Privacy Notice

What we collect

Your account details (name, email, date of birth) and the health information you give us for the review — your medicines, conditions, allergies, and any postal address for a printed copy. The current patient service does not ask for or accept genetic results, DNA reports, raw DNA or genome files. Please do not submit genetic information in free-text fields. If you use an email-linked discount code, we also keep the email address, code expiry and whether the code was used or revoked. The raw discount code is not stored.

Why, and our lawful basis

We use your information to carry out the medicines review you have asked for and to produce your letter. Our lawful basis is performance of our contract with you (UK GDPR Art. 6(1)(b)) and, for health information, the provision of health care by a health professional (Art. 9(2)(h)) together with your explicit consent (Art. 9(2)(a)).

How it is protected and who processes it

Identifiable and clinical fields are encrypted at rest. We use sub-processors under contract: a payment provider (Stripe) for payments, an email provider for notifications, and an AI provider (Anthropic) to help draft your letter — your name is pseudonymised before any AI processing. We do not sell your data. If you request a printed copy, we send only the postcode — not your name, street address, account details or health information — to postcodes.io to confirm that it is a current UK postcode before accepting the delivery address.

Retention and your rights

Released clinical letters are retained for 8 years in line with NHS records-management guidance; account data is deleted 30 days after account closure. You can ask for a copy of your data, ask us to correct it, or ask us to erase it. To exercise your rights or contact our Data Protection Officer, email hello@virtualpharmacist.co.uk.

Right to complain

If you are unhappy with how we handle your data, please contact us first at hello@virtualpharmacist.co.ukso we can put it right. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.