Privacy Policy
1. Who we are
Express Healthcare Ltd, trading as Pharmacy Online, is the data controller responsible for the personal information you give us through pharmacyonline.co.uk and our patient services. In this policy, "we", "us" and "our" mean Express Healthcare Ltd trading as Pharmacy Online.
| Detail | Value |
|---|---|
| Company number | SC704539 (registered in Scotland) |
| GPhC pharmacy registration | 9011378 |
| Superintendent Pharmacist | Umar Razzaq (GPhC 2064448) |
| ICO registration number | ZB266172 |
| Data Protection Officer | Karen Christie, 32 Welbeck Road, Glasgow, G53 7SD |
| Email (including data protection requests) | [email protected] |
You must be at least 18 years old to use our website and services. We do not knowingly collect personal information about children.
2. What information we collect
We only ask for personal information when we need it to provide a service you have requested, such as a consultation, an order, an account or a reply to your enquiry.
2.1 Information you give us
- Identity details: name, title, date of birth, age and sex.
- Contact details: postal address, email address and telephone numbers.
- Health information: your current health, medical history, medicines and treatments, and answers to our clinical consultation questions.
- Photographs and video you provide during consultations, and measurements derived from them (see section 4).
- A photograph of your identity document, used for identity checks (see section 4).
- Messages you send us, including to our prescribers, pharmacy team and customer care.
- Order and purchase history.
- Payment information, which is collected and processed by our payment service provider. We never see or store your full card details.
- Marketing preferences, survey responses and feedback.
- Information you provide when applying for a job with us.
Health information, and photographs used for clinical purposes, are special category data. We apply extra safeguards to them, described in sections 5 and 6.
2.2 Information we collect when you use our website
- Pages you view and links you follow.
- Your IP address and approximate location.
- Device, browser and operating system details.
- Account login details. Passwords are stored in hashed form and are never visible to our staff.
- A device identifier used for fraud prevention.
- Traffic data, web logs and similar technical data.
See section 11 for how we use cookies.
2.3 Information from other sources
- Identity verification and fraud-prevention services.
- Publicly available sources, such as the electoral roll or Companies House.
- Your GP or other healthcare providers, with your consent or where needed to provide our service (for example, fulfilling NHS prescriptions).
- Service providers we work with, such as payment processors and delivery companies.
When we receive information about you from a third party, we will tell you what we received and how we intend to use it.
3. How and why we use your information
We use your information only for the purposes below, each with a lawful basis under UK GDPR.
| Purpose | Lawful basis | Health data condition |
|---|---|---|
| Clinical consultations, prescribing and dispensing | Contract (Art 6(1)(b)) | Provision of health care (Art 9(2)(h)) |
| Managing your patient account | Contract; legitimate interests | Art 9(2)(h) where health data is involved |
| Processing orders, payments and delivery | Contract | Not applicable |
| Identity checks and fraud prevention | Legal obligation; legitimate interests | Not applicable |
| Repeat-medicine and adrenaline pen expiry reminders | Legitimate interests | Art 9(2)(h) |
| Test kit results and follow-up | Contract | Art 9(2)(h) |
| Sharing with your GP or consultant | Consent; contract | Art 9(2)(h) |
| Regulatory inspections and clinical audit | Legal obligation | Art 9(2)(h) and (i) |
| Marketing and newsletters | Consent | Not used |
| Messages about products similar to ones you bought | Legitimate interests (you can object at any time) | Not used |
| Improving our services, systems and staff training | Legitimate interests | Only where necessary, under Art 9(2)(h) |
| Anonymised statistical research | Legitimate interests | Data is anonymised |
| Responding to enquiries and complaints | Legitimate interests; contract | Art 9(2)(h) where relevant |
Our GPhC-registered prescribers review every consultation. If they need more information, they will contact you by email or telephone. If we cannot reach you by email or phone, we may write to your home address.
We will not use your information for a new purpose unless it is compatible with the original one, or we have told you and explained the lawful basis.
4. Photographs, video and identity images
Consultation photographs and video form part of your clinical record and are stored in our UK-hosted systems. ID document photographs are used only to verify your identity.
4.1 Consultation photographs and video
For some treatments we ask for photographs or video. For weight loss medication, for example, we ask for two full-body photographs to verify your eligibility. We will remind you at the point of capture that the image will be stored in your medical record, and tell you if a third party will process it.
Full-body photographs for weight loss treatment are analysed by a specialist body-measurement technology provider based in the United States, which returns body measurements to us. This provider:
- acts only on our instructions, as our data processor;
- does not receive your name or contact details with your photographs;
- automatically removes or blurs facial features;
- encrypts photographs in transit and at rest;
- permanently deletes photographs within 30 days of processing.
A GPhC-registered prescriber reviews every result and makes the final decision. No treatment decision is made by automated means alone.
4.2 Identity document photographs
To prevent fraud, we verify the identity of every customer. This may include a photograph of your identity document (such as a passport or driving licence), together with your name, date of birth and address. This is processed by a specialist identity verification provider. We do not use facial recognition or biometric matching for identity checks.
5. Where your information is stored and how we protect it
Your patient record, including consultation photographs and video, is stored on secure cloud servers located in the UK (London). We protect it with:
- encryption in transit (HTTPS) and encryption at rest;
- role-based access, so staff can see only the information their role needs;
- audit logging of access to patient records;
- confidentiality obligations for all staff, and professional duties of confidentiality for our registered clinicians;
- written data processing agreements with every service provider that handles your information.
We do not use real patient information to develop or test our systems.
You are responsible for keeping your account password confidential. Please do not share it with anyone.
6. Who can access your information
Only authorised Pharmacy Online staff whose role requires it can access your information, and every access to patient records is logged.
| Team | What they can access | Why |
|---|---|---|
| Prescribers and clinical lead | Your full clinical record, including photographs and video | To make and supervise safe prescribing decisions |
| Patient services | Your orders and clinical record, including photographs | To process and dispense your order |
| Customer care | Your account, orders, messages and clinical record, including photographs | To answer your queries and resolve problems with your order |
| Engineering and development team | Records held in our systems, only where necessary | To maintain, secure and fix our systems |
All staff are bound by confidentiality obligations.
7. Sharing your information with third parties
We share only the information each recipient needs, and service providers act only on our written instructions. A full list of our named service providers is available on request from our Data Protection Officer.
| Recipient | What we share | Why |
|---|---|---|
| Cloud hosting and database providers (UK) | Information held in our systems | To host our website and store your records securely |
| Email, SMS and customer messaging providers | Name, contact details and message content | To send order updates, reminders and replies |
| Website analytics providers | Usage and device data | To understand and improve how our website is used |
| Payment service provider | Name, address, phone, email and order details | To take payment. They collect your card details; we never see them |
| Specialist identity verification provider | Name, date of birth, address and ID document photograph | To verify your identity and prevent fraud |
| Specialist body-measurement technology provider (US) | Full-body photographs, without your name or contact details | To verify eligibility for weight loss treatment (section 4.1) |
| Delivery companies | Name, address, phone or email | To deliver your order |
| Accredited pathology laboratory | Name, date of birth and test reference | To process test kit samples |
| Your GP or specialist consultant | Treatment, quantity, date and, where appropriate, consultation details | Continuity of care, with your agreement (NHS service: required to issue prescriptions) |
| Regulators and approved auditors (GPhC, MHRA) | Consultation and dispensing records | Inspections and legal compliance |
For private patients, we will ask during your consultation whether we may inform your GP. You can tell us if there is any part of your record you do not want shared. For NHS patients, and for repeat prescriptions you manage on someone else's behalf, we share the relevant details with the patient's NHS GP so they can issue the prescription.
We may also disclose information where:
- the law, a court order or a regulator requires it;
- it is necessary to protect the safety of our staff, patients or the public;
- it is necessary to prevent or detect crime, including fraud;
- a merger, sale or restructure of our business takes place, in which case your information would remain protected by this policy.
8. Transfers outside the UK
Your patient record is stored in the UK, but some service providers process limited information outside the UK.
| Recipient | Location | What is transferred |
|---|---|---|
| Body-measurement technology provider | United States | Full-body photographs, with no name or contact details |
| Email, messaging and analytics providers | UK, EEA or United States | Contact details, message content and usage data |
Whenever information leaves the UK, we make sure it is protected to a standard essentially equivalent to UK law. We do this through UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework) or the UK International Data Transfer Agreement or Addendum. To obtain a copy of the safeguards for a particular transfer, contact our Data Protection Officer.
9. How long we keep your information
We keep clinical records, including photographs and video, for the period set by the health records code for the UK nation where you live, then securely delete them.
| Where you live | Records code we follow |
|---|---|
| England | NHS England Records Management Code of Practice |
| Scotland | Scottish Government Records Management Code of Practice for Health and Social Care |
| Wales | Welsh Government and NHS Wales records management guidance |
| Northern Ireland | Department of Health Good Management, Good Records (GMGR) |
In general, this means at least 13 years for adult patients and 25 years for patients who are pregnant.
| Information | How long we keep it |
|---|---|
| Prescriptions, consultations and clinical photographs or video | Per the records code above |
| Photographs held by our body-measurement provider | No more than 30 days after processing |
| Identity check records | 6 years |
| Account and order information | While your account is open, and afterwards as needed for legal, tax or clinical obligations |
| Enquiries with no purchase | No more than 3 years |
At the end of each period we review the information and securely delete it, unless we have a legal reason to keep it longer. You can ask us to close your account at any time, although we must keep clinical records for the periods above.
10. Your rights
You can exercise any of these rights free of charge by contacting our Data Protection Officer. We will respond within one month, and may need to verify your identity first.
| Right | What it means |
|---|---|
| Access | Get a copy of your information, why we use it, who we share it with (including named recipients) and how long we keep it |
| Rectification | Correct inaccurate or incomplete information |
| Erasure | Ask us to delete your information, unless we must keep it, for example clinical records |
| Restriction | Ask us to limit how we use your information while a concern is resolved |
| Portability | Receive your information in a structured, machine-readable format, or have it sent to another provider |
| Object | Object to use based on legitimate interests, and to direct marketing at any time |
| Withdraw consent | Withdraw consent you have given, such as for marketing, without affecting past use |
| Automated decisions | Not be subject to decisions made solely by automated means. All clinical decisions, including eligibility, are made by our registered clinicians |
We may charge a reasonable fee, or refuse, only where a request is manifestly unfounded or excessive, or for further copies of the same information.
11. Cookies and advertising
We use strictly necessary cookies to run the website, and other cookies only with your consent. You can change your choices at any time through Privacy Settings in our website footer. Full details are in our Cookie Policy.
| Type | Purpose | Needs your consent |
|---|---|---|
| Strictly necessary | Log-in, basket, security and remembering your cookie choices | No |
| Functionality | Remembering your preferences | Yes |
| Analytics and performance | Counting visitors and understanding how the site is used | Yes |
| Targeting and advertising | Showing relevant adverts and measuring campaigns | Yes |
If you have agreed to marketing, we may share a masked identifier (an encrypted version of your email address) with Google and Meta so that our adverts reach you on their platforms. We never share your health information or order details for advertising. You can stop this at any time by opting out of marketing.
You can also manage cookies in your browser settings, although blocking some cookies may stop parts of the website working.
12. Changes, complaints and contact
We post any changes to this policy on this page and, where appropriate, tell you by email. This version was last updated on 30 September 2026; earlier versions are available on request.
If you have a concern about how we use your information, please contact our Data Protection Officer first so we can try to resolve it. You also have the right to complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113).
Data Protection Officer: Karen Christie, 32 Welbeck Road, Glasgow, G53 7SD. Email: [email protected].
General enquiries: 0141 952 5918 (Monday to Friday, 9:00 to 17:00) or our contact page.