Privacy notice
What we collect, why, and what you can do about it.
We are a pharmacy. Information about your health is some of the most sensitive data you have. This notice sets out exactly what we collect, the lawful basis for using it, and the rights you have over it.
Who controls your data
The data controller for personal information collected through this site and through the consultation flow is Acura Pharma Ltd (trading as Switch Pharmacy), company number 17237665, registered office 1 Stadium Place, Leicester LE4 0JS.
The person with day-to-day responsibility for data protection within Switch is the Superintendent Pharmacist, Omar Farook Dagia (GPhC 2221199). You can write to them at hello@switchpharmacy.co.uk with “Data protection” in the subject line.
What we collect
We only collect what we need to provide pharmacy services safely and lawfully. Specifically:
- Identity
- Full name, date of birth, sex registered at birth and/or gender, a photo of one government-issued ID document, a selfie matched to that document, and (where required) a short live video for liveness checking.
- Contact
- Email address, mobile telephone number, delivery address.
- Health
- Your answers to the consultation questions, including conditions, medicines, allergies, height, weight, blood pressure where given, lifestyle information, family history where relevant, and any free-text you share with the prescriber.
- GP information
- Your NHS GP surgery name, town and postcode. Optionally: GP name and NHS number. You may tell us you are not registered with a GP.
- Order
- Items requested, treatment selections, prescriber decisions, dispensing records, delivery records, and dates.
- Payment
- Card payments are processed by our payment provider. Switch does not store full card numbers. We retain the last four digits, the card brand, and a payment provider reference for reconciliation and refunds.
- Device & usage
- IP address, browser type, device type, pages visited and timestamps. See our cookie policy for detail.
- Correspondence
- Emails, phone calls (where recorded with notice), and chat messages between you and our pharmacy team.
Why we are allowed to use it
UK GDPR requires us to identify a lawful basis under Article 6 for everything we do with personal data, and a separate condition under Article 9 for special category (e.g. health) data. Our bases are:
- Provision of pharmacy care
- Article 6(1)(b) — performance of a contract you have entered into with us. Article 9(2)(h) — provision of health or social care, treatment, or the management of health care systems and services.
- Identity verification & fraud prevention
- Article 6(1)(c) — legal obligation; and Article 6(1)(f) — legitimate interests in preventing supply to ineligible recipients.
- Pharmacy and prescribing records
- Article 6(1)(c) — legal obligation under the Human Medicines Regulations 2012, the Medicines Act 1968, and GPhC standards.
- Adverse-event reporting
- Article 6(1)(c) and Article 9(2)(i) — public interest in the area of public health.
- Marketing emails (only with your consent)
- Article 6(1)(a) — consent. PECR (Privacy and Electronic Communications Regulations) for the email channel itself.
- Defending legal claims
- Article 6(1)(f) and Article 9(2)(f).
- Improving the service
- Article 6(1)(f) — legitimate interests; where data is special category it is fully anonymised first.
Health information
Health information — including your consultation answers, your medicines, and any conditions you share — is treated as special category data. We do not use it for marketing. We do not sell it. We do not share it with insurers or employers. We use it only to deliver the pharmacy service you have asked for, to meet our pharmacy-law obligations, and where you have asked us to, to communicate with your NHS GP.
Where it comes from
Most of the information we hold about you comes from you, when you complete a consultation, place an order, or contact us. Some additional information comes from:
- Our identity-verification provider (when matching your selfie to your ID).
- Our payment provider (the four-digit card suffix and brand).
- Your NHS GP, if you ask us to write to them and they reply.
- Couriers and delivery providers (status updates).
- Public registers (e.g. confirming a prescriber’s GPhC or GMC number).
How long we keep it
- Prescribing & dispensing records
- Minimum 7 years from the date of last supply. Records relating to children are kept until their 25th birthday or 8 years after the last entry, whichever is later.
- Controlled drug records
- 2 years from the last entry in the CD register; but Switch does not currently supply controlled drugs online (see scope).
- Consultation records (no prescription)
- 2 years from the consultation date.
- Account & contact data
- For as long as your account is active, then 2 years.
- Financial records
- 6 years for VAT and tax purposes once VAT-registered.
- ID verification material
- Retained for 12 months from the verification date, except where attached to a prescribing record (which follows the 7-year rule above).
- Complaint files
- 10 years from closure.
- Marketing consent
- Until you withdraw, then we keep a record that you have opted out.
Your rights
Under UK GDPR you have the right to:
- Be informed about how we use your data (this notice).
- Access the personal data we hold about you (“subject access request”).
- Have inaccurate data corrected.
- Have data erased — this right is limited where we have a legal obligation to retain pharmacy records.
- Restrict our processing in certain circumstances.
- Receive a copy of your data in a portable format.
- Object to processing based on legitimate interests.
- Withdraw consent where consent is the lawful basis (e.g. marketing).
To exercise any of these rights, email hello@switchpharmacy.co.uk. We will respond within one calendar month, free of charge in the vast majority of cases.
Automated decisions
Switch does not take prescribing decisions by automated means. A named UK-registered independent prescriber reviews every request before a medicine is supplied. The consultation flow may use simple logic to show or hide questions based on your earlier answers (for example, only showing pregnancy-related questions where relevant) and to highlight specific risk flags to the prescriber. These steps inform the prescriber; they do not replace the prescriber.
We do not use your data for any profiling that has a legal or similarly significant effect on you.
Security
We use industry-standard technical and organisational measures to keep your information secure. These include encryption of data in transit (TLS 1.2 or above) and at rest, strict access controls limited to people with a legitimate need, audit logging of access to clinical records, multi-factor authentication for staff, regular vulnerability scanning, and incident-response procedures aligned to the 72-hour breach-notification requirement under UK GDPR.
International transfers
We aim to keep personal data within the United Kingdom and the European Economic Area. Where a supplier (for example, an email provider) processes data outside the UK/EEA, we rely on UK adequacy regulations or the UK International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment. Health information is not transferred outside the UK/EEA without your explicit consent or another lawful basis.
How to complain
If you are unhappy with how we have handled your personal information, please tell us first — we would rather know. Write to hello@switchpharmacy.co.uk or use our complaints procedure.
You also have the right to complain to the Information Commissioner’s Office at any time:
Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline: 0303 123 1113 · ico.org.uk/make-a-complaint
Changes to this notice
We may update this notice from time to time, for example when the law or our services change. The version and the “last updated” date at the top of this page will always reflect the current version. If we make a material change — for example, a new sharing arrangement or a new lawful basis — we will tell you directly by email before it takes effect.