Privacy Policy

What we collect

We collect only what we need to assess you safely and get your order to you.

• Your name, date of birth, email address, phone number and delivery address
• Your consultation answers, including symptoms, medical history, medication and allergies
• Records of prescriptions issued, and of medicines dispensed to you including batch and expiry
• Order and payment records — card details are handled by our payment provider and never stored by us
• The result of an identity check, and the reference the checking service gives it
• A photograph of your ID, if you send us one for checking by hand — deleted once checked
• Technical information such as your IP address, used for security and fraud prevention

Our lawful basis

For health data, we rely on Article 9(2)(h) of the UK GDPR — processing necessary for the provision of health care and the management of health care systems — alongside Article 6(1)(b), performance of a contract with you.

For the identity check described below, we rely on Article 6(1)(c) — compliance with a legal obligation — because a pharmacy supplying medicines at a distance is required to satisfy itself of your identity. Only your name, date of birth and address are used for it; your consultation answers are never sent to a checking service.

Where we send you marketing, we rely on your consent, which you can withdraw at any time.

Checking who you are

Before we dispense a prescription-only medicine we have to be satisfied you are who you say you are. The General Pharmaceutical Council requires this of every pharmacy selling medicines at a distance, and it is as much for your protection as ours: it is what stops someone ordering medicine in your name, to your address.

For most treatments we do this quietly, without asking you for anything. We send your name, date of birth and address to a credit reference agency, which tells us whether those details match a real person at that address. It is an identity check, not a credit check. It does not look at your credit history, it does not affect your credit score, and it leaves no footprint a lender can see. We are told only whether each detail matched.

For some treatments, or if that check cannot confirm you, we will ask for photo identification instead. We will tell you if that is needed.

There are two ways that can happen. If you use the checking service, it keeps the document and we are told only the outcome. If instead you send a photograph of your passport, driving licence or other UK government-issued ID directly to us, we hold that image ourselves — encrypted, readable only by our pharmacy team, and every time one of them opens it we record who did and when.

We delete your document as soon as a pharmacist has checked it. If nobody has within 30 days, it is deleted anyway. We keep the outcome of the check and the fact that a document was seen; we do not keep the document.

We do not use these checks to decide anything about you other than whether your identity is confirmed.

Who sees your information

Your consultation is seen by the prescriber reviewing it and by the pharmacy team dispensing your order. Both are bound by professional duties of confidentiality.

We share your delivery details with the courier carrying your order, and payment details with our payment provider. We do not sell your data, and we do not share it with advertisers.

We contact your GP only with your agreement, or in the uncommon situation where a prescriber judges it necessary to protect you from serious harm.

How long we keep it

An identity document you send us is the exception to everything below: it is deleted as soon as a pharmacist has checked it, and in any event within 30 days. It is never kept for the ten years that health records are.

Health records, including consultations and dispensing records, are kept for ten years from your last interaction with us, in line with professional record-keeping requirements. Order and financial records are kept for six years for tax purposes.

After those periods, records are securely destroyed.

Your rights

Under the UK GDPR you have the right to:

• Ask for a copy of the information we hold about you
• Ask us to correct anything inaccurate
• Ask us to delete information, where we are not legally required to keep it
• Object to processing, or ask us to restrict it
• Ask for your data in a portable format
• Withdraw consent for marketing at any time

Security

Data is encrypted in transit and at rest. Access to consultation records is limited to staff who need it for your care, and every access and clinical decision is logged.

If a breach occurs that is likely to risk your rights and freedoms, we will tell you and the Information Commissioner's Office without undue delay.

Contact and complaints

Contact our data protection lead at support@formens.uk, or write to AJPharm Ltd, Ground Floor, Grosvenor House, 160 Gillett Road, Thornton Heath, CR7 8SN. If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.