Privacy Policy

Last updated: 13 August 2026

 

At Pharmacy Mentor, we take the privacy, confidentiality and security of your personal information seriously. This Privacy Policy explains how we collect, use, store and share personal information when you use our website, purchase products, request medicines or treatment, use our pharmacy services, communicate with us or otherwise interact with Pharmacy Mentor. For the purposes of applicable data protection law, Pharmacy Mentor is responsible for the personal information it controls. Where another healthcare provider, prescriber or organisation independently determines how and why your information is used, that organisation may act as a separate data controller. This policy should be read alongside our Cookies Policy and any additional privacy information provided when you use a particular service.

 

1. Personal Information We Collect

The information we collect depends on how you use our website and services. We may collect and process:

• Identity information, such as your name, title, date of birth and gender where relevant;
• Contact information, such as your address, email address and telephone number;
• Account information, such as your login details, account preferences and account activity;
• Order and transaction information, including products or services ordered, order history, delivery details, refunds and payment status;
• Payment information required to process transactions, usually through our payment service providers;
• Prescription and pharmacy information, including prescription details, medicines supplied and dispensing records;
• Health and clinical information, including medical history, current and previous medicines, allergies, symptoms, health conditions, treatment information and consultation responses;
• Information you provide during consultations, which may include photographs, documents, identity information or other evidence requested as part of a clinical assessment;
• NHS or healthcare identifiers, such as your NHS number where relevant to the service being provided;
• Communications, including emails, telephone calls, contact forms, messages, complaints and other correspondence;
• Marketing preferences, including whether you have chosen to receive particular communications from us;
• Technical information, such as your IP address, browser, device information and website activity; and
• Cookie and similar technology information, as described in our Cookies Policy.

 

2. Health and Special Category Information

Because Pharmacy Mentor provides pharmacy and healthcare services, we may need to process information about your physical or mental health, medicines, prescriptions or treatment. Health information is treated as particularly sensitive personal information under UK data protection law and receives additional protection. We only process health and clinical information where there is an appropriate legal basis and an additional legal condition permitting the use of special category information. Depending on the circumstances, this may include processing that is necessary for:

• providing healthcare, pharmacy services, diagnosis or treatment;
• managing healthcare services;
• meeting legal or regulatory requirements;
• protecting public health or the safety and quality of medicines and healthcare;
• protecting someone’s vital interests in appropriate circumstances;
• establishing, exercising or defending legal claims; or
• another permitted purpose where the requirements of data protection law are satisfied.

Where health information is processed for the provision of healthcare, it will be handled by, or under the responsibility of, people who are subject to appropriate duties of confidentiality where required.

 

3. How We Collect Your Information

We may collect information directly from you when you:

• create an account;
• place an order;
• submit a prescription;
• complete a consultation or questionnaire;
• request treatment or pharmacy advice;
• contact us;
• make a complaint or exercise a data protection right;
• subscribe to communications; or
• use our website.

We may also receive information from other sources where lawful and appropriate. These may include:

• prescribers, pharmacists and other healthcare professionals;
• GP practices and other healthcare providers;
• NHS systems and organisations;
• people authorised to act on your behalf;
• payment providers;
• identity verification and fraud-prevention services;
• delivery providers;
• technology and website service providers; and
• public authorities, regulators or other organisations where information may lawfully be shared.

 

4. How We Use Your Information

We may use your personal information to:

• provide pharmacy, healthcare and related services;
• assess requests for medicines or treatment;
• support prescribing, dispensing and clinical decisions;
• process and fulfil orders;
• verify your identity where necessary;
• communicate with you about your account, orders, prescriptions, treatment or enquiries;
• arrange and manage delivery;
• process payments, refunds and other transactions;
• maintain appropriate pharmacy, clinical and business records;
• provide patient care and support continuity of care;
• prevent fraud, misuse and inappropriate ordering;
• protect the security of our website, systems, staff and patients;
• investigate complaints, incidents or concerns;
• meet our legal, regulatory, professional and NHS obligations where applicable;
• improve our website, services and customer experience;
• manage our business and defend legal claims;
• send permitted service or marketing communications; and
• use cookies and similar technologies as described in our Cookies Policy.

 

5. Our Lawful Bases for Using Personal Information

Data protection law requires us to have an appropriate lawful basis whenever we process personal information. Depending on the circumstances, we may rely on one or more of the following:

Contract

We may process information where it is necessary to enter into or perform a contract with you, such as processing an order or providing a private service you have requested.

Legal Obligation

We may process information where necessary to comply with legal, professional, regulatory, tax, pharmacy, medicines or record-keeping obligations.

Legitimate Interests

We may use information where this is necessary for our legitimate interests or those of another organisation, provided those interests are not overridden by your rights and interests. Examples may include protecting our services against fraud, maintaining website and system security, managing our business, improving our services and establishing or defending legal claims.

Consent

Where consent is the appropriate basis, we will ask you to make a clear choice. You can withdraw your consent at any time. Withdrawal of consent does not affect processing that lawfully took place before consent was withdrawn.

Public Task

Where applicable, information may be processed where necessary to perform a task in the public interest or exercise an official function, including in connection with certain NHS services.

Vital Interests

In exceptional circumstances, we may process information where this is necessary to protect your life or that of another person.

 

6. Prescribing and Clinical Assessments

If you request a medicine or treatment that requires a clinical assessment, the information you provide may be reviewed by an appropriately qualified healthcare professional. This may include information about your symptoms, medical history, current medicines, allergies, previous treatments and other information relevant to determining whether treatment can be safely provided. We may need to request additional information or verify information with you or another healthcare provider before a decision can be made. Where a separate prescribing or healthcare provider is responsible for a consultation or prescribing decision, information necessary to provide the service may be shared with that provider. That provider may process your information as an independent data controller and may provide its own privacy information.

 

7. Sharing Information with Healthcare Professionals

We may share relevant personal and clinical information with other healthcare professionals or organisations where this is lawful and necessary for your care, the safe supply of medicines or the operation of a healthcare service. This may include:

• pharmacists;
• prescribers;
• your GP or GP practice;
• hospitals and other healthcare providers;
• NHS organisations and systems; and
• other healthcare professionals involved in your care.

We will only share information that is relevant and appropriate in the circumstances and will respect applicable duties of confidentiality.

 

8. Other Organisations We May Share Information With

We may also share personal information with organisations that help us operate our services, where appropriate. These may include:

• payment processors and financial service providers;
• couriers and delivery providers;
• website, hosting, cloud and IT service providers;
• communications and customer service platforms;
• identity verification and fraud-prevention providers;
• professional advisers, auditors and insurers;
• NHS bodies and payment or reimbursement authorities where applicable;
• professional and healthcare regulators;
• medicines and healthcare authorities;
• law enforcement agencies, courts and public authorities where disclosure is lawful or required; and
• another organisation involved in a merger, acquisition, restructuring or transfer of our business, subject to appropriate confidentiality and data protection requirements.

Where another organisation processes personal information on our behalf, we require appropriate arrangements to protect that information. We do not sell your medical or clinical information.

 

9. NHS Information

Where we provide NHS pharmacy services, we may use and exchange relevant information through NHS systems and with NHS organisations as necessary to provide those services, process prescriptions, support patient care, verify entitlement, arrange payment or reimbursement, conduct appropriate audits and comply with NHS requirements. The precise information used will depend on the NHS service being provided and the circumstances of your care.

 

10. Marketing Communications

We may send you marketing communications where this is permitted by applicable data protection and electronic communications law. Depending on the circumstances, this may be based on your consent or another permitted basis, such as the limited existing-customer provisions available under electronic marketing rules. You can opt out of marketing communications at any time by using the unsubscribe method provided in the communication or by contacting us. Service messages about an order, prescription, consultation, account, safety issue or other service you are using are not normally marketing communications and may still be sent where necessary. We do not treat information provided as part of a clinical consultation or prescription as permission to send you marketing communications.

 

11. Cookies and Website Technologies

Our website uses cookies and similar technologies for purposes such as operating the website, maintaining security, remembering preferences, measuring website performance and, where permitted, supporting advertising and marketing. For more information about these technologies and your choices, please see our Cookies Policy.

 

12. Automated Systems and Decision-Making

We may use automated systems to support parts of our service, such as website security, fraud prevention, identity verification, administration or initial processing of information. Automated tools may also be used to support healthcare professionals, but they do not replace the professional responsibilities of pharmacists, prescribers or other healthcare professionals. If we use solely automated decision-making that produces legal or similarly significant effects for you, we will only do so where permitted by law and will provide appropriate information and safeguards as required.

 

13. How Long We Keep Your Information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected and to meet applicable legal, regulatory, professional and operational requirements. Different types of information may need to be kept for different periods. When deciding how long information should be retained, we may consider:

• pharmacy and healthcare record-keeping requirements;
• NHS requirements where applicable;
• medicines and prescribing requirements;
• tax and accounting obligations;
• the nature and sensitivity of the information;
• patient safety and continuity of care;
• the purpose for which the information was collected;
• potential complaints or legal claims; and
• other applicable legal or regulatory requirements.

When information is no longer required, we will securely delete, anonymise or otherwise dispose of it as appropriate.

 

14. International Transfers

Some organisations that provide technology, hosting, communications or other services to us may process personal information outside the United Kingdom. Where personal information is transferred internationally and data protection law restricts that transfer, we will ensure that an appropriate lawful transfer mechanism is in place. This may include transferring information to a country covered by UK adequacy regulations, using approved contractual safeguards or relying on another permitted mechanism where appropriate. We will also consider the protection provided to personal information when selecting and using service providers.

 

15. Keeping Your Information Secure

We use appropriate technical and organisational measures designed to protect personal information against unauthorised access, loss, misuse, alteration or disclosure. Measures may include access controls, secure systems, staff confidentiality requirements, authentication, encryption where appropriate, monitoring, backups and procedures for responding to security incidents. Access to clinical and other sensitive information is restricted according to role and need where appropriate. Although we take appropriate steps to protect information, no internet or electronic system can be guaranteed to be completely secure.

 

16. Information About Children

Some pharmacy and healthcare services may involve processing information about children or young people. Where this occurs, we will take account of the person’s age, circumstances and the nature of the service when determining how information should be collected, used and shared. A parent, guardian or other authorised person may provide information or act on behalf of a child where this is appropriate and lawful.

 

17. Your Data Protection Rights

Depending on the circumstances, you may have rights in relation to your personal information, including the right to:

• be informed about how your information is used;
• access personal information we hold about you;
• correct inaccurate or incomplete information;
• request deletion of personal information in certain circumstances;
• restrict how your information is used in certain circumstances;
• object to certain types of processing;
• receive or transfer certain information in a portable format where the right to data portability applies;
• withdraw consent where our processing is based on consent; and
• exercise rights relating to certain forms of automated decision-making.

These rights are not absolute and may not apply in every circumstance. For example, we may need to retain certain pharmacy, prescription or clinical records even where you ask us to delete them. To exercise a data protection right, please contact us or email web@pharmacymentor.com. We may ask you for information necessary to confirm your identity and ensure that personal information is not disclosed to an unauthorised person.

 

18. Data Protection Complaints

If you have concerns about how we have collected, used, shared or protected your personal information, you can make a data protection complaint by contacting us or emailing web@pharmacymentor.com. We will take appropriate steps to investigate data protection complaints, keep you informed where appropriate and provide an outcome without unnecessary or unjustifiable delay. We will acknowledge receipt of a data protection complaint within 30 days. You also have the right to raise a concern or complaint with the Information Commissioner’s Office (ICO), the UK’s data protection regulator. Further information about your rights and how to complain is available from the ICO at ico.org.uk.

 

19. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our website, pharmacy services, data practices, service providers, applicable law or regulatory requirements. Where a change is significant, we may take additional steps to bring it to your attention where appropriate. The latest version of this Privacy Policy will always be available on our website. A change to this Privacy Policy does not itself provide consent for processing where consent is required by law.

 

20. Contact Us

If you have questions about this Privacy Policy, wish to exercise a data protection right or want to raise a concern about how your personal information is being used, please contact us or email us at web@pharmacymentor.com.