Privacy Policy

About this policy

This policy explains what personal information Affection Meds collects, why we collect it, how long we keep it and what rights you have. We are the data controller for the information described here.

Controller: [COMPANY LEGAL NAME], [REGISTERED ADDRESS]. Data protection contact: [DPO / PRIVACY CONTACT EMAIL]. ICO registration: [ICO REGISTRATION NUMBER].

What we collect

Identity and contact details — your name, date of birth, delivery and billing address, email address and telephone number.

Health information — your consultation answers, the medicines you take, relevant conditions and allergies, and the prescribing decisions made about you. This is special category data and we treat it accordingly.

Order information — what you bought, when, and the batch and expiry of what we dispensed to you.

Payment information — we do not store your full card number. Payments are processed by our payment provider, which holds the card data.

Technical information — IP address, browser type and pages visited, used to keep the site secure and working.

Why we use it, and our legal basis

• To provide pharmacy services — for health data our basis is Article 9(2)(h) UK GDPR (provision of health care by a professional bound by a duty of confidentiality), with the associated condition in Schedule 1 of the Data Protection Act 2018.
• To fulfil your order — performance of our contract with you.
• To meet our legal duties — record-keeping required of a registered pharmacy, including under the Human Medicines Regulations 2012 and, where relevant, the Misuse of Drugs Regulations 2001.
• To keep the site secure and prevent fraud — our legitimate interests.
• To send marketing — your consent, which you may withdraw at any time.

We do not sell your data, and we never use your health information for advertising or targeting.

Who we share it with

We share only what is necessary, with: the prescribers who review your consultation; our delivery partner (name and address only); our payment provider; our IT and hosting suppliers under written contract; and your GP, but only where you have consented or where there is an overriding safety reason.

We may disclose information where the law requires it, or to protect someone from serious harm.

How long we keep it

We keep records of medicines supplied, and the consultation on which the supply was based, for the period required of a registered pharmacy — currently a minimum of two years for prescription records, and longer where other rules apply (for example records relating to controlled drugs). Marketing consent records are kept until you withdraw consent, plus a short period to evidence the withdrawal. Everything else is deleted when it is no longer needed.

Where it is stored

Your data is stored on servers within the UK or European Economic Area. If any supplier processes data outside that area, we put an approved safeguard in place, such as the International Data Transfer Agreement or UK Addendum.

Your rights

You have the right to be informed, and to request access, correction, erasure, restriction, portability, or to object to processing. You can also withdraw consent to marketing at any time. Some rights are limited where we are legally required to keep a pharmacy record — we will explain if that applies.

To exercise a right, contact [PRIVACY CONTACT EMAIL]. We respond within one month. If you are unhappy with how we handled your request you can complain to the Information Commissioner’s Office at ico.org.uk.

Cookies

We use cookies that are strictly necessary for the site to work — keeping you signed in and remembering your basket. These do not require consent.

Any analytics or marketing cookies are set only if you agree. You can change your mind at any time, and you can block or delete cookies in your browser settings, though the site may not work properly without the necessary ones.

Changes

If we make a significant change to this policy we will tell you. The date at the top of this page shows when it was last updated.