Privacy Policy

How Prescriptly collects, uses, and protects your personal and medical data.

Privacy Policy

Effective Date: {{ now.Format “January 2, 2006” }}

At Prescriptly (“we”, “us”, or “our”), we are committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website (prescriptly.uk) and use our online prescribing services.

As a provider of healthcare services, we handle your personal data and sensitive medical data (Special Category Data) in strict accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the standards set by the General Pharmaceutical Council (GPhC).

1. Information We Collect

A. Personal Data

When you register for an account, subscribe to a service, or contact us, we may collect:

  • Identity Data: First name, last name, date of birth, gender.
  • Contact Data: Email address, billing address, delivery address, telephone number.
  • Financial Data: Payment card details (processed securely by our third-party payment processor, Stripe; we do not store full card details on our servers).

B. Special Category Data (Medical Information)

To safely prescribe and dispense medication, we are legally required to collect sensitive health information. This includes:

  • Details of your medical history, current conditions, and symptoms.
  • Your height, weight, and BMI.
  • Current medications and allergies.
  • Details of your GP (General Practitioner) for communication purposes.
  • Any ID verification documents required to confirm your identity.

C. Technical Data

When you interact with our website, we automatically collect:

  • IP address, browser type, and version.
  • Time zone setting and location.
  • Information about how you use our website and services (via cookies and similar technologies).

2. How We Use Your Information

We will only use your personal data when the law allows us to. Most commonly, we use your data for the following purposes:

  • To Provide Healthcare Services: Evaluating your suitability for treatments, issuing prescriptions, and dispensing medication (Legal basis: Explicit Consent and Provision of Health or Social Care).
  • To Manage Your Account: Processing payments, managing subscriptions, and handling deliveries (Legal basis: Performance of a Contract).
  • To Ensure Patient Safety: Verifying your identity and communicating with your NHS GP, where you have provided consent or where it is deemed medically necessary (Legal basis: Vital Interests or Provision of Healthcare).
  • To Improve Our Services: Analyzing website usage to improve patient experience (Legal basis: Legitimate Interests).
  • To Comply with Legal Obligations: Maintaining accurate prescribing and clinical records as required by the GPhC and other UK regulatory bodies (Legal basis: Legal Obligation).

3. How We Share Your Information

We do not sell your personal data. We may share your information with carefully selected third parties only when necessary:

  • Clinical Partners: Prescribers and clinicians who review your assessments.
  • Your NHS GP: With your consent, to ensure safe continuity of care.
  • Service Providers: Couriers (e.g., Royal Mail, DPD) for delivery, and payment processors (e.g., Stripe).
  • IT and System Administration: Secure cloud hosting providers and database managers ensuring encrypted storage of your data.
  • Regulatory Bodies: The GPhC or law enforcement agencies, if we are legally required to do so.

4. Data Security

We have implemented robust, industry-standard security measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorized way.

  • Encryption: All sensitive clinical data and Special Category Data is encrypted in transit (HTTPS/SSL) and at rest within secure, compliant databases.
  • Access Control: Access to your medical records is strictly limited to authorized clinicians and partner pharmacy staff who have a legitimate need to know.

5. Data Retention

We will only retain your personal data for as long as necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

  • Medical Records: Under UK guidelines, prescribing records and clinical assessments must typically be retained for a minimum of 8 years (or longer depending on the specific medication and clinical guidelines).

Under the UK GDPR, you have rights regarding your personal data:

  • Request Access (Subject Access Request): You can request a copy of the personal data we hold about you.
  • Request Correction: You can ask us to correct inaccurate or incomplete data.
  • Request Erasure (Right to be Forgotten): You can ask us to delete your data. Note: As a healthcare provider, we may be legally required to retain certain medical records even if you request deletion.
  • Withdraw Consent: Where we rely on consent to process your data, you can withdraw it at any time.

You can exercise these rights directly via the Privacy & Data Management section in your Patient Portal, or by contacting our Data Protection Officer.

7. Contact Us

If you have any questions about this Privacy Policy or our privacy practices, please contact us:

  • Email: support@prescriptly.uk
  • Address: [Insert Office Address]
  • Complaints: You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO.