Privacy Policy

1. Introduction

AB Pharmacy is committed to protecting your privacy and handling your personal information lawfully, fairly, securely and confidentially.

This Privacy Policy explains how we collect, use, store and share personal information when you:

• visit www.abpharmacy.co.uk;
• contact us by telephone, email, post or through our website;
• create an account or place an order;
• request pharmacy services, medicines or healthcare advice;
• receive medicines or other products from us;
• act on behalf of a patient;
• represent a care home, GP practice, healthcare provider, supplier or other organisation; or
• otherwise communicate or do business with us.

This policy also explains your rights under UK data protection law.

2. Who we are

AB Pharmacy is operated by:

AB Care Group Limited
Company number: 16514123
Registered office: 76 Harrowdene Road, Wembley, England, HA0 2JF

Pharmacy premises:

AB Pharmacy
20A Turner Road
Edgware
HA8 6AU
United Kingdom

Email: info@abpharmacy.co.uk
Telephone: To be confirmed

AB Care Group Limited is the data controller responsible for deciding how and why your personal information is used.

Where another healthcare provider independently decides how your information is used, that provider may also be a separate data controller.

3. Information we may collect

The information we collect depends on how you interact with us and which services you use.

3.1 Identity and contact information

We may collect:

• your name;
• date of birth;
• age;
• title;
• gender, where relevant to your care;
• home, delivery or billing address;
• email address;
• telephone number;
• NHS number, where applicable;
• patient or customer reference numbers; and
• details of a parent, guardian, carer, representative or authorised person.

3.2 Health and pharmacy information

Where necessary to provide pharmacy services safely, we may collect information including:

• details of medicines prescribed, requested, purchased, supplied or delivered;
• prescription information;
• current and previous medication;
• allergies, sensitivities and adverse reactions;
• medical conditions and relevant medical history;
• details provided in communications with our pharmacists or pharmacy team;
• information relevant to the suitability and safe supply of medicines;
• details of your GP, prescriber, care home or other healthcare provider;
• records of pharmacy advice, interventions, consultations or referrals;
• exemption, eligibility or payment information relating to NHS services;
• safeguarding information, where relevant; and
• other information necessary to provide safe and effective pharmacy care.

Health information is classed as special-category personal data and receives additional protection under data protection law and professional confidentiality requirements.

3.3 Order and transaction information

We may collect:

• products or medicines ordered;
• order dates and order history;
• prices, delivery charges and payment status;
• delivery preferences and instructions;
• proof of delivery;
• refund, cancellation or complaint information; and
• communications relating to an order or pharmacy service.

Payment card information may be processed directly by a secure third-party payment provider. We may receive limited transaction information, such as confirmation that payment was successful, rather than your full card details.

3.4 Information about representatives and care organisations

Where we provide services to care homes or other organisations, we may collect:

• the names and business contact details of staff members;
• job titles and professional roles;
• records of instructions, orders and communications;
• authorised contact information;
• delivery and account details; and
• information required to confirm authority to act for a patient.

3.5 Website and technical information

When you use our website, we or our service providers may collect:

• your IP address;
• browser type and version;
• device type;
• operating system;
• approximate location derived from your IP address;
• pages visited;
• date and time of visits;
• referring website;
• interaction and navigation information;
• cookie choices; and
• website security and diagnostic information.

Further information is available in our Cookie Policy and through the website’s privacy settings tool.

3.6 Correspondence and enquiries

We may keep records of:

• website contact-form submissions;
• emails;
• telephone calls and messages;
• letters;
• complaints;
• feedback;
• requests to exercise data protection rights; and
• other communications with you.

Please do not include detailed medical or confidential information in a general website contact form unless it is necessary. Where appropriate, contact the pharmacy directly so that we can use a suitable confidential communication method.

4. How we collect your information

We may obtain personal information:

• directly from you;
• from a parent, guardian, carer or authorised representative;
• from a care home or its staff;
• from your GP, prescriber or another healthcare professional;
• from an NHS organisation or pharmacy system, where applicable;
• from a prescription or prescription-nomination service;
• from delivery providers;
• from payment providers;
• from website, hosting, analytics and security providers;
• from publicly available professional or regulatory registers;
• from suppliers and business partners; and
• from regulators, public bodies or law-enforcement agencies where legally permitted or required.

Where someone provides us with information about another person, they must have appropriate authority to do so and should make this Privacy Policy available to that person where possible.

5. How we use personal information

We may use personal information to:

5.1 Provide pharmacy and healthcare services

This includes:

• receiving and processing prescriptions;
• dispensing, checking, supplying, packaging and delivering medicines;
• providing pharmaceutical advice;
• checking that medicines are suitable and safe;
• identifying allergies, interactions, contraindications or other risks;
• contacting patients, carers, care homes, prescribers or healthcare professionals;
• maintaining accurate pharmacy and patient-care records;
• managing repeat medication and prescription requests;
• responding to clinical questions or concerns;
• making referrals or escalating concerns where necessary;
• supporting continuity of care; and
• meeting professional, clinical and regulatory standards.

5.2 Manage orders and deliveries

This includes:

• processing and fulfilling orders;
• arranging payment;
• confirming orders and deliveries;
• communicating about delays, availability or substitutions;
• verifying delivery information;
• dealing with cancellations, returns or refunds; and
• preventing delivery or transaction errors.

5.3 Respond to enquiries and complaints

We use information to:

• respond to questions and contact requests;
• investigate concerns or complaints;
• maintain records of our response;
• improve our services; and
• establish, exercise or defend legal claims.

5.4 Operate and protect our website and business

We may use information to:

• operate and maintain our website;
• remember privacy and cookie choices;
• measure website performance and usage;
• diagnose technical problems;
• maintain security;
• prevent fraud, misuse and cyberattacks;
• manage suppliers and business relationships;
• maintain financial and administrative records; and
• comply with legal, regulatory and insurance requirements.

5.5 Communicate with you

We may contact you about:

• your prescription, medicine, order or delivery;
• a service you have requested;
• information needed to provide safe pharmacy care;
• changes to our services or terms;
• safety notices, medicine recalls or urgent healthcare matters;
• complaints or feedback; and
• regulatory or legal matters affecting the service.

These are service communications and are not direct marketing.

5.6 Marketing

We will only send electronic marketing where we have an appropriate lawful basis and where this is permitted by the Privacy and Electronic Communications Regulations.

Where consent is required, you may withdraw it at any time by using the unsubscribe option in the communication or by contacting us.

We will not use confidential health or prescription information to market unrelated products or services without an appropriate lawful basis and any consent required by law.

6. Our lawful bases

Under UK data protection law, we must identify a lawful basis for using personal information.

Depending on the circumstances, we may rely on the following lawful bases.

6.1 Contract

We may process information where it is necessary to:

• provide products or services you have requested;
• fulfil an order;
• arrange delivery;
• process payment; or
• take steps at your request before entering into a contract.

6.2 Legal obligation

We may process information where necessary to comply with legal, professional or regulatory obligations, including obligations relating to:

• pharmacy records;
• medicine supply;
• patient safety;
• controlled drugs;
• product recalls;
• safeguarding;
• accounting and taxation;
• fraud prevention;
• data protection; and
• regulatory inspections or investigations.

6.3 Public task

Where we provide NHS pharmaceutical services or perform functions in the public interest, we may process information because it is necessary to carry out a task in the public interest or in the exercise of official authority.

6.4 Legitimate interests

We may process information where necessary for our legitimate interests or those of another organisation, provided those interests are not overridden by your rights.

Our legitimate interests may include:

• running and improving our business;
• responding to general enquiries;
• maintaining website and information security;
• preventing fraud or misuse;
• managing suppliers and professional relationships;
• keeping appropriate business records; and
• establishing, exercising or defending legal claims.

6.5 Consent

We may rely on consent where you have freely given a clear choice, including for:

• certain marketing communications;
• optional website analytics or third-party website services;
• certain disclosures of confidential information; or
• other optional uses explained at the time.

You may withdraw consent at any time. Withdrawal will not affect processing that took place before consent was withdrawn.

6.6 Vital interests

In rare circumstances, we may process or share information where necessary to protect someone’s life or physical safety and they are unable to give consent.

7. Additional conditions for health information

In addition to an Article 6 lawful basis, we must have a separate legal condition for processing health and other special-category information.

We will normally process health information where it is necessary for:

• medical diagnosis;
• the provision of health treatment or pharmacy care;
• the management of health or social-care systems and services;
• reasons of public interest in the area of public health;
• protecting vital interests;
• establishing, exercising or defending legal claims;
• substantial public-interest purposes recognised by law, including safeguarding and preventing fraud; or
• another condition permitted by the UK GDPR or Data Protection Act 2018.

Health information is handled by, or under the responsibility of, pharmacy professionals and other people who are subject to professional, contractual or legal duties of confidentiality.

8. Who we may share information with

We only share personal information where necessary, proportionate and legally permitted.

Depending on the service, recipients may include:

• pharmacists, pharmacy technicians and authorised pharmacy staff;
• your GP, prescriber or another healthcare professional;
• NHS organisations and NHS service providers;
• care homes, carers or authorised representatives involved in your care;
• other pharmacies or healthcare providers involved in continuity of care;
• medicine wholesalers, manufacturers or suppliers, where necessary;
• courier, postal and delivery providers;
• payment processors and banks;
• website hosting, email, IT, cloud-storage, cybersecurity and technical-support providers;
• professional advisers, auditors, insurers and accountants;
• regulators, including the General Pharmaceutical Council;
• the Medicines and Healthcare products Regulatory Agency;
• the Information Commissioner’s Office;
• NHS counter-fraud or fraud-prevention bodies;
• local authorities, safeguarding bodies, coroners, courts and tribunals;
• police and other law-enforcement agencies; and
• another organisation involved in a sale, transfer or restructuring of our business, subject to appropriate confidentiality protections.

Where a service provider processes information on our behalf, we require it to use the information only in accordance with our instructions, maintain appropriate security and comply with data protection law.

We do not sell personal or patient information.

9. Confidentiality and disclosures

Our pharmacy professionals and staff are required to respect and maintain patient confidentiality.

We will normally seek your consent before disclosing confidential information for purposes unrelated to your care. However, information may be disclosed without consent where:

• disclosure is required by law;
• it is necessary to comply with a court order;
• it is necessary to protect you or another person from serious harm;
• it is necessary for safeguarding;
• there is a serious risk to public health;
• disclosure is otherwise justified in the public interest; or
• another lawful exception applies.

Any such disclosure will be carefully considered and limited to the information reasonably necessary.

10. Website service providers

10.1 Website hosting and IONOS services

Our website is hosted or supported by IONOS. IONOS may process technical information necessary to host, secure and operate the website.

The website may also use IONOS SiteAnalytics to provide information about website use and performance. Where required, this service will only be activated after you have made the relevant choice through our cookie or privacy settings.

10.2 Google Maps

Our website may embed Google Maps to display our pharmacy location. Google may receive information such as your IP address, device information and interaction with the map.

Google Maps will not be loaded until you give the required consent through the website’s privacy settings, where consent is required.

10.3 Website translation service

Our website may use a third-party translation service. If you activate this feature, the provider may process your IP address, device information, website content requested and information about your interaction with the service.

The translation service will not be loaded until you give the required consent where consent is required.

10.4 Cookies

Our website uses cookies and similar technologies.

Strictly necessary technologies may be used without consent where they are required to:

• operate the website;
• provide security;
• maintain your privacy choices; or
• provide a service you have specifically requested.

Analytics, translation, map, advertising or other optional technologies will only be used in accordance with your choices and applicable law.

Please see our separate Cookie Policy for further information.

11. International transfers

Some website, IT, cloud, payment, analytics, translation or support providers may process personal information outside the United Kingdom.

Where personal information is transferred internationally, we will ensure that an appropriate safeguard is in place. This may include:

• a UK adequacy regulation;
• the UK International Data Transfer Agreement;
• the UK Addendum to the EU Standard Contractual Clauses;
• another legally approved transfer mechanism; and
• additional technical or organisational protections where appropriate.

You may contact us for further information about the safeguards used for a particular transfer.

12. How long we retain information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected and to meet legal, professional, regulatory, insurance and contractual obligations.

Retention periods vary according to the type of record.

We may retain:

• pharmacy, dispensing and patient-care records for the periods required by pharmacy law, NHS requirements, professional guidance and applicable records-management standards;
• controlled-drug and legally required records for the statutory retention period;
• prescription, supply and clinical records for the relevant healthcare-record retention period;
• order, payment and accounting records generally for at least six years after the relevant financial year or transaction;
• complaint, incident and legal records for as long as necessary to investigate the matter and manage potential legal claims;
• general enquiries for a reasonable period after the enquiry has been resolved;
• marketing preferences until you withdraw consent or object, together with a limited suppression record to ensure we respect your choice;
• cookie and consent records for an appropriate period to demonstrate compliance; and
• website security logs for the period reasonably necessary to investigate security issues and prevent misuse.

Information may be retained for longer where:

• required by law;
• necessary for patient safety;
• relevant to an ongoing complaint, investigation or legal claim;
• required by a regulator or public authority; or
• necessary to protect the rights or safety of an individual.

When information is no longer required, it will be securely deleted, destroyed or anonymised.

13. Information security

We use appropriate technical and organisational measures designed to protect personal information against:

• unauthorised access;
• unlawful use or disclosure;
• accidental loss;
• alteration;
• destruction; and
• damage.

Measures may include:

• access controls and user authentication;
• role-based access;
• staff confidentiality obligations;
• staff training;
• secure pharmacy and IT systems;
• encrypted communications or storage where appropriate;
• system monitoring and security updates;
• physical security;
• secure disposal procedures;
• supplier due diligence;
• incident-management procedures; and
• business-continuity and backup arrangements.

No website or electronic system can be guaranteed to be completely secure. Please contact us promptly if you believe information you have provided to us has been compromised.

14. Children and people who need assistance

Our pharmacy services may involve information about children or people who lack capacity to manage their own affairs.

We will handle this information in accordance with applicable law, professional guidance and the person’s best interests.

A parent, guardian, carer or authorised representative may provide information or exercise rights on behalf of another person where they have appropriate authority. We may ask for evidence of identity and authority before acting on a request.

15. Automated decision-making

We do not currently make decisions that produce legal or similarly significant effects about patients or customers solely through automated processing without meaningful human involvement.

We may use automated tools to support administrative, fraud-prevention, stock-management, website-security or clinical-checking processes. Appropriate pharmacy professionals remain responsible for decisions relating to the safe and appropriate supply of medicines.

We will update this policy and provide any additional information required by law before introducing relevant solely automated decision-making or profiling.

16. Your data protection rights

Depending on the circumstances and lawful basis used, you may have the following rights.

16.1 Right of access

You may ask for confirmation of whether we hold personal information about you and request a copy of that information.

16.2 Right to rectification

You may ask us to correct inaccurate information or complete information that is incomplete.

Clinical records are not normally altered in a way that removes the original entry. Where appropriate, a correction or supplementary note may be added so that the integrity of the record is maintained.

16.3 Right to erasure

You may ask us to delete personal information in certain circumstances.

This right is not absolute. We may need to retain pharmacy or healthcare records where required by law or necessary for patient safety, public health, professional accountability or legal claims.

16.4 Right to restrict processing

You may ask us to restrict how we use information in certain circumstances.

16.5 Right to object

You may object to processing based on legitimate interests or public task.

You have an absolute right to object to the use of your personal information for direct marketing.

16.6 Right to data portability

Where processing is based on consent or contract and carried out by automated means, you may be entitled to receive information you provided in a structured, commonly used and machine-readable format.

16.7 Right to withdraw consent

Where processing is based on consent, you may withdraw consent at any time.

16.8 Rights concerning automated decisions

Where applicable, you may have rights relating to decisions based solely on automated processing that have legal or similarly significant effects.

Not every right applies in every situation. We will explain any relevant exemption or limitation if we cannot comply fully with a request.

17. How to exercise your rights

To exercise a data protection right, contact:

Data Protection Lead
AB Pharmacy
20A Turner Road
Edgware
HA8 6AU

Email: info@abpharmacy.co.uk

Please clearly state that your enquiry concerns data protection or your personal information.

We may ask for information to confirm your identity and, where you are acting for someone else, evidence of your authority.

We normally respond without undue delay and within one month. A longer period may apply where a request is particularly complex or where several requests have been made. We will tell you if an extension is necessary.

We do not normally charge a fee. A reasonable fee may be charged, or a request may be refused, where permitted by law because it is manifestly unfounded or excessive.

18. Complaints

Please contact us first if you have concerns about how we have used your personal information.

Data Protection Lead
AB Pharmacy
20A Turner Road
Edgware
HA8 6AU

Email: info@abpharmacy.co.uk

You also have the right to complain to the Information Commissioner’s Office:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113
Website: www.ico.org.uk

You may complain to the ICO without contacting us first, although the ICO may recommend that you give us an opportunity to resolve the matter.

19. Links to other websites

Our website may contain links to external websites or services.

We are not responsible for the privacy practices, security or content of external websites. You should read the privacy information provided by the relevant external organisation before submitting personal information.

20. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect:

• changes to our services;
• changes to our website or technology;
• changes to our suppliers;
• regulatory or legal developments; or
• improvements to our information-handling practices.

The latest version will be published on our website and will show the date on which it was last updated.

Where a change materially affects how we use personal information, we will take reasonable steps to bring the change to the attention of affected individuals.

21. Contact us

For general questions about this Privacy Policy or our use of personal information, contact:

AB Pharmacy
20A Turner Road
Edgware
HA8 6AU

Email: info@abpharmacy.co.uk
Telephone: To be confirmed