By consenting to this privacy notice, you are confirming that you have read and understood this policy, including how and why we use your information. In line with the GDPR Meditrue Limited in acting as a data controller/processor is committed to protecting and respecting your privacy. We value the trust you place in us by providing the personal information we need to provision our services. The statement below details when and why we collect personal information, how we use it, the conditions under which we may disclose it to others, and how we keep it secure. Personal information is any information that can be used to identify you, or that which we can link to you. We may change this policy from time to time to reflect updated regulations, so please check this page regularly. By using our services, you are agreeing to abide by this policy.

Meditrue Limited is an online pharmacy service. We are a company limited by guarantee (No 2236378). Our registered address is:

The Estate Office
Lordship Farm Barns Dane End
SG12 0NS

The personal information we collect you provide voluntarily. We process this personal information to allow us to enter into an agreement with you and provide services. A summary of the information we collect and why is listed below.

In providing you with our services we may collect:

• Patient and customer personal details such as your name, address, phone numbers, email address, and date of birth.
• Proof of identity such as a copy of your passport or driving license.
• Credit card and debit card details.
• Information relating to your previous medical history and medicines prescribed to you by us.
• Information related to your browsing activities including your IP address.

We are committed to ensuring that the information we collect and use is appropriate for this purpose and does not constitute an invasion of your privacy. In order to provide clients with information and quotes for our goods and services, we make use of your contact information such as name, address, phone number, and email to engage in correspondence. We will also correspond with you from time to time to inform you of changes or improvements to services. Additionally, as permitted under soft-opt in and the GDPR, existing customers will also be sent marketing information and offers relating to our products. You can choose to opt out of such marketing at any time using the unsubscribe option or the preferences in your online customer account. We also collect sensitive personal data from you in the form of your medical history to ensure we prescribe medicines safely and accurately. Due to government regulations, we have a duty to confirm our patient’s identity. Proof of identification is sometimes requested in the form of a passport or driving license as we have a legal obligation to confirm and verify the identity of the individual we are prescribing medicine to.

Payment card information is collected so we can process your order and take payment for the medicines you wish to purchase. We do collect some personal information automatically from you when you visit this website and our event websites, using cookies and tools such as Hotjar, Google analytics, and Facebook. Please refer to our cookie policy for further details. In using these technologies, we may therefore collect details about the type of device you use to access our website, its operating system and version, your IP address, your general geographic location, your browser, and the webpages/content you view. We also monitor website sessions to see how users interact with forms and pages.

The information that we collect automatically is used to protect our websites and improve them.

We may pass your personal data to third-party service providers contracted to Assured Pharmacy. This is strictly for the purposes of providing services to you or improving them. All third parties are obliged to keep your details securely and to use them only to fulfill the services they provide on our behalf. We will also share your sensitive personal details with prescribers, clinicians, and other healthcare professionals for the purposes of making a medical diagnosis to prescribe your medicines. When third parties no longer need your data to fulfill this service, they will dispose of the details in line with Assured Pharmacy’s procedures. We can share data with GPT Medical Services for the purpose of fulfilling orders. Where necessary or required to provide and improve our services we share information with: (List available on request).

When you use our Royal Mail collection service Royal mail will receive your email address and mobile number to inform you when your order is ready for collection.

Due to the global nature of our computer systems, the data that we collect from you may be transferred to, and stored at, a destination outside the European Economic Area ("EEA") to third-party suppliers, delegates, or agents. Not all countries outside the EEA have data-protection laws that are equivalent to those in the EEA, the European Commission may not consider such countries as providing an adequate level of data protection. In consenting and using our services voluntarily you understand the risks involved. In the absence of either an adequacy decision or the implementation of “appropriate” safeguards, we only transfer data to other countries outside of the EEA where it is necessary for the performance of a contract to provide you with services. We take all reasonably necessary steps to make sure that your data is treated securely and in accordance with this privacy policy. Such protection is set out in contracts we have with international organizations. If you require further information, please contact [email protected].

There are different legal bases that we rely on to process your personal information, these are:

• Performance of a contract to clients to provide services – We undertake processing necessary to meet our contractual obligations to clients as the lawful basis for processing personal data.
• Legal Obligation – We undertake processing necessary to meet our legal obligations as a data controller as the lawful basis for processing your personal data. In particular our obligations to HMRC.
• Consent – We undertake processing necessary to provide direct marketing under the basis of consent.
• Legitimate Interest.

We process sensitive personal information about you such as your medical history because:

It is necessary for the purposes of preventive or occupational medicine, to assess whether you are able to work, medical diagnosis, to provide health or social care or treatment, or to manage health-care or social-care systems (including to monitor whether we are meeting expectations relating to our clinical and non-clinical performance).

Meditrue Limited will process (collect, store, and use) the information you provide in a manner compatible with the EU’s General Data Protection Regulation (GDPR). We will endeavor to keep your information accurate and up to date, and not to keep it for longer than is necessary. You can view and update your personal data by editing your customer profile on the Meditrue Limited website. We will only hold your personal information for as long as is necessary to provide you with our services. We also retain data for longer periods so as to meet our legal obligations to regulatory bodies which are set by law or recommended by regulators, professional bodies, and associations. All personal data we hold is subject to this privacy notice and our internal data retention policy. If you have a question about a specific retention period for certain types of personal information we process about you, please send an email to [email protected].

Meditrue Limited is committed to protecting the personal information you entrust to us. While we take reasonable precautions to guard the personal information we collect, no system is impenetrable. Unfortunately, sending information via e-mail is not completely secure; anything you send is done so at your own risk. Once received, we will secure your information in accordance with our security procedures and controls. Meditrue Limited takes measures to prevent information about you being subject to loss, theft, misuse, unauthorized access, disclosure, alteration, and destruction. For example, we store the personal data you provide to us on computer systems that have limited access and are located in controlled facilities. We also ensure that our third-party suppliers provide adequate security measures.

Meditrue Limited wants you to be in control of how your personal data is used by us, you can do this by exercising the rights granted to you under the GDPR.

• Right of access – you have the right to request a copy of the information that we hold about you.
• Right of rectification – you have a right to correct data that we hold about you that is inaccurate or incomplete. We rely on you to ensure that your personal information is complete, accurate, and up to date. Please inform us promptly of any changes to or inaccuracies in your personal information that you cannot correct yourself via the website by contacting [email protected].
• Right to be forgotten – in certain circumstances you can ask for the data we hold about you to be erased from our records.
• Right to restriction of processing – where certain conditions apply you have a right to restrict the processing.
• Right of portability – you have the right to have the data we hold about you transferred to another organization. Please address such requests to [email protected] and we will be happy to work with you to provide this information in a machine-readable format.
• Right to object – you have the right to object to certain types of processing such as direct marketing.
• Right to object to automated processing - including profiling.
• Right to judicial review - in the event that Meditrue Limited refuses your request under rights of access, we will provide you with a reason as to why. You have the right to complain as outlined below.

Meditrue Limited wishes to be as open as it can be in terms of giving people access to their personal data. Individuals can find out if we hold any personal information by making a ‘subject access request’ in doing so, you can request the following information:

• The purpose of the processing we undertake as well as the legal basis for doing so.
• The categories of personal data collected, stored, and processed.
• Recipient(s) that the data will be disclosed to.
• If we intend to transfer the personal data to a third party or international organization, information about how we ensure this is done securely and in line with GDPR requirements.
• How long the data we hold on you will be stored.
• Details of your rights to correct, erase, restrict, or object to such processing.
• Information about your right to withdraw consent at any time (if applicable).
• How to lodge a complaint with the supervisory authority.
• Whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether you are obliged to provide the personal data and the possible consequences of failing to provide such data.
• The source of personal data if it wasn’t collected directly from you.
• Any details and information of automated decision making, such as profiling, and any meaningful information about the logic involved, as well as the significance and expected consequences of such processing.

Due to legal requirements, we need to verify your identity. We attempt to do this using LexisNexis to perform identity checks. They will access public databases and credit agencies in order to verify your identity. This is known as a "soft search " and will not impact your credit file in any way. If we cannot identify you automatically we may ask for identity documents.

Meditrue Limited accepts the following forms of ID when information on your personal data is requested:

• Passport or Driving Licence

Please send an email to [email protected] our team will provide you with a subject access request form and facilitate the request. We will respond to your request as soon as possible and within 30 days of your request form being formally submitted.

Meditrue Limited is committed to working with you to reach a fair resolution of any complaint or concern you may have about our use of your personal information. Please contact us in the first instance to discuss your concerns.

If you believe that we have not been able to assist with your complaint, you may have the right to file a complaint with the Information Commission.

Meditrue Limited complaints contact details:

Information Commission contact details:

Like many other websites, the Meditrue Limited website uses cookies. 'Cookies' are small pieces of information sent by an organization to your computer and stored on your hard drive to allow that website to recognize you when you visit. This helps us to improve our website and deliver a better more personalized service. We may therefore collect details about the type of device you use to access our website, its operating system and version, your IP address, your general geographic location, your browser, and the webpages/content you view.

For full details of what cookies are used by our website please see our cookie policy here.

It is possible to switch off cookies by setting your browser preferences. Turning cookies off may result in a loss of functionality when using our website. Please refer to the following guides below if you wish to disable cookies.

• http://www.allaboutcookies.org/manage-cookies/

Our website may contain links to other websites run by other organizations. This privacy policy applies only to our website‚ so we encourage you to read the privacy statements on the other websites you visit. We cannot be responsible for the privacy policies and practices of other sites even if you access them using links from our website. In addition, if you linked to our website from a third-party site, we cannot be responsible for the privacy policies and practices of the owners and operators of that third-party site and recommend that you check the policy of that third-party site.

We keep this Policy under regular review so please check often for changes. This Policy was last updated in July 2024.