This notice is a draft and has not yet been reviewed by a data protection adviser. Values shown as [TO BE SUPPLIED] are outstanding. It must not be published in this state.
Who we are
[TO BE SUPPLIED] (the registered pharmacy behind the clinic) is the data controller for the information described here. Our registered address, company number and ICO registration are on the about page.
Our Data Protection Officer can be reached at [TO BE SUPPLIED].
What this notice covers
This website. It is a set of static pages: it runs no analytics, sets no cookies of its own, and sends nothing about your visit anywhere. Reading these pages creates no record of you.
Two things on it do involve your information, and only if you choose them. The contact page carries a message form — what that collects is described below. That form is protected by Cloudflare Turnstile, which is the one piece of third-party content on this website; the cookies page describes what it does and why it is there.
Everything else — the consultation, your account, your orders — happens in the patient application on a separate address, and that is where the processing described below takes place.
What we collect
When you consult. Your name, date of birth, address, email address and telephone number. Your height, weight and the measurements the consultation asks for. Your medical history, family history, current medicines, allergies, and your answers to every question in the questionnaire. A photograph of you and a photograph of an identity document.
When you are treated. What was prescribed, by whom, at what strength and on what date. The outcome of any consultation by video. What you report at each review, including side effects.
When you pay. The fact and amount of a payment, and the last four digits and card type returned to us by our payment processor. We never see or hold a full card number.
Technical information in the patient application. Sign-in times, the device and browser used, and an audit record of actions taken on your record by our staff.
When you write to us through the contact form. Your name, your email address, the subject you chose from the list, and what you wrote. We also record the network address the message was sent from and the time it arrived, which is how we tell a real message from an automated one.
The form offers no clinical subject and asks you not to describe symptoms, medicines or doses. That is deliberate: a message sent from a web page arrives in a mailbox rather than in your clinical record, and we cannot attach it to your record because you have not signed in. A question about your own treatment belongs in your account, where it reaches the clinical team with your record in front of them. If you send us clinical information anyway we do not ignore it — we treat it with the same confidence as the rest of your record, and we may ask you to send it again from your account so that it lands where it belongs.
Why, and on what lawful basis
| What | Why | Lawful basis (UK GDPR) |
|---|---|---|
| Your consultation and clinical record | To decide whether treatment is appropriate and to supply it safely | Art 6(1)(b) contract; Art 9(2)(h) health care, provided by a health professional under an obligation of confidentiality |
| Identity and age verification | To confirm who you are and that you are 18 or over before a prescription-only medicine is supplied | Art 6(1)(c) legal obligation; Art 9(2)(h) |
| Dispensing and delivery records | Because a pharmacy must be able to say what it supplied to whom | Art 6(1)(c); Art 9(2)(h) |
| Pharmacovigilance and recall | To report suspected side effects and to identify everyone who received an affected batch | Art 6(1)(c); Art 9(2)(i) public health |
| Payments, refunds and accounting | To take payment and to keep the records tax law requires | Art 6(1)(b) and 6(1)(c) |
| Writing to your GP | So your records are complete | Art 6(1)(f) and your explicit consent, which you can withhold |
| Service emails and supply reminders | To tell you what is happening with an order, and that the supply you are on is running out | Art 6(1)(b); Art 9(2)(h) |
| Answering a message you send us | To read what you asked and reply to it | Art 6(1)(f) legitimate interests — you wrote to us for an answer; Art 9(2)(h) for anything you tell us about your health |
| Checking that a message is from a person | To stop the contact form being used to send mail in our name | Art 6(1)(f) legitimate interests — keeping the service and our sending domain usable |
| Marketing email | To tell you about our other treatments, and to ask you to finish a consultation you started | Art 6(1)(f) legitimate interests, with the soft opt-in at PECR reg 22(3); off at any time |
We do not make any decision about your treatment by automated means. A prescriber reads every consultation.
Who your information is shared with
- Our prescribers and pharmacy team, who need it to do their work.
- Your GP, where you have consented.
- The delivery company, which receives your name, address and contact details, and nothing about what is in the parcel.
- Our payment processor, which receives what it needs to take a payment.
- The MHRA, where a suspected side effect is reported, and the General Pharmaceutical Council or another regulator where we are required to provide information.
- Cloudflare, which serves this website and runs the anti-spam check on the contact form, and so sees the network address of anyone who uses it.
- Our technology suppliers, who process data on our instructions under a written contract.
We do not sell your information, and we do not share it for anyone else’s marketing.
Where it is held
Our systems are hosted in the United Kingdom and the European Economic Area. Where a supplier processes data outside the UK, it is done under transfer terms the UK recognises. [TO BE SUPPLIED] — the list of processors and the countries they operate in.
How long we keep it
- Your clinical record, including your consultation, prescriptions and reviews: retained for the period required of a healthcare provider. [TO BE SUPPLIED — confirm against the records management code that applies.]
- Your identity photograph and your body photograph: 90 days each, on separate clocks, then deleted from every copy and derivative. An audit record that the deletion happened outlives the images themselves.
- Payment and accounting records: six years, as tax law requires.
- Messages sent through the contact form: kept while we deal with what you asked and for a period afterwards, so that we can show what was asked and what we answered. [TO BE SUPPLIED — confirm the period, and note that a complaint sent this way is kept for as long as the complaints procedure requires rather than for this one.]
- Your marketing choice: until you change it, and the record of the change for as long as we have to be able to show we honoured it.
Asking us to delete your account does not delete your prescriptions, and does not delete the record of the money we took or the medicines we supplied. What goes, what stays and what happens to the account itself are set out under your rights, and we tell you which is which before we act rather than afterwards.
Your rights
You have the right to ask for a copy of your information, to have inaccurate information corrected, to ask us to delete it, to object to or restrict how we use it, and to receive it in a portable form. Where we rely on consent, you can withdraw it at any time.
To exercise any of them, email [TO BE SUPPLIED]. We respond within one month. Because these requests are answered by a person rather than by a button in your account, we first satisfy ourselves that you are who you say you are — otherwise anyone who reached your inbox could ask for your clinical record, or ask us to destroy it.
Asking for a copy
We send everything we hold, grouped by what it is rather than by where we keep it: your account and the details on it, your date of birth and the other facts we record about you, your addresses, your consultations and every answer you gave, what you consented to and what you were warned about, the identity checks made against you, your treatment plans and dose history, your prescriptions, the calls we held with you and every other time we tried to reach you, letters written to your GP, notes our staff have written about you, your orders and deliveries, anything you reported as a side effect, any complaint you made, every email we have sent you, and the record of which of our staff have looked at your record.
You receive it as a document you can read and, if you would rather, as a spreadsheet. Photographs and identity documents are listed in it and sent alongside, because they are images rather than text. We will not email a file of this kind to an address we have not confirmed is yours.
Asking us to delete it
Deletion is not all-or-nothing, and we tell you exactly what will happen before we do it.
What is deleted. Your account, including your name and the address you sign in with; your consultations and every answer you gave; the details you gave at checkout, including your address; the address held on your account; what you told us you were already taking; anything a prescriber asked you for and your answer; what you consented to and what you were warned about; your identity and body photographs and the checks made against them; your treatment plans and dose history; your consultation calls; your contact preferences and telephone number; your height, date of birth, biological sex and ethnicity; letters written to your GP; notes our staff have written about you; and every email we have ever sent you.
What we have to keep, and why. Prescriptions are kept in full and still name you: a prescription is the record of a clinical decision and a medicine supplied, it is kept under a professional obligation we cannot set aside on request, and it is signed in a way that means removing your name from it would destroy the proof it is genuine. Your orders, the payments and refunds on them, any side effect you reported and any complaint you made are kept without your name or address attached — we must be able to account for money taken, medicines supplied and harms reported, but we do not need to know whose. The record of which of our staff read your data is kept the same way, and it is how we show your record was handled properly, including how we show this deletion was carried out.
What happens to your account. It is left as an empty shell with nothing on it that says who you were, and it can no longer be signed in to. We keep the shell because the records above point at it. If you come back to us later, you start as a new patient.
Some of these rights are limited where the law requires us to keep a record. Where a request is refused in part, we say which part and why — before we act, not afterwards.
If you are unhappy with how we have handled your information you can complain to the Information Commissioner’s Office at ico.org.uk, or call 0303 123 1113. We would rather you told us first, so that we can put it right.
Changes
When this notice changes in substance, the date at the top of the page changes with it, and you are told about a change that affects how your information is used.