Skip to main contentSkip to footer
FREE PRESCRIPTION DELIVERY SERVICE
7 Days a Week

Privacy Policy

Data controller Script Supply Ltd, trading as Felling Pharmacy

Company number          17065223 (registered in England and Wales)

Registered office            8 Waverley Road, Gateshead, Tyne & Wear, NE9 7TU

Pharmacy premises      4 Booth Street, Gateshead, Tyne & Wear, NE10 9BF

GPhC premises registration     9013342

Superintendent pharmacist     Hamza Khalil, GPhC registration number 2215833

Data security lead          Hamza Khalil, as recorded in our NHS Data Security and Protection Toolkit submission

NHS organisation code               Pending

ICO registration              pending

Website              www.fellingpharmacy.co.uk

Script Supply Limited owns and operates Felling Pharmacy, a pharmacy registered with the General Pharmaceutical Council at 4 Booth Street, Gateshead, Tyne and Wear, NE10 9BF. We dispense NHS and private prescriptions, supply medicines over the counter and deliver medicines to patients.

Handling information about your health is central to what we do, and the law treats that information as deserving the highest level of protection. This notice explains, in plain terms, what information we hold about you, where it comes from, what we do with it, who else sees it, how long we keep it, how we keep it safe and what rights you have. We have written it to meet our obligations under the UK General Data Protection Regulation and the Data Protection Act 2018, our professional obligations under the standards set by the General Pharmaceutical Council, and the common law duty of confidence that every healthcare professional owes their patients.

We are the controller of the information described in this notice. That means we decide why and how it is used, and we are legally accountable for it.

1.1 Who this notice applies to

This notice applies to you if you are any of the following.

  • A patient who has an NHS or private prescription dispensed by us, whether you collect it from the pharmacy or we deliver it to you.
  • A customer who buys a medicine or other product over our counter, or who asks our team for advice.
  • Someone who uses one of our NHS or private services at the pharmacy, such as Pharmacy First, a blood pressure check or a medicines review.
  • A carer, parent, representative or nominated person collecting or ordering on someone else’s behalf.
  • A visitor to our website or our premises.
  • Someone who contacts us with a question, a compliment or a complaint.
  • A supplier, contractor or job applicant.

1.2 What this notice does not cover

This notice does not cover what other organisations do with your information under their own responsibility. It also does not cover websites you reach by following a link from ours.

  1. We do not record telephone calls. Calls to and from the pharmacy are not recorded. Where a call matters clinically, a member of our team writes a note of it in your record.
  2. The information we hold about you
Category What it includes
Identity information Your name, title, date of birth, gender, and where relevant your NHS number and your GP practice.
Contact information Your home address, delivery address, email address, telephone and mobile numbers, and your preferred way of being contacted.
Health and clinical information Your medical history, diagnosed conditions, symptoms, allergies and intolerances, the medicines you take including those prescribed elsewhere, measurements such as height, weight and blood pressure where relevant to a treatment, the clinical checks our pharmacists carry out, notes of advice we give you, records of any intervention we make, and records of any occasion on which we decide not to supply a medicine.
Prescription and dispensing information NHS and private prescriptions, our digital private prescription register, your electronic patient medication record, and the record of each supply we make to you including the name of the medicine, its strength, its form, the quantity, the directions, the date of supply and where it was delivered. Also our record of the sale and supply of prescription only medicines, controlled drug records, repeat and repeat dispensing records, and records of emergency supplies.
Service records Records of NHS and private services we provide at the pharmacy, such as Pharmacy First consultations, New Medicine Service consultations, blood pressure checks and medicines reviews.
Communications Emails, letters, text messages, messages through our website or social media, and notes our team makes of telephone calls and face-to-face conversations with you.
Delivery information The address you asked us to deliver to, your delivery instructions, proof of delivery, and any record of a failed or refused delivery.
Technical information Your IP address, the type and version of your browser and device, your operating system, your general location derived from your IP address, and your time zone setting.
Usage information The pages you visit on our website, how long you spend on them, what you click on, the site or search term that brought you to us, and errors you encounter.
Feedback Reviews, survey answers, compliments and complaints, including anything you tell us about the outcome of a treatment.
CCTV Images of you captured by the CCTV system at our premises.

Special category information. Anything that reveals something about your health is “special category” information under the UK GDPR and attracts extra protection. This includes the obvious, such as a diagnosis, but also the less obvious, such as the name of a medicine we have dispensed for you, because a medicine can reveal a condition. Health information is handled by, or under the direct responsibility of, healthcare professionals who are bound by a legal duty of confidentiality.

What we do not collect. We do not ask about your race, ethnic origin, religion, political opinions, trade union membership, sex life or sexual orientation, and we do not collect genetic or biometric information, unless a particular NHS service requires it and you have been told so at the time, or unless it is clinically relevant to a treatment you have asked for and you have chosen to tell us. We do not store your full payment card number, and we do not collect criminal offence information about patients.

5. Where your information comes from

  • From you: When you hand in a prescription, order a repeat, speak to our team in person or by telephone, email or message us, complete a form or buy something from us.
  • From your GP practice, hospital or another prescriber: Prescriptions, and information we ask for or give when we need to clarify a prescription, resolve a query or tell them about a supply we have made.
  • From NHS systems: The NHS Spine and the Electronic Prescription Service, where an NHS prescription has been sent to us electronically, and your Summary Care Record, which our pharmacists may view where it is necessary for your care and, other than in an emergency, with your permission.
  • From NHS commissioning bodies: Where you have been referred to us for a service, or where we are told you are eligible for one.
  • From someone acting for you: A carer, family member, representative or care home, where that is appropriate and lawful.
  • Automatically: Through cookies and similar technologies when you use our website

6. Why we use your information, and our lawful bases

We only use your information where the law allows. In each case we rely on a lawful basis under Article 6 of the UK GDPR and, where health information is involved, an additional condition under Article 9 of the UK GDPR together with a condition in Schedule 1 to the Data Protection Act 2018.

What we do Information used Lawful basis
Dispensing a prescription, carrying out the clinical and legal checks, labelling and supplying the medicine, and contacting the prescriber where we need to Identity, contact, health and clinical, prescription and dispensing, images Article 6(1)(c), because the law requires us to dispense in a particular way and to keep records, and Article 6(1)(b) where we have a contract with you. Article 9(2)(h), the provision of health care and treatment, with paragraph 2 of Schedule 1 to the Data Protection Act 2018. The information is handled by or under the responsibility of health professionals who owe a duty of confidentiality.
Providing NHS services at the pharmacy, including Pharmacy First, New Medicine Service and other commissioned services Identity, contact, health and clinical, service records Article 6(1)(c) legal obligation and Article 6(1)(e) performance of a task in the public interest. Article 9(2)(h) with paragraph 2 of Schedule 1 to the Data Protection Act 2018.
Supplying medicines over the counter and giving advice, including checking that a pharmacy medicine is suitable for you Identity, health and clinical Article 6(1)(c) legal obligation and Article 6(1)(f) legitimate interests in supplying medicines safely. Article 9(2)(h).
Delivering your medicines, arranging redelivery, and dealing with a delivery that goes wrong Identity, contact, delivery, transaction Article 6(1)(b) performance of a contract and Article 6(1)(c) legal obligation to supply the medicine to the right person.
Taking payment, issuing refunds and keeping our accounts Identity, contact, transaction, account Article 6(1)(b) performance of a contract and Article 6(1)(c) legal obligation for tax and company law purposes.
Verifying your identity and your age, and preventing fraudulent, duplicate or unsafe repeat orders Identity, contact, account, transaction, technical Article 6(1)(c) legal obligation and Article 6(1)(f) legitimate interests in protecting our patients and our business. Article 9(2)(h) where clinical judgement is involved.
Answering your questions, handling complaints, and dealing with requests you make under data protection law Identity, contact, communications, health where relevant Article 6(1)(c) legal obligation and Article 6(1)(f) legitimate interests in running our business properly. Article 9(2)(h) where health information is involved.
Meeting our regulatory and professional obligations, including record keeping required by the General Pharmaceutical Council, the Human Medicines Regulations 2012, the Misuse of Drugs Regulations 2001 and our NHS terms of service, and cooperating with inspections and audits All categories as relevant Article 6(1)(c) legal obligation. Article 9(2)(h) and Article 9(2)(i), the public interest in ensuring high standards of quality and safety of health care and of medicinal products.
Reporting suspected adverse drug reactions through the Yellow Card scheme, reporting patient safety incidents, and acting on medicines recalls and safety alerts Identity, contact, health, dispensing Article 6(1)(c) legal obligation. Article 9(2)(i) public interest in the area of public health.
Clinical governance, incident investigation, near miss recording, audit and improving the safety of what we do Health, clinical and dispensing information, de-identified wherever it is possible to do so Article 6(1)(f) legitimate interests in providing a safe service. Article 9(2)(h), the management of health care systems and services.
Claiming payment and reimbursement for NHS services, and supporting the checks NHS bodies carry out Identity, service records, dispensing Article 6(1)(c) legal obligation and Article 6(1)(e) public task.
Operating CCTV at our premises for the safety of patients, staff, medicines and stock CCTV images Article 6(1)(f) legitimate interests in security and the prevention of crime, and Article 6(1)(c) in relation to the secure storage of controlled drugs.
Running, securing and maintaining our website and IT systems, diagnosing faults and defending against attack Technical, usage Article 6(1)(f) legitimate interests in keeping our systems secure and available.
Understanding how our website is used so that we can improve it Technical, usage Article 6(1)(a) consent, given through our cookie banner.
Sending you marketing about our products and services by email or text message Identity, contact, marketing preferences Article 6(1)(a) consent. We market to patients only where they have given us permission, and we do not rely on the soft opt-in.
Advertising our services online and measuring whether that advertising works Technical and marketing information only. We do not use health or clinical information for advertising. Article 6(1)(a) consent, given through our cookie banner.
Asking for feedback and publishing reviews you have agreed we may publish Identity, contact, feedback Article 6(1)(f) legitimate interests in improving our service, and Article 6(1)(a) consent before anything identifying you is published.
Establishing, exercising or defending a legal claim, and dealing with our insurers All categories as relevant Article 6(1)(f) legitimate interests in protecting our legal position. Article 9(2)(f), the establishment, exercise or defence of legal claims.
Protecting children and adults at risk, and preventing or detecting crime or serious harm All categories as relevant Article 6(1)(c) legal obligation, Article 6(1)(d) vital interests where someone’s life is at risk, and Article 6(1)(f). Article 9(2)(b), 9(2)(c) or 9(2)(g) as appropriate, with the relevant condition in Schedule 1 to the Data Protection Act 2018.
  • Where we rely on legitimate interests: We have weighed our interests against your interests, rights and freedoms and concluded that ours are not overridden. You can ask us for our assessment, and you have the right to object.
  • Where we rely on consent: You can withdraw it at any time. That does not affect anything we did while the consent was in force. Withdrawing consent to marketing or to analytics cookies has no effect on the pharmacy services we provide to you.
  • Information you have to give us: Some information we are required by law to collect, and some we need in order to fulfil a contract with you. If you do not give it to us we will not be able to dispense your medicine or provide the service. We will tell you at the time if that is the case.
  • Using your information for a new purpose: If we ever need to use your information for something not described here, we will tell you first and explain the lawful basis, unless the law allows or requires us to act without telling you.

7. NHS services and the National Data Opt-Out

Where we provide services for the NHS, we handle your information in line with NHS information governance requirements as well as data protection law. NHS bodies including NHS England, the NHS Business Services Authority and your Integrated Care Board receive information about the NHS services we provide to you, so that prescriptions can be processed, payments verified and services assured.

The NHS National Data Opt-Out lets you stop your confidential patient information being used for research and planning, as opposed to your own care. We apply the national data opt-out where it is relevant to information we hold. It does not affect information used to provide your care, and it does not affect information we are required by law to hold or disclose. You can set or change your choice at www.nhs.uk/your-nhs-data-matters or by calling 0300 303 5678.

8. Photographs and images

We will not publish an image of you, use it for training, or use it in any marketing, without asking you separately and obtaining your written consent, which you are free to refuse and free to withdraw. Please do not send us images through social media or other unsecured channels.

9. Automated decision-making and profiling

Our systems carry out automated checks. Our dispensing system flags interactions, allergies, doses outside the expected range and duplicate supplies. Our ordering process carries out automated fraud and identity checks. These checks support our pharmacists, they do not replace them.

We do not make any decision that produces a legal effect concerning you, or that similarly significantly affects you, based solely on automated processing. A pharmacist reviews every supply, and a person reviews any automated refusal before it takes effect. If you believe a decision has been reached unfairly, you can ask us to review it, ask for a person to look at it again, and put your own point of view.

10. Artificial intelligence

We do not use your personal or health information to train artificial intelligence or machine learning models, and we do not provide your information to any third party to train theirs.

11. Who we share your information with

We do not sell your personal information, and we never sell, rent or trade health information. We share only what is necessary, only with organisations that have a proper reason to receive it, and only where the law permits.

Who Why, and what they receive
Your GP practice, hospital or other treating clinician To support safe prescribing and continuity of care, to resolve a prescription query, and to tell them about a supply we have made where that is necessary for your care. We will not contact your GP or other health professional if you do not provide us consent first. This will be given or not given when you sign up.
NHS bodies, including NHS England, the NHS Business Services Authority, NHS Digital and your Integrated Care Board For the NHS services we provide: prescription processing, reimbursement, payment verification, service assurance and public health programmes.
Our payment service provider To take payment and make refunds. Card details are entered directly into their systems, which meet the Payment Card Industry Data Security Standard, and are not stored by us.
Our IT, hosting, pharmacy system, communications and website suppliers To run our patient medication record system, our website, our email and text messaging. They act as our processors and may use your information only on our written instructions.
Our medicines wholesalers and manufacturers Only where necessary to deal with a product defect, a recall or a safety alert affecting a medicine supplied to you.
Regulators and official bodies, including the General Pharmaceutical Council, the Medicines and Healthcare products Regulatory Agency, the Care Quality Commission where it applies, the Information Commissioner’s Office, the NHS Counter Fraud Authority and the local Controlled Drugs Accountable Officer To meet our legal and regulatory obligations, to report adverse drug reactions and patient safety incidents, and to respond to inspections, audits and investigations. We use the National Yellow Card scheme. No personal data will be provided to them.
Our insurers, including NPA Insurance Ltd, and our professional advisers, solicitors, accountants and auditors To obtain advice, to notify and manage a claim or an incident, and to meet our statutory obligations. They are bound by their own duties of confidentiality. Their privacy policy can be seen at npa.co.uk/insurance/insurance-privacy-policy.
Law enforcement, courts, coroners and other public authorities Where we are required or permitted by law to disclose, including to prevent or detect crime, to protect someone from serious harm, to respond to a court order, or to assist a coroner.
Safeguarding authorities, including the local authority and the police Where we have a concern that a child or an adult at risk is being harmed, in line with our safeguarding duties.
A buyer or successor If we sell, restructure or transfer the business or any part of it, information transfers subject to the same protections and we will tell you.

Every organisation that handles your information on our behalf does so under a written contract requiring it to keep the information secure, to use it only for the purpose we specify, to impose the same duties on anyone it engages, and to return or destroy the information when it is no longer needed.

 12. Discretion in how we deliver and package

We know that the medicines we supply can reveal something private about you. Our parcels are plain, they carry no branding that identifies the contents or the condition being treated, and no clinical information appears on the outside. Delivery drivers are told only where to deliver and what your delivery instructions are. We comply with all regulations for data protection as per requirements set out in our privacy policy.

13. Marketing

We send marketing to patients only where you have given us your permission to do so. We ask for that permission separately from anything else, we do not pre-tick any box, and we do not treat buying a medicine from us as permission to market to you. The law would in some circumstances allow us to market to an existing customer without asking first, under what is known as the soft opt-in, but we have chosen not to rely on it. If you have not told us we may contact you, we will not.

Opting out of marketing does not stop messages we need to send you about a delivery, your medicine or a medication safety matter. Those are service messages, not marketing.

We do not use your health information for advertising. We do not disclose your health, clinical, consultation, prescription or dispensing information to advertising platforms, social media networks, data brokers or advertising networks, and we do not use it to build advertising audiences or lookalike audiences. We do not sell your personal information to anyone, for any purpose.

14. Reviews, surveys and feedback

We may invite you to review our service or take part in a short survey. Taking part is entirely voluntary and declining has no effect on the service you receive. If a review you write would identify you, we will not publish it without your consent. Please do not include clinical details about yourself in a public review.

15. Cookies and similar technologies

A cookie is a small file placed on your device when you visit a website. We also use similar technologies such as pixels, tags and browser storage. We group them into four types.

  • Strictly necessary. These make the site work: keeping you signed in, remembering your basket, balancing load and protecting against fraud and attack. They do not need your consent and cannot be switched off.
  • These remember choices you have made, such as your preferences or your region.
  • These tell us how many people visit, which pages they use, and where they run into problems.
  • These measure how well our advertising works and help show you relevant adverts elsewhere.

Apart from strictly necessary cookies, nothing is set until you consent through the banner shown on your first visit. You can change or withdraw your choices at any time through the “Cookie settings” link in the footer of every page.

16. How we keep your information safe

We have technical and organisational measures in place to protect your information against loss, destruction, alteration and unauthorised access or disclosure. They include the following.

  • Every page of our website that collects or displays personal information, and every page relating to orders and payments, is served over an encrypted TLS connection. Personal and clinical information is encrypted in transit and when stored. – AJ to check this?
  • Access to patient records is limited to those members of our team who need it to do their job. Access is through individual named accounts with multi-factor authentication, and it is logged so that we can see who viewed a record and when.
  • Payment card details are captured directly by our payment provider, which is certified to the Payment Card Industry Data Security Standard. We never see or store your full card number.
  • Our premises are secured, controlled drugs are held in a compliant cabinet, and paper records are held in areas that patients and visitors cannot access.
  • All members of our team complete information governance and confidentiality training when they join and refresh it annually, and are bound by contractual confidentiality obligations. Our pharmacists are additionally bound by professional duties of confidentiality enforced by the General Pharmaceutical Council.
  • We maintain written standard operating procedures covering information governance, access control, confidentiality, secure disposal, business continuity and incident response, and we test our backups.
  • We complete the NHS Data Security and Protection Toolkit, which is the assessment the NHS uses to confirm that an organisation is handling personal information correctly and meeting the national data security standards.
  • We have a procedure for dealing with a suspected personal data breach. Where the law requires it we will report a breach to the Information Commissioner’s Office within 72 hours of becoming aware of it, and we will tell you without undue delay where a breach is likely to result in a high risk to your rights and freedoms.

No method of sending information over the internet is completely secure. Please do not send clinical information to us through social media or other unsecured channels. Use your account, our secure forms, the telephone, the post, or speak to us in the pharmacy.

17. How long we keep your information:

We keep your information only for as long as we need it, and for as long as the law and our professional obligations require. Where more than one period applies to the same record, we apply the longest. The main periods are below.

Record How long Why
Record of the sale and supply of prescription only medicines Two years from the date of the last entry Regulation 253(5) of the Human Medicines Regulations 2012
Private prescriptions, other than for controlled drugs Two years Human Medicines Regulations 2012 and Royal Pharmaceutical Society guidance
Controlled drugs register, requisitions and destruction records Two years from the date of the last entry Misuse of Drugs Regulations 2001
Electronic patient medication record and private prescription register, including the medicines supplied to you, their strength, form and quantity Eight years from the date of supply, and longer where a period below requires it NHS Records Management Code of Practice 2021, applied on top of the statutory minimums
Clinical records of a consultation or service provided to an adult, including Pharmacy First Eight years after the last entry NHS Records Management Code of Practice 2021
Clinical records relating to a child or young person Until their 25th birthday, or their 26th if the last entry was made when they were 17 NHS Records Management Code of Practice 2021
Records kept for NHS reimbursement and service assurance Three years NHS terms of service and commissioner requirements
Adverse drug reaction reports and patient safety incident records Ten years Pharmacovigilance and clinical governance requirements
Order, payment, accounting and tax records Six years after the end of the financial year to which they relate Companies Act 2006 and HMRC requirements
Marketing preferences and opt-out records Until you withdraw consent, then on a suppression list indefinitely so that we do not contact you again Privacy and Electronic Communications Regulations 2003
Correspondence, enquiries and complaints Three years after the matter is closed, or longer where it concerns a clinical incident, a claim or a regulatory matter Legitimate interests and defence of legal claims
CCTV footage Two weeks, unless an image is needed for an investigation or a legal claim Legitimate interests and ICO CCTV guidance
Website analytics and advertising information As stated in our cookie table, and no longer than 26 months Consent
Job applications from unsuccessful candidates Six months after the decision Legitimate interests and defence of discrimination claims

When information is no longer needed we delete it securely or anonymise it so that it can no longer be connected to you. Paper records are destroyed by confidential shredding.

18. Your rights

You have the following rights under the UK GDPR and the Data Protection Act 2018. Some apply only in particular circumstances.

  • The right to be informed. To know what we do with your information, which is what this notice is for.
  • The right of access. To get a copy of the information we hold about you, and information about how we use it. This is often called a subject access request.
  • The right to rectification. To have inaccurate information corrected and incomplete information completed.
  • The right to erasure. To have information deleted, subject to the important limits.
  • The right to restrict processing. To have us pause our use of your information while a concern you have raised is looked into.
  • The right to object. To object to our use of your information where we rely on legitimate interests, and to object to direct marketing at any time, which we will always honour.
  • The right to data portability. Where we process information you gave us by automated means on the basis of consent or a contract, to receive it in a commonly used machine-readable format or have it sent to another organisation.
  • The right to withdraw consent. Where we rely on your consent, at any time.
  • Rights relating to automated decisions. To ask for human involvement.
  • The right to complain. To the Information Commissioner’s Office.

To exercise a right, contact us.

19. Why we do not delete records of medicines we have supplied

People are sometimes surprised that a pharmacy cannot simply delete their record on request, so it is worth setting out plainly.

We do not erase clinical records of medicines we have supplied. Our private prescription register and your electronic patient medication record are retained for eight years from the date of supply, in line with the period the NHS Records Management Code of Practice sets for an adult clinical record, and longer where a period in section 16 requires it. We keep them because the law obliges us to and because a record of what medicine a person has taken can matter years later, to another prescriber, to a coroner, or to the person themselves.

The right to erasure in Article 17 of the UK GDPR does not apply where processing is necessary for compliance with a legal obligation, for reasons of public interest in the area of public health, for the purposes of health care under Article 9(2)(h), or for the establishment, exercise or defence of legal claims. Our dispensing records fall into those exceptions. We will therefore refuse a request to delete them, and we will tell you in writing why and what you can do about it.

There is a great deal we can still do. We will delete anything we are not required to keep, and limit who inside the pharmacy can open your record. Where you dispute the accuracy of a clinically significant entry, we record your account of it alongside the entry rather than removing the entry, which is what the NHS and the GPhC expect of a health record.

19.1 Keeping a record is not the same as sharing it: Holding a record for eight years does not mean anyone can ask us for it. Your record is confidential, under data protection law and under the separate common law duty of confidence that our pharmacists owe you. We do not disclose it to a family member, an employer, an insurer, a solicitor, a landlord or anyone else simply because they ask. The circumstances in which we may lawfully disclose without your consent are narrow, and they are set out below.

When we may disclose without your consent The legal basis we rely on
Where a court orders it, or a statute requires it, for example a request from a coroner or a warrant Article 6(1)(c) of the UK GDPR, a legal obligation, with Article 9(2)(f) where the disclosure relates to legal proceedings, or Article 9(2)(h) where it relates to your care.
Where the police or another law enforcement authority ask us for information to prevent or detect a crime, or to apprehend or prosecute an offender Article 6(1)(f) legitimate interests, with Article 9(2)(g) substantial public interest and the condition in paragraph 10 of Schedule 1 to the Data Protection Act 2018, which covers disclosure for the prevention or detection of an unlawful act where asking for consent would prejudice that purpose. We may in addition rely on the crime and taxation exemption in paragraph 2 of Schedule 2 to the Data Protection Act 2018, which allows us to set aside some of our usual transparency duties where complying with them would be likely to prejudice a criminal investigation.
Where a child or an adult at risk may be being harmed, abused or neglected Article 6(1)(c) legal obligation and Article 6(1)(d) vital interests, with Article 9(2)(b), 9(2)(c) or 9(2)(g), and the safeguarding condition in paragraph 18 of Schedule 1 to the Data Protection Act 2018.
Where someone’s life is in immediate danger and they cannot consent Article 6(1)(d) and Article 9(2)(c), vital interests.
Where a medicine we supplied must be reported for safety reasons, for example an adverse drug reaction or a recall Article 6(1)(c) legal obligation, with Article 9(2)(i), the public interest in the area of public health and in ensuring high standards of safety of medicinal products.
Where our regulator, the NHS Counter Fraud Authority or the Controlled Drugs Accountable Officer requires it as part of an inspection or investigation Article 6(1)(c) and Article 6(1)(e), with Article 9(2)(h) and Article 9(2)(i).
Where we need to establish, exercise or defend a legal claim, or notify our insurers of an incident Article 6(1)(f) legitimate interests, with Article 9(2)(f), legal claims.

None of these is a blanket permission. A police request does not compel us to hand over a record: it is for us to decide, each time, whether the disclosure is necessary and proportionate, and we will refuse where it is not. We disclose the minimum information needed, to the person entitled to receive it, and we record what we disclosed, to whom, on what basis and why. Where we hold an appropriate policy document because the condition we rely on requires one, we maintain it and will provide it to the Information Commissioner on request. Wherever it is safe, lawful and practical, we will tell you before we disclose, or afterwards if telling you first would defeat the purpose.

20. Carers, representatives and people acting for you

You may ask someone to collect a prescription, place an order or speak to us for you. We will check that they have your authority and we will share only what they need in order to do what you have asked. We do not discuss your care with a family member or friend who has no authority, however well meant the enquiry. Where you lack capacity to make a decision, we act in your best interests under the Mental Capacity Act 2005 and involve the person with lasting power of attorney or court-appointed deputy where there is one.

21. Confidentiality and safeguarding

Everything you tell us is held in confidence, both under data protection law and under the separate common law duty of confidence that our pharmacists owe you. There are narrow circumstances in which we may disclose confidential information without your consent: where you or someone else is at risk of serious harm, where a child or an adult at risk may be being abused or neglected, where we are required to by a court or by law, or where there is an overriding public interest. We disclose the minimum necessary, to the right person, and we record what we disclosed and why. Wherever it is safe and practical to do so, we will tell you first.

22. CCTV at our premises

We operate CCTV at the pharmacy for the safety of patients, staff and stock, and to meet the security requirements that apply to the storage of controlled drugs. Signs are displayed so that you know when you are in a monitored area. Cameras do not cover any area where you would reasonably expect privacy, such as a consultation room or a toilet. Footage is held securely, viewed only by authorised people and only when there is a proper reason, and retained for the period shown in section 16. You have the right to ask for a copy of footage of yourself.

There are no CCTV cameras in any consultation rooms.

 23. Suppliers, contractors and job applicants

If you supply goods or services to us, we hold your business contact details, the details of the people who deal with us, your bank details for payment, and where relevant evidence of your insurance, registration and right to work. We use it to manage the contract, to pay you and to meet our own regulatory obligations, relying on Article 6(1)(b) and Article 6(1)(c). We keep it for six years after the end of the relationship.

If you apply to work with us, we hold your application, CV, references, right to work evidence, professional registration details and interview notes. For roles that qualify, we obtain a Disclosure and Barring Service check, and we handle criminal offence information under Article 10 of the UK GDPR with the relevant condition in Schedule 1 to the Data Protection Act 2018, in line with our written policy. We keep applications from unsuccessful candidates for six months and then delete them.

24. Changes to this notice

We review this notice regularly. Where a change materially affects how we use your information, we will update the notice. Previous versions are available on request.

25. How to complain

If you are unhappy with how we have handled your information, please tell us first using the details in section 2, so that we have the chance to put things right. We will acknowledge your complaint promptly and tell you who is dealing with it.

You can also complain to the Information Commissioner’s Office at any time, and you do not have to come to us first.

Information Commissioner’s Office Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline 0303 123 1113
Website www.ico.org.uk

If your complaint is about the pharmacy service itself rather than your information, you can contact the General Pharmaceutical Council at www.pharmacyregulation.org. If it concerns an NHS service we provided, you can also complain to NHS England.