Privacy Policy

1. Who We Are

Shaunaks Pharmacy Group ('we', 'us', 'our') is an independent community pharmacy group operating branches across the South-West of England, including Bristol, Gloucestershire, Wiltshire and Worcestershire. We are registered as a data controller with the Information Commissioner's Office (ICO).

Our registered address and Data Protection Officer (DPO) contact details are set out in Section 12 below.

2. Our Commitment to Your Privacy

We take your privacy and the confidentiality of your personal and health information extremely seriously. As a pharmacy group, we are subject to both UK GDPR and the Data Protection Act 2018, as well as professional obligations under the General Pharmaceutical Council (GPhC) Standards for Pharmacy Professionals.

This Privacy Policy explains:

• What personal information we collect and why
• The lawful basis on which we process your data
• How we store, protect and share your information
• How long we keep it
• Your rights as a data subject

3. What Personal Information We Collect

3.1 Information you provide to us

When you use our website, contact us, or use our services, we may collect:

• Your name, date of birth, address, email address and telephone number
• NHS number and GP surgery details (where relevant to your prescription or services)
• Health and medical information necessary to provide pharmacy services — this is 'special category' data under UK GDPR and is given the highest level of protection
• Prescription information and medication history
• Correspondence you send to us

3.2 Information collected automatically

When you visit our website, we automatically collect certain technical data, including:

• Your IP address and browser type
• Pages visited and time spent on those pages
• Device identifiers and operating system
• Referring website or search engine

This data is collected using cookies and similar technologies — please see our Cookie Policy for full details.

4. Why We Use Your Information — Lawful Bases

UK GDPR requires us to identify a lawful basis for processing personal data. We rely on the following:

• Legal obligation: processing prescription and dispensing data to comply with the Medicines Act 1968, NHS contractual obligations, and GPhC standards
• Vital interests: in an emergency situation where your safety or the safety of others is at risk
• Legitimate interests: to manage and improve our services, respond to enquiries, prevent fraud and ensure the security of our website, where these interests are not overridden by your rights
• Consent: where we ask for your consent — for example, for marketing communications or for optional services — and which you may withdraw at any time

For special category data (health and medical information), we additionally rely on processing being necessary for the provision of health or social care services (Article 9(2)(h) UK GDPR).

5. Sharing Your Information

We do not sell your personal data. We may share information only in the following circumstances:

• With NHS bodies, GPs, and other healthcare providers: where necessary to provide you with safe, coordinated care (for example, confirming dispensed medication with your GP)
• With our IT and operational service providers: who process data on our behalf under data processing agreements and strict confidentiality obligations
• With regulatory bodies: including the GPhC, NHS England, and the ICO where we are required to do so by law
• With other third parties: only with your explicit consent, or where permitted or required by law

Where data is shared, we take reasonable steps to ensure that third parties apply appropriate technical and organisational security measures.

6. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction or disclosure. These include:

• Encrypted storage and transmission of data
• Access controls limiting who within our organisation can view personal and health data
• Regular staff training on data protection obligations
• Physical security measures at our branch premises

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and, where required, notify you directly without undue delay.

7. How Long We Keep Your Data

We retain personal data only for as long as necessary for the purposes for which it was collected, and in accordance with applicable legal and regulatory requirements. Our standard retention periods are:

• NHS prescription records: retained in accordance with NHS Records Management Code of Practice
• Private prescription records: minimum 2 years, recommended 8 years for clinical liability purposes (GPhC guidance)
• General customer correspondence and enquiry records: up to 3 years
• Website analytics data: up to 26 months

At the end of the applicable retention period, data is securely deleted or anonymised.

8. Your Rights

Under UK GDPR, you have the following rights in relation to your personal data:

• Right of access: to request a copy of the personal data we hold about you (Subject Access Request)
• Right to rectification: to ask us to correct inaccurate or incomplete data
• Right to erasure: in certain circumstances, to request that we delete your personal data
• Right to restrict processing: to ask us to limit how we use your data
• Right to data portability: to receive your data in a structured, commonly used format
• Right to object: to object to processing based on legitimate interests or for direct marketing
• Rights relating to automated decision-making: we do not make decisions about you based solely on automated processing

To exercise any of these rights, please contact our Data Protection Officer using the details in Section 12. We will respond within one calendar month of receiving your request. We may need to verify your identity before processing certain requests.

9. Cookies

Our website uses cookies to improve your experience and to help us understand how visitors use the site. You can control cookies through your browser settings and our cookie consent tool. For full details of the cookies we use and how to manage them, please refer to our separate Cookie Policy, available on our website.

10. Links to Third-Party Websites

Our website may contain links to external sites operated by third parties, including NHS services and health information providers. We are not responsible for the privacy practices of those websites and encourage you to read their privacy policies before providing any personal information.

11. Changes to This Policy

We may update this Privacy Policy from time to time, for example to reflect changes in the law or our practices. The most current version will always be published on our website with the date it was last updated. We recommend you review this policy periodically.

12. Contact Us & Data Protection Officer

If you have any questions about this Privacy Policy, wish to exercise your data rights, or have a concern about how we handle your information, please contact our Data Protection Officer:

If you are unhappy with how we have handled your personal data and we have not been able to resolve your concern, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Website: www.ico.org.uk
• Telephone: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF