Privacy Policy
1. Who we are
This policy explains how Next Gen Pharma Ltd, trading as 24 HR Pharmacy ("we", "us"), collects and uses your personal information when you use www.24hrpharmacy.co.uk, book an appointment or buy from us.
We are the data controller for your information. We are registered with the Information Commissioner's Office (ICO) under number ZB641054. Our registered office is Unit 5, Sir James Clark Building, Seedhill, Paisley, PA1 1TJ.
Our data protection lead is our Superintendent Pharmacist, Sehar Shahid. You can contact her at hello@24hrpharmacy.co.uk, or by post at the address above, marked "Data Protection".
2. What information we collect
We collect only what we need to provide safe care and run our service.
| Type | Examples | Where it comes from |
| Identity and contact | Name, date of birth, sex, address, email address, phone number | You |
| Health information | Consultation answers, medical history, allergies, current medicines, photos or readings you upload, prescriptions (including private prescriptions you upload), clinicians' notes | You, our prescribers and pharmacists, your GP (with your consent) and the prescriber who wrote a prescription you upload |
| Identity verification | Results of age and identity checks, copies of ID if you send them | You and our identity-check provider, LexisNexis |
| Order and payment | Orders, delivery details, payment confirmation. We do not see or store your full card number. | You and our payment provider, Worldpay |
| Communications | Emails, secure messages, call notes, video consultation notes, complaints | You |
| Website and device | IP address, browser type, pages visited, cookie data (see our Cookie Policy) | Your device |
| Marketing preferences | Whether you have opted in to marketing | You |
3. How we use it and our legal basis
Data protection law requires us to have a legal basis for each use of your information.
| What we use it for | Legal basis |
| Assessing your consultation, prescribing, dispensing and delivering medicines, and providing appointments | Performing our contract with you. For health information: the provision of health care (UK GDPR Article 9(2)(h)) |
| Checking and dispensing private prescriptions you upload | Performing our contract with you, and the provision of health care |
| Keeping clinical and pharmacy records | Legal obligation, and the provision of health care |
| Checking your identity and age, and preventing fraud or misuse | Legal obligation, and our legitimate interest in supplying medicines safely |
| Contacting your GP | The provision of health care, with your consent unless there is a serious safety concern |
| Sending service messages about your order and treatment, such as dispatch updates, refill reminders and aftercare information | Performing our contract with you, and the provision of health care |
| Customer service and complaints | Performing our contract, and our legitimate interests |
| Improving our website and service, using non-identifiable or combined data where possible | Our legitimate interests |
| Sending marketing emails or text messages, including offers related to treatments we have supplied to you | Your consent. Where marketing is based on the treatment you have received, we ask for your explicit consent. You can withdraw it at any time. |
| Analytics and advertising cookies | Your consent (see our Cookie Policy) |
We do not use your information to make fully automated decisions about your treatment. Every prescribing decision is made by a clinician.
4. Who we share it with
We never sell your information, and we never share your health information with other companies for their own marketing. We share it only when necessary, with:
- Our clinical team: the prescribers and pharmacists involved in your care.
- Your GP: with your consent, or without it if there is a serious risk to your safety.
- The prescriber who wrote a prescription you upload, where we need to confirm it is genuine.
- Service providers acting on our instructions: Royal Mail (your name and delivery address only), Worldpay (payments), LexisNexis (identity checks), our website hosting provider, and Klaviyo, which sends our emails and text messages. Klaviyo receives details of the treatments we have supplied to you so we can send relevant service messages and, if you have given explicit consent, tailored marketing. They may use your information only to provide their service to us.
- Analytics and advertising providers: Google and Meta, only if you accept analytics or advertising cookies. We do not share your consultation answers or health information with them.
- Regulators and authorities: such as the General Pharmaceutical Council, the MHRA, the police or a court, where the law requires it or to protect someone from serious harm.
- A buyer of our business, if we sell it, under the same privacy protections.
5. Where your data is stored and how we protect it
Storage. We store your information in the UK. Some of our providers, including Google, Meta and Klaviyo, may process limited information, such as website usage data or the email data held by Klaviyo, in the United States. Where this happens, it is protected by the UK–US data bridge or other safeguards approved under UK data protection law.
Security. We encrypt your information in transit and at rest, limit access to staff who need it, use secure log-ins on our systems, carry out regular security checks and train our team in confidentiality. If a data breach occurs that puts you at high risk, we will tell you and the ICO as the law requires.
6. How long we keep it
We keep information only for as long as we need it or the law requires.
| Information | How long we keep it |
| Clinical records, consultations and prescriptions | 8 years after your last order or appointment (longer for some medicines, or if you were under 18) |
| Order, payment and accounting records | 6 years after the end of the financial year |
| Customer service messages and complaints | 3 years after the matter is closed |
| Marketing preferences | Until you opt out, plus a record that you opted out so we do not contact you again |
| Cookie and website data | As set out in our Cookie Policy |
If you ask us to delete your account, we will delete what we can, but we must keep clinical and financial records for the periods above.
7. Your rights
You have the right to:
- get a copy of the information we hold about you
- have inaccurate information corrected
- have information deleted, where we are not legally required to keep it
- restrict or object to how we use it, including objecting to marketing at any time
- receive information you gave us in a portable format
- withdraw your consent at any time, where we rely on consent.
To use any of these rights, email hello@24hrpharmacy.co.uk. We may need to confirm your identity first. We will respond within one month, and there is usually no charge.
8. How to complain
If you are unhappy with how we have handled your information, please tell us first at hello@24hrpharmacy.co.uk so we can try to put it right. You also have the right to complain to the Information Commissioner's Office at www.ico.org.uk or on 0303 123 1113.
9. Changes to this policy
We may update this policy from time to time. We will post changes on this page and, if they are significant, email you.