Skip to main content

Privacy Policy

How collects, uses, and protects your personal data.

Last updated: 25 July 2026

1. Who We Are

(trading as "Derby Street Pharmacy") is a GPhC-registered community pharmacy and the data controller responsible for your personal data when you use our services or visit this website.

Registered address: 17 Derby Street, Hanley

Data protection contact: contact@derbystreetpharmacy.org.uk

2. Data We Collect

We may collect the following categories of personal data:

Personal information

  • Name, date of birth, address, telephone number, and email address
  • NHS number (where applicable)
  • GP surgery details

Health and clinical data (special category data)

  • Medical history, current medications, and allergies
  • Prescription records and dispensing history
  • Consultation notes from clinical services (Pharmacy First, weight management, travel health, and other private consultations)
  • Vaccination records

Website and technical data

  • Information submitted through online forms (enquiries, appointment bookings, callback requests)
  • Cookies and browsing data (see our Cookie Policy for details)

3. Legal Basis for Processing

We process your personal data under the following lawful bases as defined by UK GDPR:

  • Contract - to provide pharmacy services you have requested, including dispensing prescriptions and delivering consultations
  • Legal obligation - to comply with NHS, GPhC, and MHRA regulations, including maintaining dispensing records and reporting adverse drug reactions
  • Vital interests - in medical emergencies where you are unable to give consent
  • Consent - for marketing communications, newsletters, and non-essential cookies
  • Legitimate interests - to improve our services, maintain security, and respond to enquiries

For health data (special category data under Article 9 of UK GDPR), we process this for the provision of healthcare, preventive or occupational medicine, and the management of health systems and services.

4. How We Use Your Data

  • Dispensing NHS and private prescriptions
  • Providing clinical consultations (Pharmacy First, weight management, travel health, and other services)
  • Administering vaccinations and recording them with NHS systems
  • Processing appointment bookings and callback requests
  • Responding to your enquiries and providing healthcare advice
  • Maintaining clinical records as required by GPhC and NHS regulations
  • Submitting NHS reimbursement claims
  • Sending service updates and health information (only with your consent)

5. Who We Share Data With

We may share your personal data with the following parties where necessary and lawful:

  • NHS England and NHS Business Services Authority (for prescription reimbursement and service claims)
  • Your GP surgery (for clinical referrals, Pharmacy First outcomes, and medicines optimisation)
  • Other healthcare providers involved in your care
  • The General Pharmaceutical Council (GPhC) for regulatory purposes
  • MHRA (for adverse drug reaction reporting under the Yellow Card scheme)
  • Our technology providers who process data on our behalf under data processing agreements

We will never sell your personal data to third parties. We do not share your data for marketing purposes without your explicit consent.

6. Data Retention

We retain your data for the minimum period necessary:

  • Prescription dispensing records: 2 years (as required by NHS regulations)
  • Controlled drug registers: 2 years from the last entry
  • Private consultation records: 8 years (or until the patient turns 25, whichever is longer)
  • Vaccination records: 10 years
  • Website enquiries and callback requests: 12 months
  • Marketing consent records: until you withdraw consent

7. Data Security

We take the security of your data seriously and implement appropriate technical and organisational measures, including:

  • Encrypted data transmission (SSL/TLS) on this website
  • Secure, access-controlled pharmacy systems
  • Staff training on data protection and confidentiality
  • Compliance with the NHS Data Security and Protection Toolkit (DSPT)
  • Regular review of data security procedures

8. Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

  • Right of access - request a copy of the personal data we hold about you
  • Right to rectification - ask us to correct inaccurate data
  • Right to erasure - ask us to delete your data (subject to legal retention requirements)
  • Right to restrict processing - ask us to limit how we use your data
  • Right to data portability - receive your data in a structured, machine-readable format
  • Right to object - object to processing based on legitimate interests or direct marketing
  • Right to withdraw consent - where processing is based on consent, you may withdraw it at any time

Please note that some rights may be limited where we have a legal obligation to retain data (for example, prescription records required by NHS regulations). We will always explain any limitations when you make a request.

To exercise any of these rights, contact us at contact@derbystreetpharmacy.org.uk or visit the pharmacy in person.

9. Cookies

This website uses cookies. For full details on what cookies we use and how to manage them, please see our Cookie Policy.

10. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. The updated policy will be published on this page with a revised date. We encourage you to review this page periodically.

11. Complaints

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

We would always prefer to resolve your concerns directly. Please contact us at contact@derbystreetpharmacy.org.uk before approaching the ICO so we can try to put things right.