Privacy Policy

Who we are and how to reach us

We operate from Ground Floor, Row 60, 183a King Street, Great Yarmouth NR30 1LS. You can reach our team about this notice or about your personal information by phone on 01493 857888, by email at customercare@pharmacyexprezz.org.uk, or by writing to us at the address above.

Because we handle health information, protecting your privacy is central to how we work. We are registered with the Information Commissioner’s Office (ICO) as a data controller, and our registration reference is available on request.

The information we collect about you

Depending on how you interact with us, we may collect the following types of personal information.

Information you give us

• Identity and contact details, such as your name, date of birth, gender, address, email address and phone number
• Health and clinical information, such as your medical and medication history, symptoms, allergies, GP details, and records of the consultations and treatment we provide
• Booking and payment details, including the appointment information and payment details you provide through our booking system
• Your preferences, including marketing choices, and any reviews or feedback you give us

Information we collect automatically

• Technical and usage information about your device and how you use our website, collected through cookies and similar technologies. You can read more in our Cookie Policy.

Information from other sources

• Where it is relevant to your care, we may receive information from your GP surgery, the NHS or another healthcare provider, for example to support a prescription request or a Pharmacy First consultation.

How and why we use your information

We only use your personal information when the law allows us to. Most often we rely on one or more of the following legal bases: performing a contract with you, complying with a legal or regulatory obligation, our legitimate interests (where these are not overridden by your rights), or your consent. Because we provide health care, our use of your health information is also covered by the condition in Article 9(2)(h) of the UK GDPR, the provision of health and social care.

Your health information and confidentiality

As a pharmacy, we owe you a common law duty of confidence in addition to our duties under data protection law. We handle your clinical information in line with the professional standards set by the General Pharmaceutical Council and relevant NHS guidance.

We will never sell your personal information, and we will not use your health information for marketing.

Who we share your information with

We share your information only where it is necessary and lawful to do so. We may share it with:

• Your GP surgery and the NHS, for example to process a repeat prescription, an Electronic Prescription Service nomination, or an NHS service such as Pharmacy First
• Accredited laboratories and clinical partners, where you have a blood test or another sample analysed
• Our booking and payment provider, Halaxy, which processes appointment and payment information on our behalf
• Our website hosting and IT providers, who keep our systems running securely
• Our regulators, professional bodies and professional advisers, where we are required or permitted to share information
• The authorities, where we are legally obliged to do so, or to protect a person’s vital interests
• Anyone you ask us to share your information with

Where another organisation processes information on our behalf, we put a written contract in place that requires them to protect it and to use it only as we instruct.

Marketing and reviews

We will only send you marketing if you have asked us to. You can opt out at any time by using the unsubscribe link in our emails or by contacting us.

If you give us a review or testimonial, we may display it on our website together with your first name. If you would like us to update or remove it, just let us know and we will action this for you.

How long we keep your information

We keep your information only for as long as we need it. For clinical and pharmacy records, we follow the retention periods in the NHS Records Management Code of Practice. In general, this means we keep adult health records for at least eight years after your last contact with us, and records relating to a child until their 25th birthday.

We keep financial and transaction records for at least six years to meet tax and accounting requirements. Other information, such as general enquiries and marketing preferences, is kept for a shorter period and then securely deleted.

How we keep your information secure

We take the security of your information seriously. It is stored on secure servers in the United Kingdom and protected by appropriate technical and organisational measures, including access controls, encryption in transit, and staff confidentiality training. We limit access to your information to those who need it to do their job.

Storing and transferring your information

We aim to keep your information within the United Kingdom and the European Economic Area. Some of our providers, including our booking and payment provider, may process limited information within the European Economic Area. Where any information is transferred outside the UK, we make sure an appropriate safeguard recognised under UK data protection law is in place, such as an adequacy decision or standard contractual clauses.

Your data protection rights

You have a number of rights over your personal information. These include the right to:

• Be informed about how we use your information, as set out in this notice
• Access a copy of the information we hold about you, known as a subject access request
• Rectify information that is inaccurate or incomplete
• Erase your information in certain circumstances, which is limited where we have a legal duty to keep health records
• Restrict or object to how we use your information in certain circumstances
• Data portability, where we process your information by automated means based on consent or a contract
• Withdraw consent at any time, where we rely on your consent

To exercise any of these rights, please contact us using the details below. We will respond within one month. There is usually no charge, and we may need to confirm your identity first.

How to complain about our use of your data

We hope to resolve any concern about your information directly. If you are not satisfied, you have the right to complain to the Information Commissioner’s Office, the UK regulator for data protection.

You can contact the ICO at ico.org.uk, by phone on 0303 123 1113, or by post at Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

Changes to this notice

We may update this notice from time to time to reflect changes in our services or the law. The date at the top shows when it was last reviewed. Where changes are significant, we will make this clear on our website.