1. Who we are
This website and the PharmaPlus member portal are run by Pharma Plus Limited (trading as PharmaPlus), a company registered in England and Wales with company number 04982646. Our registered office is Unit B1 Livingstone Court, 55 Peel Road, Harrow, Greater London, HA3 7QT.
We are the controller of the personal information described in this policy. That means we decide how and why it is used. In this policy, “we”, “us” and “our” mean Pharma Plus Limited.
If you have any questions about this policy or your information, contact us at info@pharmaplusltd.co.uk, call 0208 863 3335, or write to us at the address above.
2. What this policy covers
This policy applies when you:
- visit our website;
- send us an enquiry through our contact form;
- register for, or use, the PharmaPlus member portal; or
- are a member of staff at a member pharmacy whose details are added to the portal.
Our blog is hosted separately, and websites we link to (for example payment or video sites) have their own privacy policies.
3. The information we collect
| Type of information | Examples | Where it comes from |
|---|---|---|
| Enquiry details | Name, email address, phone number, pharmacy name, and your message | You, through our contact form |
| Account details | Name, email address, phone number, pharmacy name, password (stored only in encrypted, hashed form), role and membership status | You, when you register; our administrators |
| Pharmacy details | Pharmacy address and contact details, NHS ODS code, and names of key role holders such as the superintendent and responsible pharmacist | You or your pharmacy’s administrators |
| SOP and training records | Which Standard Operating Procedures you have read and signed (with the date, time and version), your assigned roles, training records, competencies and certificates | You, your pharmacy’s administrators, or our administrators |
| Orders and events | Services you order, amounts, payment and fulfilment status, and events you sign up to | You; our administrators |
| Technical and security information | IP address, browser type, sign-in history, and session information | Collected automatically when you use the portal |
| Communications | Emails we send you about your account, and notes our team keeps about our dealings with you | Us |
We do not collect payment card details. Payments are made by bank transfer or through an external payment provider.
Please do not enter patient information into the portal. The portal is designed for pharmacy business and staff records only. It is not designed to hold patient details or other health information about individuals.
4. How we use your information, and our lawful basis
Data protection law requires us to have a lawful basis for each way we use personal information.
| Purpose | Lawful basis |
|---|---|
| Replying to enquiries you send us | Legitimate interests (responding to people who contact us) |
| Setting up and managing your membership and portal account, and giving you access to member resources | Contract (our membership agreement with you or your pharmacy). Where you are a staff member of a member pharmacy, legitimate interests (providing the service your pharmacy has signed up to). |
| Keeping SOP sign-off, training and competency records | Legitimate interests (helping member pharmacies keep and evidence the records they need to meet professional standards) |
| Processing orders and keeping financial records | Contract; legal obligation (accounting and tax records) |
| Sending service emails, such as account approval, password resets and SOP update notices | Contract; legitimate interests (keeping you informed about the service) |
| Keeping the website and portal secure, preventing misuse, and keeping audit logs | Legitimate interests (protecting our service and our members) |
| Complying with the law, and establishing or defending legal claims | Legal obligation; legitimate interests |
Where we rely on legitimate interests, we have considered whether your rights outweigh those interests. You can ask us for more information about this.
We only send marketing messages where the law allows, and you can opt out at any time. We do not use your information for automated decision-making that has legal or similarly significant effects on you.
5. Information added by your pharmacy
If you work at a member pharmacy, that pharmacy’s administrators may add or manage information about you in the portal, such as your roles, SOP sign-offs and training records. Your pharmacy decides what it records about its own staff, and can see that information. You can contact your pharmacy or us about it.
6. Who we share your information with
We do not sell your personal information. We share it only where needed to run our service, with the following types of recipient:
- Our technology providers, who process information on our behalf and only on our instructions:
Provider What they do Location Karad Infotech Ltd Develops, hosts and supports the website and portal United Kingdom Neon (on Amazon Web Services) Database hosting United Kingdom (London) Vercel Website hosting and delivery United Kingdom (London), with a global delivery network Cloudflare Storage of uploaded documents and certificates Europe Resend Sending service emails European Union and/or United States Microsoft Business email used for support and account notifications United Kingdom and/or European Union - Your pharmacy’s administrators, for information about staff at that pharmacy (see section 5).
- Professional advisers, such as accountants and lawyers, where needed.
- Regulators, law enforcement or courts, where the law requires us to share information.
- A buyer or successor, if our business or its assets are sold or restructured, in which case your information would continue to be protected in line with this policy.
7. Transfers outside the UK
Our main database is hosted in the United Kingdom. Some of our providers are based outside the UK or operate global networks, so your information may sometimes be processed elsewhere, for example when an email is sent. When this happens, we make sure it is protected by safeguards recognised under UK data protection law. These include UK adequacy regulations (which cover the European Economic Area and certified US organisations) and the ICO’s International Data Transfer Agreement or Addendum.
8. How long we keep your information
| Information | How long we keep it |
|---|---|
| Membership and portal account | While your membership is active, and for 12 months after it ends |
| SOP sign-off records and SOP audit trail | 6 years from the date of signing |
| Training records and certificates | 6 years after the record expires or the staff member leaves |
| Orders and financial records | 6 years from the end of the financial year they relate to |
| Contact enquiries and sign-in history | 24 months |
Backups are overwritten on a rolling basis, so deleted information may remain in backups for a short time before it is permanently removed. We may keep information for longer where the law requires it or where it is needed for a legal claim.
9. How we protect your information
We use appropriate technical and organisational measures to protect your information. These include encryption in transit and at rest, hashed passwords, role-based access controls, approval of new accounts before they can access member content, and audit logs. No website can be completely secure, so please keep your password safe and tell us straight away if you think your account has been compromised.
10. Your rights
Under UK data protection law, you have the right to:
- access the personal information we hold about you;
- ask us to correct information that is inaccurate or incomplete;
- ask us to delete your information;
- ask us to restrict how we use your information;
- object to us using your information on the basis of legitimate interests, or for direct marketing;
- ask us to transfer information you have given us to you or another organisation; and
- withdraw consent at any time, where we rely on consent.
Some of these rights only apply in certain circumstances. For example, we may need to keep SOP sign-off or financial records even if you ask us to delete them. To exercise any of your rights, email info@pharmaplusltd.co.uk. We may need to confirm your identity. We will respond within one month, and there is usually no charge.
11. Complaints
If you are unhappy with how we have handled your information, please contact us first at info@pharmaplusltd.co.uk so we can try to put it right. We will acknowledge your complaint within 30 days.
You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.
12. Cookies
We use a small number of cookies and similar technologies. See our Cookie Policy for details.
13. Children
Our website and portal are intended for pharmacy professionals and businesses. They are not aimed at children, and we do not knowingly collect information about anyone under 18.
14. Changes to this policy
We may update this policy from time to time. The “last updated” date at the top shows when it was last changed. If we make significant changes, we will tell portal users by email or through the portal.