Website Privacy Policy

Scope of this policy

This policy covers the Tynewydd Pharmacy website, online enquiries, appointment links and online forms. Clinical records created when we provide pharmacy or healthcare services are also governed by our separate Patient Privacy Notice.

1. Who we are

GRH Pharma Ltd (company number 14196408), trading as Tynewydd Pharmacy, is the data controller for the personal information described in this policy. Our registered office is Suite 2d, Building 1, Eastern Business Park, St Mellons, Cardiff, CF3 5EA. Our pharmacy is at 59 Gwendoline Street, Tynewydd, Treherbert, CF42 5BL. Tynewydd Pharmacy is registered with the General Pharmaceutical Council (registration 1043630) and with the Information Commissioner's Office (registration ZB511077; current registration expiry 8 February 2027).

2. Information we may collect

We collect only the information we need for the relevant purpose. Depending on how you use the website, this may include:

• your name, date of birth, address, email address and telephone number;
• appointment, enquiry and service details, including the service requested and your preferred time;
• prescription, pharmacy nomination and medicine-request information;
• health information you choose to provide, such as symptoms, medical conditions, medicines, allergies, vaccination history or clinical answers;
• details of a parent, guardian, carer or other representative where relevant;
• your communication, marketing and cookie preferences;
• technical information such as IP address, device/browser details, pages visited, security logs and cookie identifiers; and
• reviews or feedback you submit or make public on a review platform.

Health information is special category personal data and receives additional protection under data protection law.

3. Where information comes from

Most information comes directly from you, including when you complete a form, book an appointment, telephone us or contact us by email. We may also receive information from someone acting for you; Setmore, Pharmadoctor or another booking/service platform you use; NHS Wales, a GP practice, hospital or other care provider where you have agreed or the law permits; and website technologies used to operate and protect the site.

4. Why we use information and our lawful bases

We will tell you if information is required by law, by a contract or to provide a requested service, and what may happen if it is not provided.

5. Booking platforms, forms and clinical systems

Our website may connect you to Setmore for bookings and to Pharmadoctor or another approved clinical platform for particular services. Online forms may be provided through Tynewydd Pharmacy's controlled Microsoft 365 environment. These providers process information for us under contractual and security requirements, and may also provide their own privacy information.

When information from a website form or booking becomes part of your pharmacy or clinical care, relevant details may be transferred to our clinical records. Titan is our current patient medication record system; historic records remain in ProScript. Access is limited to authorised personnel with a work-related need.

Please do not use a general enquiry form for an emergency.

If you need urgent medical help, use NHS 111 Wales or 999 as appropriate. Online messages are not continuously monitored.

6. Who we may share information with

Where necessary and lawful, we may share information with:

• NHS Wales bodies, Digital Health and Care Wales, health boards, GP practices, hospitals and other healthcare professionals involved in your care;
• our approved technology and professional service providers, including GoDaddy, Microsoft, Setmore, Pharmadoctor, Titan and ProScript suppliers;
• regulators, auditors, insurers, legal advisers, law-enforcement bodies or public authorities where required or justified; and
• a buyer or successor if our business is reorganised or transferred, subject to appropriate confidentiality and data-protection safeguards.

We do not sell personal information. We do not require a private prescription to be dispensed by Tynewydd Pharmacy as a condition of receiving clinical advice.

7. Links, maps and reviews

The website may include links to NHS, Google, Setmore and other external services, and may display an embedded map or review information. If you follow a link or interact with embedded third-party content, that provider may collect information under its own privacy and cookie terms. Where required, optional embedded content should remain blocked until you consent.

8. International transfers

Some service providers may process information outside the United Kingdom. Where this happens, we require an appropriate legal transfer mechanism, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another safeguard permitted by law. You can ask us for further information about the relevant safeguards.

9. How long we keep information

We keep information only for as long as needed for the purpose collected, clinical and patient-safety requirements, NHS and professional retention rules, legal obligations and the establishment or defence of claims. General website enquiries are normally retained for up to 12 months after they are resolved unless they become part of a patient record or must be kept longer for a justified reason. Form and booking data is periodically deleted from the originating system once actioned and securely transferred where required. Clinical records are retained under the applicable NHS, legal and professional schedules and are explained further in our Patient Privacy Notice. Cookie durations are described in our Cookie Policy and cookie settings panel.

10. Communications and marketing

We may send messages needed to manage an appointment, prescription, requested service or your care. These are service communications, not marketing. With appropriate consent, we may also send information about pharmacy services, health campaigns or vaccination opportunities. You can withdraw marketing consent at any time by contacting us or using any opt-out offered. Withdrawing marketing consent will not stop essential service or safety messages.

11. Children and people using representatives

Some services are available to children and young people. We consider age, understanding, parental responsibility and the requirements of the particular service. A parent, guardian or representative should provide only information they are authorised to provide. We may verify identity or authority where appropriate.

12. Security

We use proportionate technical and organisational measures, including role-based access, staff confidentiality requirements, secure systems, supplier contracts, authentication controls and encryption where appropriate. No internet transmission can be guaranteed completely secure, so please use the designated secure form rather than ordinary email for detailed health information whenever one is available.

13. Your data-protection rights

Depending on the circumstances, you may have rights to be informed; access your information; correct inaccurate information; have information erased; restrict or object to processing; receive certain information in a portable format; and withdraw consent. You also have rights relating to solely automated decisions with legal or similarly significant effects. We do not currently use the website to make such decisions.

These rights are not absolute. For example, we may need to retain clinical records or continue processing required by law or for patient safety. We may ask for proof of identity before responding. There is normally no fee, and we normally respond within one month.

14. Complaints

Please contact the Data Protection Lead first if you have a concern. We will provide a clear route to complain, acknowledge a data-protection complaint within 30 days, investigate it and respond without undue delay. You may also contact our Data Protection Officer or complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or by telephone on 0303 123 1113. You do not have to contact us before approaching the ICO.

Contact us about your information

The Data Protection Lead
Tynewydd Pharmacy
59 Gwendoline Street
Tynewydd, Treherbert
CF42 5BL
Email: gareth.tynewyddpharmacy@outlook.com
Telephone: 01443 771782

Our Data Protection Officer is Digital Health and Care Wales (NHS Wales). Email DHCW.PHARMACYDPO@wales.nhs.uk or write to: 6th Floor, Tŷ Glan-yr-Afon, 21 Cowbridge Road East, Cardiff CF11 9AD.

Changes to this policy

We may update this policy when our website, services, suppliers or legal requirements change. The current version and update date will be published on the website. Significant changes will be highlighted where appropriate.