Patient Privacy & Data Protection Policy

2. Categories of Personal Data Collected

We collect personal information necessary to deliver clinical services, manage electronic prescriptions, and fulfill patient inquiries:

• Identity & Contact Identifiers: Full name, date of birth, biological sex, residential address, postcode, contact phone numbers, and email address.
• NHS Identifiers: 10-digit NHS number and registered GP practice details for NHS Electronic Prescription Service (EPS) nomination.
• Technical Identifiers: IP address, device telemetry, browser type, and cookie preference data collected during digital portal sessions.

3. Special Category Health Data & Clinical Records

Under Article 9 of the UK GDPR, medical, prescription, and clinical consultation records constitute special category data. We process health data under Article 9(2)(h) ("Health or Social Care Provision") overseen by GPhC-registered Superintendent Pharmacists and clinical practitioners bound by statutory professional duties of confidentiality.

4. Lawful Basis for Processing Data

We process personal data under the following statutory lawful bases under UK GDPR Article 6:

• Performance of Contract: Fulfilling requested pharmaceutical dispense orders, clinical appointments, and delivery services.
• Legal & Regulatory Obligations: Compliance with NHS Dispensing Regulations, Medicines Act 1968, Misuse of Drugs Regulations 2001, and GPhC audit mandates.
• Legitimate Clinical Interests: Ensuring patient safety, pharmacovigilance, and service continuity across our pharmacy network.

5. NHS & Third-Party Disclosures

Your personal and clinical data may be shared exclusively with authorized entities involved in your healthcare pathway:

• NHS Business Services Authority (NHSBSA) for prescription reimbursement and auditing.
• Your nominated General Practitioner (GP) surgery for clinical continuity and consultation reporting.
• Regulated NHS logistics partners for secure prescription home delivery.
• Statutory law enforcement or public health bodies where mandated by legal enactment or court order.

6. Data Retention & NHS Record Standards

Prescription records, clinical notes, and patient registers are retained strictly in accordance with the NHS Records Management Code of Practice 2021 and GPhC governance rules:

• NHS Prescriptions & Register Logs: Retained for a minimum of 2 years to 11 years as statutory required.
• Patient Consultation Records: Retained for 8 years following the last clinical contact.
• Digital Web Inquiries: Deleted or anonymized within 12 months of resolution.

7. Your Patient Rights & GDPR Protections

Under UK GDPR, you hold enforceable statutory rights regarding your personal information:

• Right of Access (Subject Access Request): Request copies of your personal and medical records processed by Wise Pharmacy without charge.
• Right to Rectification: Request correction of inaccurate demographic or contact details.
• Right to Restriction / Erasure: Request restriction of non-statutory data processing, subject to NHS clinical retention mandates.
• Right to Lodge a Complaint: You have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.

8. Technical Security & Encryption Architecture

Wise Pharmacy implements end-to-end TLS 1.3 encryption, AES-256 database storage encryption, role-based access control (RBAC), and continuous threat monitoring. All staff undergo mandatory annual Information Governance (IG) training.

9. Data Protection Officer Contact

To exercise your statutory rights or submit a formal data inquiry: