Privacy Notice

Who we are
[Pharmalogic legal entity name] (“Pharmalogic”, “we”, “us”) is the data controller for the personal information described in this notice, registered with the Information Commissioner's Office (ICO) under registration number [ICO registration number]. Our appointed Data Protection Officer / privacy contact is [DPO name / role] ([DPO email]). Postal address: [registered office address].

What we collect and how
We collect information you give us directly (for example when you register, place an order, or contact us), information generated by your use of the Site (technical and browsing data), and, where relevant, information from third parties such as the NHS or your GP where needed to provide your care. Categories of data may include:
• Identity data - name, date of birth, gender.
• Contact data - address, phone number, email.
• Special category (health) data - medical history, conditions, prescriptions, consultation answers.
• Transaction data - orders and payment details (card details are handled by our payment provider, not
stored by us).
• Technical and usage data - IP address, browsing activity, device information.
• Marketing preferences and correspondence.

Why we use it (lawful basis)
We rely on performance of our contract with you and our legitimate interests (UK GDPR Article 6(1)(b) and (f)) to process most account, order and delivery data. Because we handle health data, we also rely on Article 9(2)(h) (provision of health or social care) as our special category condition for clinical and prescribing data. Where we send marketing, we rely on your consent (Article 6(1)(a)), which you can withdraw at any time. Full detail of each processing activity and its lawful basis is set out in our Schedule of Personal Data Processing Activities.

How long we keep it
We keep personal data only as long as necessary for the purpose it was collected, including to meet legal and regulatory retention requirements. As a guide: general account and order data is typically kept for [X years], and prescription/health records are kept for [X years, per GPhC record-keeping standards] after your last interaction with us, unless a longer period is required by law.

Your rights
Under UK data protection law, you have the right to:
• Be informed about how we use your data.
• Request a copy of the data we hold about you (subject access request).
• Have inaccurate data corrected.
• Request erasure of your data, where applicable.
• Restrict or object to certain processing, including direct marketing.
• Not be subject to solely automated decisions that significantly affect you, without human review.
To exercise any of these rights, contact us at [privacy contact email]. If you remain unhappy with how we handle your data, you can complain to the ICO (ico.org.uk / 0303 123 1113).

Automated decision-making
We may use automated checks (for example to flag unusual payment activity, or to screen consultation answers for red-flag symptoms that make a treatment unsuitable). Where an automated check leads to a significant decision, such as declining an order, a member of our team reviews the outcome, and you can ask us to review any such decision.

Data security and sharing
We use appropriate technical and organisational measures (encryption, access controls, staff training) to protect your data. We share data only with trusted parties who need it to help us operate for example delivery couriers, payment processors, our pharmacy dispensing system, cloud/IT providers, and, for NHS prescriptions, the NHS under appropriate contracts, and we never sell your personal data.

Cookies
The Site uses cookies; see our Cookie Policy for full details and how to control them.

Changes to this notice
We will post any changes to this notice on this page.