Our policies
Schedule of Personal Data Processing Activities
| Activity | Data used | Purpose | Lawful basis (UK GDPR) |
|---|---|---|---|
| Account registration | Name, contact details, DOB | Create and manage your account | Art 6(1)(b) contract |
| Orders & delivery | Contact/delivery details, order & payment data | Fulfil and deliver your order | Art 6(1)(b) contract |
| Consultations & prescribing | Health data, consultation answers, medical history | Assess suitability and dispense treatment | Art 6(1)(b); Art 9(2)(h) health/social care |
| NHS prescriptions | Identity data, NHS number, prescription data | Process NHS prescriptions | Art 6(1)(e) public task; Art 9(2)(h) |
| Customer support & complaints | Contact details, order history, correspondence | Resolve queries and complaints | Art 6(1)(f) legitimate interests |
| Marketing communications | Contact details, marketing preferences | Send offers and updates you've opted into | Art 6(1)(a) consent |
| Website analytics | Technical/usage data, cookie identifiers | Understand and improve site performance | Art 6(1)(a) consent (non-essential cookies) |
| Fraud & identity checks | Identity data, verification results | Prevent fraud and verify age/identity | Art 6(1)(f) legitimate interests; Art 6(1)(c) legal obligation |
| Business contacts & suppliers | Name, role, contact details | Manage supplier and business relationships | Art 6(1)(f) legitimate interests |