Skip to main content
nuPharma

Privacy Policy

How we collect, use, and protect your personal information in accordance with UK GDPR and the Data Protection Act 2018.

Last updated: February 2026

1. Data Controller

The data controller responsible for your personal data is:

nuPharma Ltd
123 Pharma Lane
London EC1A 1BB
United Kingdom

Email: privacy@nupharma.co.uk
Phone: 01234 567 890

Our Superintendent Pharmacist acts as the primary point of contact for data protection matters relating to health data. You may contact them at the address above or by emailing privacy@nupharma.co.uk.

2. What Personal Data We Collect

We collect and process the following categories of personal data:

Identity and Contact Data

  • Full name
  • Email address
  • Telephone number
  • Delivery and billing address
  • Date of birth

Health and Medical Data (Special Category Data)

  • Responses to pharmacy screening questionnaires
  • Prescription documents uploaded to your account
  • Information about medicines purchased
  • Any health information you voluntarily provide to our pharmacists

Financial Data

  • Payment card details (processed securely by Stripe; we do not store full card numbers)
  • Transaction and order history

Technical Data

  • IP address
  • Browser type and version
  • Device information
  • Cookie data (see our Cookie Policy)

3. Lawful Basis for Processing

We process your personal data on the following legal bases under UK GDPR:

Purpose Lawful Basis
Fulfilling your orders and providing pharmacy services Performance of a contract (Article 6(1)(b))
Processing health data for pharmacy screening and prescription handling Explicit consent (Article 9(2)(a)) and necessity for healthcare provision (Article 9(2)(h))
Maintaining pharmacy records as required by the GPhC Legal obligation (Article 6(1)(c))
Sending marketing communications Consent (Article 6(1)(a))
Improving our website and services Legitimate interest (Article 6(1)(f))
Fraud prevention and security Legitimate interest (Article 6(1)(f))

4. Special Category Health Data

Health information is classified as special category data under UK GDPR and receives additional protection. We process health data on the basis of:

  • Explicit consent — which you provide when completing screening questionnaires or uploading prescription documents.
  • Necessity for healthcare provision — processing is necessary for the provision of health care by or under the responsibility of a health professional (our registered pharmacists).

You may withdraw your consent at any time by contacting us. However, withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal, and we may be legally obliged to retain certain health records regardless of withdrawal.

5. How We Use Your Data

We use your personal data for the following purposes:

  • Processing and fulfilling your orders
  • Conducting pharmacy screening questionnaires to ensure medicines are safe and appropriate for you
  • Handling and verifying prescription documents
  • Managing your account and providing customer support
  • Processing payments securely through Stripe
  • Communicating order updates, dispatch notifications, and delivery information
  • Complying with legal and regulatory obligations, including GPhC record-keeping requirements
  • Sending marketing communications where you have given consent
  • Improving our website, services, and customer experience

6. Who We Share Your Data With

We share your personal data only where necessary and with the following categories of recipients:

  • Stripe — our payment processor, who handles card payments securely. Stripe acts as an independent data controller for payment data. See Stripe's Privacy Policy.
  • Royal Mail and courier partners — for delivery of your orders. We share only the information necessary for delivery (name and address).
  • Regulatory bodies — including the GPhC and MHRA, where required by law.

We do not sell, rent, or trade your personal data with third parties for marketing purposes.

All third-party service providers are required to process your data in accordance with UK GDPR and our instructions.

7. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law:

Data Type Retention Period
Order records and transaction data 8 years (pharmacy record-keeping requirements)
Prescription records 8 years from the date of the last entry
Screening questionnaire responses 8 years (pharmacy record-keeping requirements)
Marketing consent records Until consent is withdrawn
Account data Until you request deletion of your account
Website analytics data 26 months

8. Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

  • Right of access — to request a copy of the personal data we hold about you.
  • Right to rectification — to request correction of inaccurate or incomplete personal data.
  • Right to erasure — to request deletion of your personal data where there is no compelling reason for continued processing. Note: this right does not apply where we have a legal obligation to retain data (e.g. pharmacy records).
  • Right to restriction of processing — to request that we limit how we use your data in certain circumstances.
  • Right to data portability — to receive your personal data in a structured, commonly used, machine-readable format.
  • Right to object — to object to processing based on legitimate interest or for direct marketing purposes.
  • Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting prior processing.

To exercise any of these rights, please contact us at privacy@nupharma.co.uk. We will respond to your request within one month.

9. Cookies

Our website uses cookies to provide essential functionality and improve your experience. For full details of the cookies we use and how to manage them, please see our Cookie Policy.

10. How to Complain

If you are unhappy with how we have handled your personal data, we encourage you to contact us first so we can try to resolve the issue.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection:

Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF

Website: ico.org.uk
Phone: 0303 123 1113

11. Contact Us

If you have any questions about this Privacy Policy or how we handle your data, please contact us:

nuPharma Ltd
123 Pharma Lane
London EC1A 1BB

Email: privacy@nupharma.co.uk
Phone: 01234 567 890