Patient Privacy Notice

The essentials

We use relevant information to provide safe pharmacy and healthcare services, maintain clinical records, communicate with you and meet our NHS, legal and professional duties. We keep it confidential, share it only when there is a proper reason, and do not sell it. You have rights over your information, although some clinical records must be retained.

1. Who this notice is for

This notice applies to patients and service users of Tynewydd Pharmacy, including people receiving NHS or private pharmacy, prescribing, vaccination, travel-health, weight-management, ear-care and other clinic services. It also applies to parents, guardians, carers and representatives who provide information for, or act on behalf of, a patient.

A separate Website Privacy Policy explains information collected through our website, online forms, appointment links and cookies. Once information is used for your care or entered into a clinical record, this Patient Privacy Notice applies.

2. Who we are

GRH Pharma Ltd (company number 14196408), trading as Tynewydd Pharmacy, is the data controller for the information described in this notice. Our registered office is Suite 2d, Building 1, Eastern Business Park, St Mellons, Cardiff, CF3 5EA. Our pharmacy is at 59 Gwendoline Street, Tynewydd, Treherbert, CF42 5BL.

Tynewydd Pharmacy is registered with the General Pharmaceutical Council (registration 1043630) and the Information Commissioner's Office (registration ZB511077; current registration expiry 8 February 2027).

3. Information we may hold about you

The information depends on the service you use and may include:

• identity and contact details, including your name, date of birth, address, telephone number, email address and NHS number;
• details needed to identify you safely, such as your GP practice, representative, preferred language and communication needs;
• prescriptions, medicines supplied, allergies, adverse reactions, vaccination history and other medication records;
• health and clinical information, including symptoms, diagnoses, medical and family history, examination findings, measurements, test results, photographs where clinically required, treatment plans, referrals and outcomes;
• information about sex life, sexual orientation, ethnicity, religion, disability or other protected characteristics where relevant to safe, equitable care;
• appointment, consultation, consent, capacity and safeguarding information;
• payment and transaction information for private services, without retaining full card details handled by the payment provider;
• communications, complaints, compliments, incidents and claims;
• delivery details and information needed to provide medicines safely at your home; and
• CCTV images where you enter an area covered by our security system.

Health information and certain other information are "special category" data and receive additional legal protection. We collect only what is relevant and proportionate for the purpose.

4. Where the information comes from

We may receive information:

• directly from you during a consultation, booking, telephone call, form or other contact;
• from a parent, guardian, carer, family member or other person acting for you;
• from prescriptions and NHS systems, including the Electronic Prescription Service where available;
• from your GP record or Welsh Clinical Portal where authorised access is available and relevant to the service;
• from GP practices, hospitals, health boards, NHS 111 Wales, care homes, laboratories, other pharmacies and healthcare professionals;
• from approved booking, clinical-service and patient medication record systems; and
• from devices, tests or measurements used during your assessment.

If you provide information about another person, please make sure you are authorised to do so. We may check identity, parental responsibility or authority to act where appropriate.

5. Why we use information and our lawful bases

We do not normally rely on data-protection consent to use information that is necessary for direct care. Clinical consent to an examination or treatment is separate from the lawful basis used under data-protection law.

6. How we use information in your care

Your information may be used to:

• confirm your identity, eligibility and suitability for a service;
• review medicines, allergies, relevant history and previous care;
• assess, diagnose, prescribe, dispense, vaccinate, test, monitor, refer or provide treatment;
• contact you about appointments, prescriptions, results, follow-up and patient safety;
• communicate relevant information to another professional involved in your care;
• manage repeat prescriptions, deliveries and medicine availability;
• document clinical decisions and demonstrate that care was provided safely;
• support safeguarding, infection prevention, public health and medicines safety; and
• improve service quality through audit, learning, training and governance.

Your choice and direct care

We will explain relevant choices wherever possible. However, refusing necessary information may mean we cannot safely provide a particular medicine or service. We may use or share information without consent where the law requires it or where this is necessary to protect someone from serious harm.

7. Our clinical and pharmacy systems

Titan is our current patient medication record system. Historic patient medication records remain in ProScript. Depending on the service, we may also use NHS Wales systems and approved platforms such as Choose Pharmacy, the Welsh Clinical Portal, electronic prescribing services, Pharmadoctor, Setmore and secure Microsoft 365 tools. Access is restricted to authorised personnel and is subject to confidentiality, security and audit controls.

Where an approved system allows us to view relevant GP or hospital information, staff access only what is necessary for the service and access may be audited. Information created by national NHS systems may also be controlled by the relevant NHS organisation, whose privacy information will apply alongside this notice.

8. Who we may share information with

We may share relevant information, where necessary and lawful, with:

• your GP practice and other pharmacists, prescribers or healthcare professionals involved in your care;
• NHS Wales bodies, Digital Health and Care Wales, health boards, hospitals, NHS Wales Shared Services Partnership and commissioners;
• laboratories, vaccination, clinical-service and referral providers used for your care;
• care homes, carers or representatives where authorised or otherwise lawful;
• our approved technology suppliers, professional advisers, auditors, insurers and confidential waste providers;
• delivery personnel, who receive only the information needed to make the delivery safely;
• the General Pharmaceutical Council, the Medicines and Healthcare products Regulatory Agency, the Information Commissioner's Office and other regulators;
• police, courts, safeguarding bodies or other public authorities where required or justified; and
• a buyer or successor if the business is reorganised or transferred, subject to confidentiality and data-protection safeguards.

We do not sell patient information. We do not share identifiable information for advertising by other organisations. Where practicable, information used for audit, planning, reimbursement or service improvement is minimised, pseudonymised or anonymised.

9. Confidentiality and your GP record

Pharmacy team members and people working for our service are bound by confidentiality duties. We normally share relevant care information with your GP or another healthcare professional where this supports safe, joined-up care. We will respect reasonable objections where possible, but there may be circumstances in which sharing is required by law or necessary for safety, safeguarding or the protection of others.

If you do not want a consultation summary or other information sent to your GP, please discuss this with the clinician. They will explain whether the service can proceed safely and whether any information must still be recorded or shared.

10. Communications and service invitations

We may contact you by telephone, text, email, letter or another agreed method about prescriptions, appointments, results, recalls, follow-up and safety. These are service communications. If you have opted in, we may also send relevant information about pharmacy services, health campaigns or vaccination opportunities. You can opt out of promotional messages at any time, but we may still send messages necessary for your care or safety.

Please tell us if your contact details or communication preferences change. Ordinary email and text messages may not be fully secure, so we limit sensitive content and use safer methods where appropriate.

11. Children, capacity and representatives

We consider the patient's age, understanding, capacity, parental responsibility and the requirements of the service. A child or young person who has sufficient understanding may be able to make some decisions about their information and care. We may communicate with a parent, guardian, carer or representative where the patient agrees, where that person has legal authority, or where another lawful reason applies. We disclose only what is appropriate in the circumstances.

12. Keeping information secure

We use proportionate technical and organisational safeguards, including staff training, confidentiality requirements, role-based access, secure systems, authentication controls, audit logs, physical security, secure disposal and supplier contracts. DHCW information-governance training is completed in accordance with NHS Wales requirements. No system can be guaranteed completely secure, and we review risks and incidents so that appropriate action can be taken.

13. International processing

Some approved technology providers may process information outside the United Kingdom. Where we are responsible for the transfer, we use an appropriate legal safeguard, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another mechanism permitted by law. You may ask us for further information about applicable safeguards.

14. How long we keep information

Different pharmacy and clinical records have different legal and professional retention periods. We retain information for the period required by medicines legislation, NHS Wales service specifications, the applicable health and care records-management code, tax and financial rules, patient-safety needs and the establishment or defence of legal claims. The period may depend on the type of record, the patient's age and the service provided.

Clinical and dispensing information may therefore be kept for a number of years after the last entry and cannot normally be erased simply because treatment has ended. CCTV is kept for a shorter, proportionate period unless footage is required for an incident, investigation or claim. When information is no longer required, it is securely deleted or destroyed. You may ask us about the period applying to a particular record.

15. Your data-protection rights

Depending on the circumstances, you may have the right to:

• be informed about how your information is used;
• request access to your personal information;
• have inaccurate or incomplete information corrected;
• request erasure or restriction of processing;
• object to particular processing;
• receive certain information in a portable format;
• withdraw consent where processing is based on consent; and
• receive safeguards concerning solely automated decisions with legal or similarly significant effects.

These rights are not absolute. In particular, pharmacy and clinical records may have to be retained for legal, professional and patient-safety reasons. We may ask for proof of identity or authority. There is normally no charge, and we normally respond within one month.

We do not currently use solely automated decision-making to determine whether you receive treatment or to make another decision with a legal or similarly significant effect.

16. Complaints

Please contact the Data Protection Lead if you have a concern about how we use your information. We will acknowledge a data-protection complaint within 30 days, investigate it and respond without undue delay. You may also contact our Data Protection Officer or complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113. You do not have to contact us before approaching the ICO.

Contact us about your information

The Data Protection Lead
Tynewydd Pharmacy
59 Gwendoline Street
Tynewydd, Treherbert
CF42 5BL
Email: gareth.tynewyddpharmacy@outlook.com
Telephone: 01443 771782

Our Data Protection Officer is Digital Health and Care Wales (NHS Wales). Email DHCW.PHARMACYDPO@wales.nhs.uk or write to: 6th Floor, Tŷ Glan-yr-Afon, 21 Cowbridge Road East, Cardiff CF11 9AD.

17. Changes to this notice

We review this notice when our services, systems, suppliers or legal requirements change. The current version and update date will be available in the pharmacy and on our website. We will bring significant new uses of patient information to your attention where appropriate.