Privacy Policy for George and Florence Pharma

What Personal Data We Collect and Why

George and Florence Pharma is committed to protecting the privacy and security of the personal data we collect from our customers and users of our online pharmacy website. This Privacy Policy outlines the types of personal data we collect, how we use it, and your rights regarding your information. We operate in compliance with applicable UK privacy laws, including the UK GDPR.

We collect personal information that is reasonably necessary to provide our online pharmacy services and to comply with legal and regulatory obligations. The types of personal data we may collect include:

How We Collect and Hold Your Personal Data

  • Contact and Identification Details: This includes your name, address, date of birth, and other contact information. This is essential for fulfilling your prescription orders and delivering products to you.
  • Health Information: For prescription fulfillment, we collect sensitive health information such as your medical history, current medications, symptoms, and test results. This data is crucial for ensuring the safe and appropriate dispensing of medicines and for providing wider consultation services. We may also collect your NHS number or similar identification for prescription processing.
  • Financial Information: We process payment card details for purchases, though we do not store these details directly. Our third-party processing agency securely handles this information.
  • Qualifications and Professional Information: If you are a healthcare professional involved in patient care or advising on studies, we may collect your professional qualifications, experience, and registration information.
  • Technical Data: When you access our website, we may automatically collect technical data such as your IP address, pages viewed, and links clicked. This is primarily through the use of cookies, which help us monitor website activity, improve user experience, and ensure security. More details are available in our Cookie Policy.
  • Commercially Available Data: We may acquire some personal data from commercially available sources, such as the electoral roll, to keep your data accurate and better understand your needs. This is done as part of our legitimate business interests.
  • Interaction Records: This includes records of your interactions with us, such as phone calls (which may be recorded for regulatory, training, and quality purposes), and online communications.

We primarily collect personal information directly from you when you contact us, agree to participate in services, or interact with our website. We may also collect information from third parties, such as your medical or health provider (e.g., GP or hospital), particularly for prescription services.

Your personal data may be accessed by or transferred to:

Who Has Access to Your Personal Data

Your personal information is held in both paper-based and electronic records and systems. We employ physical security and other measures to protect your data from misuse, interference, loss, and unauthorized access, modification, or disclosure.

  • Our personnel across various departments (e.g., Clinical Trial, Patient Safety, Medical Information, Quality Assurance, and Legal).
  • Other companies within our wider group of companies, where there is a legal or justified business need.
  • Selected third-party service providers (e.g., courier companies for deliveries, payment processing agencies, or content processors for health advice). These third parties are contractually obligated to protect your data.
  • National and international regulatory authorities, enforcement agencies, commissions, courts, or ethics committees, to comply with legal and regulatory requirements.
  • NHS bodies, such as your GP or the NHS Business Services Authority, to fulfill our contractual obligations and ensure proper service standards.

International Data Transfers

Whenever possible, your personal information will be de-identified (and aggregated with others) before disclosure, especially for research or statistical purposes.

Data Retention

As an online pharmacy, we may need to transfer your information outside the UK to service providers or partners in countries that may not offer the same level of data protection as the European Economic Area. In such cases, we implement specific safeguards and assurances, such as standard contractual clauses approved by the European Commission, and conduct Transfer Risk Assessments to ensure your data is appropriately protected.

We retain your personal data for as long as legally or contractually required, or for a period justifiable to meet our business needs. This period varies depending on the type of information and its purpose. For instance, clinical study documentation may be retained for a minimum of 25 years in certain countries. After the applicable retention period, your data will be securely deleted or anonymized.

Under UK data protection law (UK GDPR), you have several rights regarding your personal data, including:

Your Privacy Rights

  • Right of Access (Subject Access Request): You can request a free copy of your personal data.
  • Right to Rectification: You can ask us to correct or complete inaccurate or incomplete data.
  • Right to Object: You can object to certain processing activities, such as direct marketing or profiling related to marketing.
  • Right to Erasure (Right to be Forgotten): In certain circumstances, you can request the deletion of your personal data.
  • Right to Portability: You can request a copy of certain data elements to be transferred to another company.
  • Right to Restrict Processing: You can ask us to limit the use of your data in specific situations.

Complaints

To exercise these rights, please contact us via email at privacy@george-medicines.com or by post. We aim to respond to requests within 10-20 business days.

Changes to This Privacy Policy

If you have a complaint about how we handle your personal information, please contact our Data Protection Officer at privacy@george-medicines.com. If you are not satisfied with our response, you can lodge a complaint with the Information Commissioner’s Office (ICO) in the UK.

We may update this Privacy Policy periodically. Any changes will be posted on our website and will take effect 7 days after being posted. We encourage you to review it regularly for updates .