website and marketing system, Kartra.
• Kids Eyes (Pty) Ltd delivers the consultations booked through the Website and is responsible for the clinical practice-management system, GoodX, in which patient records are held.
• Dr Claire Cullen Inc is Dr Claire's registered medical practice. South African law requires a doctor's practice to be registered in the practitioner's own name, and this practice is the treating provider.
• Kids Vision SA carries out school vision screenings on behalf of the group.
• plusoptiX provides and rents the screening and diagnostic equipment used by the group.

These companies share information between them on a need-to-know basis, only as far as is necessary to provide you with the service you have asked for and to meet our legal and clinical obligations.

Written to meet South African, European, UK and Californian standards at once

We serve families in South Africa and, increasingly, internationally, so this policy is written to the higher standard rather than the local minimum.

• South Africa. POPIA applies. Kids Eyes is the responsible party and has designated an Information Officer.
• European Union and United Kingdom. The GDPR and UK GDPR apply. The relevant Kids Eyes company is the data controller.
• California. The CCPA/CPRA and CalOPPA apply, including in respect of sensitive personal information.
• Anywhere else. We apply the protections in this policy as a baseline and comply with any additional local law.

Where any mandatory right or protection in your home region is greater than what is written here, that greater protection applies to you. Nothing in this policy takes away a right the law of your country gives you. Which country's law governs the policy itself is a separate question, and it is answered under Which country's law applies.

Only what we need to serve you, your child, or the law

Information you give us. What you provide when you fill in a form or survey, subscribe to our emails, create an account, contact us, purchase a course or resource, or book a consultation. Typically your name, email address, telephone number and, where relevant, your postal or delivery address.

Your child's information. Because we are a paediatric eye care practice, some of our forms ask you, as the parent or guardian, for information about your child: name, age, gender, and eye conditions, including standardised condition codes. A pre-consultation history may also include symptoms and background so Dr Claire can prepare.

Order and booking information. Billing details, delivery address where a physical product is involved, the service or appointment booked, and payment confirmation.

Clinical records. Once your child becomes a patient, a clinical record is created and held in GoodX. That goes well beyond the above, and is dealt with separately below.

Information we collect automatically. Cookies, log files, tags, pixels and analytics collect your IP address, device and browser type, operating system, the pages you view, what referred you, and how you interact with the Site.

Information we get from other people. Some information reaches us from someone other than you. That includes our payment provider confirming a payment, our courier confirming a delivery, the providers who run parts of the site collecting information on our behalf, and, where your child has been referred to us, the referring practitioner. Where a school screening is arranged through a school, the school gives us what we need to run it. Anything we receive this way is treated under this policy exactly as if you had given it to us directly.

A child's information is protected, and it comes from you

Protecting children's information is central to what we do, and the law treats it with extra care.

• Our Website is intended for use by parents and guardians, not by children. We do not knowingly allow a child to create an account, make a purchase or provide their own information to us.
• We collect a child's information from you, with your consent, and only to provide eye care and related services to that child.
• A child's health information is only used for the child's care, and is only shared as described below.
• If you believe we hold information about a child without a parent or guardian's consent, contact our Information Officer and we will investigate.

Clinical records are held separately, under stricter rules

When your child attends a consultation, a procedure or a school screening, a clinical record is created and maintained by the treating practice in GoodX. It may include consultation notes, examination findings, diagnoses, treatment plans, prescriptions, procedure records, correspondence and referrals.

• Used for the direct care of your child, clinical administration, lawful reporting and our professional obligations. Never for marketing.
• Access is limited to the treating practitioner and the staff who need it.
• Kept confidential under the doctor's duty of confidentiality, the National Health Act and HPCSA rules.
• Retained for the periods those rules require, including the longer periods that apply to the records of minors.
• You may request access to, or correction of, your child's record. Requests go through the practice, because clinical records carry duties a website account does not.

To provide the care and services you have asked for

• Provide the services, products, courses, resources and consultations you asked for
• Create and manage your account and your child's records
• Process payments, arrange delivery, and provide invoices, receipts and refunds
• Communicate about your account, orders, subscriptions and appointments
• Prepare for and deliver consultations and follow-up care
• Provide customer service and support
• Send newsletters and offers where you have subscribed, always with an opt out
• Screen orders for fraud and protect the security of our systems
• Meet our legal, regulatory, clinical, accounting and tax obligations

Where the GDPR or UK GDPR applies we rely on performance of a contract, your consent, our legitimate interests, compliance with a legal obligation, and, for health information, your explicit consent and the provision of health care. Under POPIA we process on the equivalent grounds, including your consent as the competent person for a child.

Your child's clinical information never leaves the practice

This is the section most parents actually want, so here it is plainly. We hold information at three different levels, and they are kept apart on purpose.

Level 2. Website and account information. Our website and marketing system, Kartra, holds a limited set of information: your name, email address, telephone number, what you have bought or booked, and what you have subscribed to. It does not hold your child's clinical record.

Level 3. Operational providers. A handful of providers receive standard contact information, and only the minimum needed to do one specific job:

• Payments. Stripe processes card payments as our payment gateway. Your card details are collected and held by Stripe under its own security and data-retention rules. We never see or store them.
• Courier and delivery. The provider varies by region and by what is being delivered, so we cannot name a single one. Whichever is used receives only the name and delivery address needed to deliver that parcel.
• Email, SMS and messaging. We use a number of providers, including Meta for WhatsApp. Each receives only the contact detail needed to send you the message.
• Marketing and analytics. We currently advertise and measure through Meta, Google and TikTok. These platforms receive website activity and standard contact information for advertising measurement and audiences. We may add, change or drop platforms, including AI-based tools, as our marketing changes.

None of the providers at level 3 ever receive your child's clinical information. What they receive is standard contact information and nothing beyond what is required to deliver a parcel, send a message, or measure an advert.

Within the Kids Eyes group. The sister companies share information with each other only as far as is necessary to deliver the service. A booking taken by Kids Eyes LLC is shared with Kids Eyes (Pty) Ltd and the treating practice so the appointment can be delivered and recorded. Clinical records are held by the practice and are never shared across the group for marketing or commercial purposes.

For legal and protective reasons. We may disclose information where the law requires it, to respond to a lawful request from an authority, to enforce our terms and policies, or to protect the rights, safety or property of the group, our patients or others. We may also disclose information to a successor in the event of a merger, restructuring or sale of the business or its assets.

Some of it does, and it stays protected when it goes

Because the group operates across South Africa and abroad, and because Kartra and some of our providers are located outside South Africa, your information may be transferred to, stored in or processed in another country, including the United States.

When we transfer information across borders we take the steps the law requires: transferring only to countries or providers offering an adequate level of protection, putting safeguards such as standard contractual clauses in place, and, where required, obtaining your consent. Clinical records held in GoodX are handled in line with South African health and data-protection law.

You can see it, correct it, delete it, or tell us to stop

Everywhere. You may ask for a copy of the personal information we hold about you, ask us to correct or update it, ask us to delete it, object to or restrict certain processing, and withdraw a consent you have given, without affecting processing already carried out.

• South Africa (POPIA). Access, correction, deletion, objection, a complaint to the Information Regulator, and the right to ask us not to process your information for direct marketing.
• EU and UK (GDPR). Access, rectification, erasure, restriction, objection, portability, withdrawal of consent, and a complaint to your supervisory authority.
• California (CCPA/CPRA). The right to know, access, delete and correct, and to opt out of any sale or sharing for cross-context behavioural advertising. We do not sell your information, and we will not discriminate against you for exercising your rights.
• The right to appeal. If we decline a request you have made about your information, we will tell you why, and you may appeal that decision by replying to us directly. If you are still not satisfied you may take it to the regulator for where you live.
• Someone can act for you. You may appoint an authorised agent to make a request on your behalf. Before we act on it we will need proof that you authorised them, and we may still need to verify your identity with you directly.

Requests about your child's clinical record are handled through the practice, as set out above.

You choose what you give us, and you can change your mind

When you provide personal information you consent to it being used for the purposes set out in this policy, and you confirm you are entitled to provide it, including, for a child, that you are the parent or guardian.

If you choose not to provide certain information you may still browse the Website, but you may not be able to make purchases or book consultations that require it.

You may withdraw your consent to marketing at any time. Withdrawing consent does not affect processing we are required to carry out by law, or processing necessary to provide care you have already asked for, and it will never affect your child's treatment.

Come to us first, then to the regulator

If you believe we are not handling your information in line with this policy, please contact our Information Officer first so we can put it right.

You also have the right to complain to the relevant authority: the Information Regulator (South Africa) under POPIA, your data protection supervisory authority in the EU or UK under the GDPR, or the California Privacy Protection Agency or Attorney General under the CCPA/CPRA.

Through PAIA, and everything you need is set out here

South African law gives you a separate, formal route to ask for a record held by a private body, under the Promotion of Access to Information Act, 2000 (PAIA). It sits alongside the rights above, it does not replace them.

Most requests never need it. If you want a copy of your child's record, or want something corrected, just ask us and we will deal with it. PAIA matters when you need a record in order to exercise or protect a right, and you want the formal process.

What the practice holds. Our records fall into these categories:

• Patient records: health records, medical reports, consents, assessments, funding and account information, and related correspondence. In the health sector these are protected by legislation and by ethical rules, and any disclosure can only happen within those frameworks, if at all.
• Internal business records: founding and statutory documents, minutes, policies and procedures, financial and operational records, contracts, licences, intellectual property, insurance, and internal correspondence.
• Personnel records for employees, locums, associates and contractors, including contracts, conditions of employment and related records.
• Supplier and service provider records: registrations, contracts, confidentiality agreements, logs and delivery records.
• Technical records: manuals, logs, product and equipment registrations, and statutory or professional body records.
• Third party information in our possession, subject to whatever conditions attach to it.

Listing a category here does not mean we will hand it over. Every request is assessed against the Act.

How to make a request.

• Use the prescribed form and address it to our Information Officer, whose details are below.
• Give us enough detail to identify the record, to identify you (and your authority, if you are acting as someone's agent), and the form of access you want.
• Tell us which right you are trying to exercise or protect, and why you need the record to do it. The Act requires this.
• Give us a postal address or other contact details in South Africa, and say how you would like to be told the outcome.

What happens next.

• We must respond within 30 days. If we refuse and you are not satisfied, you may take it further, including to court within 30 days.
• Fees may be payable. A request fee, and fees for reproduction, are set by regulation rather than by us and change from time to time. We will tell you the current amounts when you ask.
• If the record you want is part of a larger record, you will get only the part that relates to what you are entitled to, not the rest.
• The Act allows us to refuse access on the grounds it sets out, for example where a record contains someone else's confidential information or a business's trade secrets. Health records carry their own protections under the National Health Act and the HPCSA rules on top of that.

PAIA is overseen by the Information Regulator (South Africa), which took over that role from the South African Human Rights Commission. You may approach the Regulator if you are unhappy with how a request was handled.

Secure transmission, limited access, and no card details on our side

• Online transactions and sensitive information are protected using secure transmission technology (SSL/TLS).
• Your card details are never stored or visible to us. They are collected and processed by Stripe, our PCI-compliant payment gateway, under its own security and data-retention rules.
• Access within the group is limited to people who need it for their role.
• Email is not a fully secure medium. Please do not send us sensitive personal or clinical information by email.

No system can be guaranteed completely secure. Where a compromise occurs despite our reasonable measures and without our negligence, we will act as the law requires, including notifying you and the relevant regulator where that duty applies.

As long as we need it, and as long as the law requires

We keep personal information for as long as it is necessary to provide the services you and your child have asked for, and for as long as the law separately requires us to keep it. Those two periods are not always the same, and where they differ the longer one applies.

• Website, account and marketing information is kept while your relationship with us is active, and thereafter as needed to meet legal, accounting, tax and dispute obligations, or until you ask us to delete it.
• Clinical records are kept for the periods required by the National Health Act and HPCSA guidelines, including the longer periods that apply to the records of minors.

After an account is closed, or after you ask us to delete information, we may still keep what we need in order to comply with the law, to complete a financial or tax audit and our reporting, to prevent or investigate fraud, to resolve a dispute or complaint, to troubleshoot a problem, to assist a lawful investigation, and to enforce our terms. Anything we keep stays covered by this policy.

We may also keep information in a de-identified or aggregated form, for statistical and reporting purposes. Once it is de-identified it can no longer be traced back to you or your child.

When information is no longer needed and no legal duty requires us to keep it, we delete or de-identify it.

You choose on the banner, the first time you arrive

When you first visit the Website a cookie banner asks you to choose. You can accept all cookies, or accept only the essential ones.

• Essential cookies make the Site work: they remember your choices, keep you logged in, and let forms and the shopping basket function. These cannot be switched off, because without them the Site does not work.
• Everything else, including analytics and advertising cookies and pixels, is only set if you accept them on the banner.

What a cookie actually is. A cookie is a very small text file placed on your device, usually containing an anonymous unique identifier. Your browser only allows a website to read the cookies that same website set, not those set by anyone else. You can also block or delete cookies through your browser settings at any time, though parts of the Site may then not work properly.

What else records your visit. Server log files record your IP address, browser type, internet service provider, the pages that referred you and that you left by, and date and time stamps. Web beacons, tags and pixels are small electronic files that record how you browse the Site.

Third-party pixels. We use advertising and analytics technologies from Meta (Facebook, Instagram and WhatsApp), Google and TikTok. These let us and those platforms measure and improve our advertising and show content that is more relevant to you. We do not control these third parties' technologies, and their own privacy policies govern what they do with what they collect.

Some content and adverts on our Site are served by third parties: advertisers, ad networks and servers, content providers and application providers. They may use cookies on their own, or together with web beacons and other tracking technologies, to collect information about you when you use our Site.

What they collect may be joined to information they already hold about you, and may be gathered over time and across other websites and online services that you use. They may use it to show you interest-based advertising or other targeted content. We do not control their technologies or how they use them. If you have a question about a particular advert or piece of targeted content, take it up with the provider responsible for it, not with us.

How to opt out of tailored advertising. You can do this directly with each platform, or through the industry portals:

• Our emails: the unsubscribe link at the foot of every marketing email
• Meta: facebook.com/settings/?tab=ads
• Google: myadcenter.google.com
• TikTok: in the app, under Settings and privacy, then Ads
• Microsoft and Bing: Microsoft personalised ads settings
• Digital Advertising Alliance: optout.aboutads.info
• Europe and the UK: youronlinechoices.com

Opting out does not stop advertising. It stops advertising being tailored to you, so you will still see adverts, they will simply be less relevant.

Do Not Track. Our Site does not currently respond differently to a "Do Not Track" signal from your browser. Your choice on the cookie banner is what controls non-essential cookies here.

Email, SMS and WhatsApp, and you decide about the marketing

How you go on our mailing list. Only by ticking the consent box on one of our forms. The form will not submit until you do, and we keep a record of that consent. We do not add you to a marketing list because you bought something or downloaded a resource.

• We keep the content of your messages to us, your contact details and our replies, and protect them as we do everything else.
• Our marketing emails always say who they are from and include a clear way to unsubscribe.
• Service, appointment and account messages are not marketing, and you may continue to receive them while you have an active relationship with us.
• We do not sell, rent or lease our contact or subscriber lists.

Keep your password to yourself, and your details up to date

Please keep your account username and password confidential and do not share them, make sure your device is secure and free of malware, and give us accurate and current information so we can serve you properly and reach you when we need to.

This policy covers our site, not theirs

Our Website may contain links to other websites that we do not control. We are not responsible for their privacy practices, and we encourage you to read their policies before providing information to them.

Delaware for the website, South Africa for the consulting room

The group operates on both sides of the Atlantic, so two bodies of law apply, and which one depends on what you are doing with us.

• The Website and everything digital. This Privacy Policy, our Terms of Service, and everything you do through the Website, including courses, downloadable resources, the shop and any digital service, are governed by and interpreted in accordance with the laws of the State of Delaware in the United States of America. You submit to the non-exclusive jurisdiction of the courts of Delaware for the resolution of any dispute arising out of them.
• Care given to a patient in person. Where a consultation, procedure or screening is provided in person in South Africa, that care and the clinical record of it are governed by South African law. That includes the National Health Act, the ethical rules and guidelines of the HPCSA, and POPIA in respect of the clinical record.

Nothing in this section takes away a mandatory right that the law of your own country gives you. The protections that apply to you wherever you are, are set out under Which laws apply to me.

It can, and the date at the top tells you when it last did

We may update this Privacy Policy to reflect changes in our practices or for operational, legal or regulatory reasons. Where changes are material we may notify you by email or through a notice on the Website. Your continued use of the Website after a change takes effect means you accept the updated policy.

The limitation of liability in our Terms of Service applies to this policy. If any part of this policy is found to be unlawful, void or unenforceable, that part is severed and the rest of the policy remains in force to the fullest extent the law allows.

The headings and sub-headings in this policy are written as the questions a parent would ask, so the page can be scanned rather than waded through. They are for convenience only and do not affect how the policy is read or interpreted.

Our Information Officer handles every privacy question

For any question about this Privacy Policy, or to exercise any of your rights, please contact our Information Officer.

Read this together with the rest

This Privacy Policy is one of six. Any additional terms we communicate to you in writing also form part of your agreement with us.