Privacy policy

01Who we are and who is responsible for your data#

Burntwood Clinic is the private clinic at Chasetown Pharmacy. The pharmacy and the clinic are owned and operated by Medicate Pharma Ltd (registered in England and Wales, company number 16277720), which trades as Burntwood Clinic at Chasetown Pharmacy, 23 High Street, Chasetown, Burntwood, Staffordshire WS7 3XE.

For the information described in this policy, Medicate Pharma Ltd is the data controller. That means we decide what information is collected and what it is used for, and we are responsible for looking after it.

• Controller: Medicate Pharma Ltd, company number 16277720
• Clinic and pharmacy address: Chasetown Pharmacy, 23 High Street, Chasetown, Burntwood, Staffordshire WS7 3XE
• GPhC registered pharmacy premises number: 1038499
• Phone: 01543 682921 · Email: chasetownpharmacy@medicatepharma.co.uk
• Registered office address: [CLIENT TO CONFIRM: registered office address, if different from the pharmacy]
• ICO registration number: [CLIENT TO CONFIRM: ICO registration number]
• Data protection lead: [CLIENT TO CONFIRM: name and contact details of the data protection lead or DPO]

We are also required to keep your health information confidential as a matter of professional duty. Our pharmacists are registered with the General Pharmaceutical Council (GPhC) and work to its standards on confidentiality as well as to data protection law.

02The information we collect#

Information that identifies you

• Your name, date of birth and, where relevant, your gender
• Your address, phone number and email address
• Your GP practice details, where you give them to us
• Emergency or next-of-kin contact details, where you give them to us

Health and clinical information — special category data

To provide clinical services safely we need information about your health. Data protection law treats this as special category data and gives it extra protection. It can include:

• Your medical history, symptoms and reason for the appointment
• Medicines you take, allergies and previous reactions
• Travel plans and history, where you come to us for travel health advice
• Vaccines given, batch numbers and the site of administration, which we must record
• Test requests, sample details and results
• Notes made by the pharmacist during your consultation, and any consent you give

Appointment, payment and correspondence information

• Appointment dates, times and the service booked
• Payment records. Card details are handled by our payment provider, not stored by us — [CLIENT TO CONFIRM: payment provider used in the pharmacy and online]
• Emails, letters, text messages and call notes between you and the clinic
• CCTV images, where CCTV is in use on the premises — [CLIENT TO CONFIRM: whether CCTV is in use, and its retention period]

Website information

When you use this website we may collect technical information such as your device type, browser, approximate location and the pages you visit. See our cookie policy for the detail.

03Where your information comes from#

Most of the information we hold comes directly from you — from the forms you complete, what you tell the pharmacist in your consultation, and messages you send us.

We may also receive information about you from:

• your GP practice or another healthcare provider, where you have asked us to request it or have consented to it being shared;
• NHS services, where we provide an NHS-commissioned service to you;
• a laboratory, where a sample taken at the clinic has been analysed;
• a person acting on your behalf, such as a parent, carer or someone with lasting power of attorney.

04How we use your information, and our lawful bases#

We only use your personal information where the law allows us to. The lawful bases we rely on under Article 6 of the UK GDPR are:

• Article 6(1)(b) — contract. To provide the service you have booked and paid for: taking the booking, carrying out the consultation, supplying treatment where appropriate and dealing with aftercare.
• Article 6(1)(c) — legal obligation. To meet duties placed on a registered pharmacy, such as record-keeping for medicines, reporting suspected adverse drug reactions, and complying with tax and company law.
• Article 6(1)(f) — legitimate interests. To run and improve the clinic safely: managing appointments, preventing missed appointments, keeping the premises secure, dealing with complaints, defending legal claims, and basic website analytics. We balance this against your interests and rights.
• Article 6(1)(a) — consent. For anything you have separately opted in to, such as marketing emails. You can withdraw consent at any time.

Health information

For health and other special category information we additionally rely on:

• Article 9(2)(h) — the provision of health care and treatment, and the management of health care services. This applies because the information is handled by, or under the responsibility of, a health professional who is subject to a duty of confidentiality (here, our pharmacists, who are registered with the GPhC). This is supported in UK law by Schedule 1, Part 1, paragraph 2 of the Data Protection Act 2018.
• Article 9(2)(c) — protecting your vital interests, in an emergency where you cannot give consent.
• Article 9(2)(f) — establishing, exercising or defending legal claims.
• Article 9(2)(a) — your explicit consent, where we ask for it, for example before sending your records to your GP.

We do not use your information to make any decision about you by automated means alone, and we do not use it for profiling that produces legal or similarly significant effects.

05Appointment messages and marketing#

We may contact you about an appointment you have booked — confirmations, reminders, changes and results-related messages. These are part of providing the service, not marketing.

We will only send you marketing about our services if you have asked us to, or where the law allows us to contact an existing customer about similar services. Every marketing message includes a way to unsubscribe, and you can also opt out at any time by calling 01543 682921 or emailing chasetownpharmacy@medicatepharma.co.uk.

Marketing tools currently in use: [CLIENT TO CONFIRM: email/SMS marketing platform, if any].

06Who we share your information with#

We do not sell your information, and we do not share it with anyone who does not need it. We may share it with:

• Your GP, where you consent — for example so that a vaccination or a test result is added to your NHS record. We will ask you before we do this.
• NHS bodies, including the UK Health Security Agency and NHS England, where we provide an NHS-commissioned service or where there is a public health or legal requirement to notify them.
• The MHRA, where a suspected side effect is reported through the Yellow Card scheme. Reports can be made without identifying you, but some reports include clinical details.
• Laboratories, where a sample taken at the clinic is analysed — [CLIENT TO CONFIRM: laboratory partner(s) used for blood testing].
• Our suppliers (data processors), who act only on our instructions under a written contract: our booking system, clinical record system, IT support, and website hosting — [CLIENT TO CONFIRM: booking system and clinical record system providers].
• Regulators and professional bodies, such as the GPhC or the Information Commissioner's Office, where we are required to.
• Our professional advisers and insurers, where necessary for a claim or a legal obligation.
• The police, courts or other public bodies, where we are legally required to disclose information or where there is an overriding public interest, such as a serious safeguarding concern.

07How long we keep your records#

We keep your records for no longer than we need them. Different records have different retention periods:

• Clinical records (consultation notes, vaccinations given, test results): [CLIENT TO CONFIRM: clinical record retention period — this should follow the retention schedule the clinic works to, for example the Records Management Code of Practice for Health and Social Care]
• Private prescription and medicines records: kept for the period required by medicines legislation — [CLIENT TO CONFIRM: retention period applied in the pharmacy]
• Financial and accounting records: usually six years from the end of the financial year they relate to, to meet HMRC and company law requirements
• Complaints records: [CLIENT TO CONFIRM: complaints record retention period]
• CCTV footage: [CLIENT TO CONFIRM: CCTV retention period, if CCTV is in use]
• Marketing preferences: until you unsubscribe, plus a short record of your opt-out so that we do not contact you again

When a record reaches the end of its retention period it is securely destroyed, or deleted from our systems.

08Keeping your information secure#

We take appropriate technical and organisational measures to protect your information, including access controls and passwords, locked storage for paper records, encryption where appropriate, staff training on confidentiality, and written agreements with the suppliers who process data for us.

Consultations take place in a private consultation room. If you would like something discussed away from the counter, please just ask.

No system can be completely secure. If a personal data breach happens that is likely to result in a risk to your rights and freedoms, we will report it to the Information Commissioner's Office within 72 hours of becoming aware of it, and we will tell you directly where the law requires it.

09Sending information outside the UK#

We aim to keep your information in the UK. Some of the suppliers we use may store or access data outside the UK — for example a website or email provider with servers in the European Economic Area or the United States.

Where that happens, we make sure the transfer is protected by one of the safeguards allowed by UK data protection law: UK adequacy regulations, the International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses.

Suppliers that store data outside the UK: [CLIENT TO CONFIRM: whether any supplier stores or accesses data outside the UK, and which].

10Your rights#

Under the UK GDPR you have the right to:

• be informed about how we use your information — that is what this policy is for;
• access a copy of the information we hold about you (a subject access request);
• have inaccurate information corrected;
• have information erased in some circumstances — this right is limited where we must keep clinical records;
• restrict how we use your information while a concern is being looked into;
• object to processing we carry out under legitimate interests, and to direct marketing at any time;
• data portability — receive information you gave us in a machine-readable format, where processing is based on consent or contract;
• withdraw consent at any time, where we relied on your consent;
• not be subject to automated decision-making that has a legal or similarly significant effect. We do not do this.

To exercise any of these rights, contact us at chasetownpharmacy@medicatepharma.co.uk or call 01543 682921. We may ask you for proof of identity so that we do not disclose your information to the wrong person.

There is normally no charge. We will respond within one month, as the law requires. If your request is complex we may extend this by up to two further months and will tell you if we do.

11Cookies and this website#

This website uses cookies and similar technologies. Non-essential cookies are only set where you have agreed to them. What we use, and how to turn cookies off in your browser, is set out in our cookie policy.

12If you are unhappy with how we use your information#

Please tell us first — it is usually the quickest way to put something right. Contact chasetownpharmacy@medicatepharma.co.uk or call 01543 682921. Our full complaints route is on the complaints page.

You also have the right to complain to the Information Commissioner's Office, the UK data protection regulator, at any time:

• Website: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

Complaining to the ICO does not affect your right to take legal action, and it will not affect the care you receive from us.

13Changes to this policy#

We review this policy when our services change, when we start using a new supplier, or when the law changes. The date it was last updated is shown at the top of this page. If we make a significant change we will make that clear on the website.