Privacy Policy

1. Who We Are

MSN Pharmacy Group ("we", "our", or "us") is an independent community pharmacy group providing NHS and private healthcare services across the Midlands. Through our pharmacies and digital platforms, including our website, we offer a range of healthcare services including prescription dispensing, Pharmacy First consultations, vaccination services, online appointment booking, and other pharmacy-led clinical services.

We are committed to protecting the privacy and confidentiality of all personal information entrusted to us.

This Privacy Policy explains how we collect, use, store and protect your personal information when you visit our website or use any of our services.

2. Our Commitment to Your Privacy

Protecting your personal information is extremely important to us.

MSN Pharmacy Group complies with:

• UK General Data Protection Regulation (UK GDPR)
• Data Protection Act 2018
• NHS Information Governance requirements
• General Pharmaceutical Council (GPhC) Standards
• Applicable healthcare confidentiality obligations

We only collect information that is necessary to provide safe, effective and lawful pharmacy services.

Our staff receive regular data protection training and are required to maintain strict confidentiality when handling patient information.

3. What Personal Information We Collect

3.1 Information You Provide

Depending on the services you use, we may collect:

• Full name
• Date of birth
• Home address
• Telephone number
• Email address
• NHS Number (where applicable)
• GP surgery details
• Prescription information
• Medication history
• Allergy information
• Medical conditions relevant to pharmacy services
• Consultation notes
• Appointment booking information
• Correspondence submitted through our website

Some of this information is classified as Special Category Personal Data under UK GDPR because it relates to your health.

3.2 Information Collected Automatically

When you visit our website we may automatically collect:

• IP address
• Browser type
• Device type
• Operating system
• Website pages visited
• Time spent on pages
• Referral source
• Website usage statistics

This information helps us improve website performance, maintain security and understand how visitors use our website.

4. Why We Use Your Information

We process personal information for several lawful purposes including:

• Providing NHS and private pharmacy services
• Dispensing prescriptions safely
• Managing repeat prescription requests
• Booking appointments
• Conducting pharmacy consultations
• Communicating with patients
• Responding to enquiries
• Meeting legal and regulatory obligations
• Preventing fraud
• Maintaining patient safety
• Improving our website and digital services

Where required under UK GDPR, we rely on one or more lawful bases including:

• Legal obligation
• Performance of a public task
• Legitimate interests
• Consent (where applicable)
• Provision of health and social care under Article 9(2)(h) UK GDPR

5. Sharing Your Information

We never sell your personal information.

Your information may be shared only where necessary with:

• NHS England
• Integrated Care Boards (ICBs)
• GP practices
• Hospitals and other healthcare providers
• Our secure IT service providers
• Regulatory authorities including the General Pharmaceutical Council (GPhC)
• The Information Commissioner's Office (ICO) where legally required

All organisations processing information on our behalf are required to maintain appropriate security measures and comply with UK data protection legislation.

We only share the minimum amount of information necessary for the relevant purpose.

6. Data Security

We take the security of your personal information seriously and have implemented appropriate technical and organisational measures to protect it against unauthorised access, disclosure, alteration, loss or destruction.

These measures include:

• Secure storage of electronic records
• Encryption of data where appropriate
• Password-protected systems
• Restricted staff access based on job responsibilities
• Regular cybersecurity monitoring
• Secure disposal of confidential information
• Ongoing staff training on data protection and confidentiality

If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office (ICO) within the required timescales and, where appropriate, inform affected individuals.

7. How Long We Keep Your Data

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected and to comply with legal, professional and regulatory obligations.

Typical retention periods include:

• NHS prescription records – retained in accordance with the NHS Records Management Code of Practice.
• Private prescription records – retained in accordance with applicable legal and professional requirements.
• Appointment and consultation records – retained for the period required under healthcare regulations.
• Customer enquiries and correspondence – normally retained for up to three years.
• Website analytics information – retained for up to twenty-six months unless otherwise required.

When information is no longer required, it is securely deleted or permanently anonymised.

8. Your Rights

Under UK GDPR you have several rights regarding your personal information.

These include:

• Right of Access – Request a copy of the personal information we hold about you.
• Right to Rectification – Ask us to correct inaccurate or incomplete information.
• Right to Erasure – Request deletion of your personal information where legally applicable.
• Right to Restrict Processing – Ask us to limit how your information is used.
• Right to Data Portability – Receive certain personal data in a structured, commonly used format.
• Right to Object – Object to processing based on legitimate interests or direct marketing.
• Rights relating to Automated Decision Making – We do not make decisions that produce legal or similarly significant effects based solely on automated processing.

To exercise any of these rights, please contact our Data Protection Officer. We may request proof of identity before responding to your request.

We aim to respond to all valid requests within one calendar month.

9. Cookies

Our website uses cookies and similar technologies to improve your browsing experience, analyse website traffic and support website functionality.

Cookies may be used to:

• Remember your preferences
• Improve website performance
• Monitor website usage
• Enhance security
• Support online appointment booking

You can manage or disable cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of our website.

Where required by law, we will ask for your consent before placing non-essential cookies on your device.

10. Links to Third-Party Websites

Our website may contain links to third-party websites including NHS services, healthcare organisations and other external providers.

These websites operate independently from MSN Pharmacy Group and have their own privacy policies.

We are not responsible for the content, security or privacy practices of external websites. We encourage you to review their privacy policies before submitting any personal information.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in legislation, regulatory guidance, technology or our business operations.

The latest version will always be published on our website together with the date of the most recent update.

We encourage users to review this Privacy Policy periodically.

12. Contact Us

If you have any questions regarding this Privacy Policy, wish to exercise your data protection rights, or have concerns about how your information is handled, please contact:

If you remain dissatisfied after contacting us, you have the right to lodge a complaint with the Information Commissioner's Office (ICO).