Privacy Policy
Last updated: 7th June 2026
This Privacy Policy explains how Church Pharmacy collects, uses, and protects personal information when you use our website, book an appointment with us, or use our pharmacy and clinical services. It should be read alongside our Terms and Conditions.
We are committed to protecting your privacy and handling your personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and applicable NHS confidentiality standards.
1. Who we are
Church Pharmacy is the trading name of WIR LTD, a company registered in England and Wales (company number 05293077).
Address: 99 Queens Road, Weybridge, Surrey, KT13 9UQ
Telephone: 01932 842 632
Email: ku.oc.cinilcycamrahphcruhc@ofni
For the purposes of UK GDPR, Church Pharmacy is the data controller of the personal information we hold about you. We are registered with the Information Commissioner’s Office (ICO).
ICO registration number: Z9150372
Our Data Protection Officer is:
Somia Jamil
Contact: ku.oc.cinilcycamrahphcruhc@ofni (mark “FAO Data Protection Officer”)
2. What information we collect
We collect personal information in the following circumstances:
When you visit our website
- Technical information about your device (IP address, browser type, operating system)
- Information about your visit (pages viewed, time on site, referring website)
- Cookie data, where you have consented (see section 8)
When you book an appointment
- Your name, date of birth, address, telephone number, and email address
- The service you are booking and your preferred date and time
- Any clinical information you provide as part of the booking (for example, symptoms, travel destinations, medical history relevant to the service)
When you use our pharmacy and clinical services
- NHS number (where applicable)
- GP details
- Prescription and medication history
- Clinical observations, assessments, and consultation notes made by our pharmacist or clinician
- Records of services provided (vaccinations, consultations, screenings, etc.)
- Payment records for private services (the payment itself is taken in person; we record that payment was made but do not store card details on our systems)
When you contact us
- Your contact details and the content of your enquiry
3. Why we collect this information and our lawful basis
Under UK GDPR we must have a lawful basis for processing your personal data. For health information (which is “special category” data) we also need an additional condition. The bases we rely on are:
| Purpose | Lawful basis (Art. 6) | Special category condition (Art. 9) |
|---|---|---|
| Providing NHS services | Public task (6(1)(e)) | Health or social care (9(2)(h)) |
| Providing private clinical services | Contract (6(1)(b)) | Health or social care (9(2)(h)) |
| Maintaining clinical records | Legal obligation (6(1)(c)) | Health or social care (9(2)(h)) |
| Website analytics and cookies | Consent (6(1)(a)) | Not applicable |
| Responding to enquiries | Legitimate interests (6(1)(f)) | Not applicable |
| Sharing safeguarding concerns | Legal obligation (6(1)(c)) | Substantial public interest (9(2)(g)) |
4. How we use your information
We use your personal information to:
- Provide pharmacy and clinical services to you safely and effectively
- Maintain accurate clinical records as required by NHS contract and GPhC professional standards
- Communicate with you about your appointment, treatment, or follow-up care
- Share information with your GP and other NHS bodies where this is necessary for your care
- Process NHS payments and audit our service delivery
- Comply with legal, regulatory, and professional obligations
- Improve our website and services
- Respond to your enquiries
We do not use your information for marketing purposes without your specific consent, and we do not sell your personal data to third parties.
5. Who we share your information with
We share your information only where necessary and lawful. Recipients may include:
- Your GP and other NHS healthcare providers involved in your care
- NHS England, the NHS Business Services Authority, and your Integrated Care Board — for payment processing, audit, and contractual compliance
- The UK Health Security Agency (UKHSA) — for vaccine and travel health reporting where required
- The General Pharmaceutical Council (GPhC) — in connection with regulatory inspections or investigations
- Cliniko (operated by Red Guava Pty Ltd) — our booking and practice management platform, acting as a data processor on our behalf
- External auditors — occasionally, to verify the accuracy of our records and NHS claims
- Law enforcement, courts, or safeguarding authorities — where we are legally required or have a professional duty to disclose information
All third parties who process data on our behalf are required to do so under written contract, in accordance with UK GDPR, and to maintain appropriate security measures.
6. Where your information is stored
- NHS clinical records are held on our pharmacy clinical systems, hosted within the UK
- Booking data submitted through our website is processed and stored by Cliniko on servers located in the European Union (Frankfurt, Germany). Cliniko’s privacy notice is available at https://www.cliniko.com/policies/privacy/
- Email correspondence is held on our email systems
- Paper records, where they exist, are held securely at our Weybridge premises
Where data is transferred outside the UK, we ensure appropriate safeguards are in place as required by UK GDPR (such as UK adequacy regulations or standard contractual clauses).
7. How long we keep your information
We retain your information for as long as we are required to by NHS regulations, professional standards, and law. In summary:
- NHS prescription and clinical records: retained in accordance with the NHS Records Management Code of Practice (typically 8 years from last entry for adults, longer for children)
- Private clinical records: retained for at least 8 years from last contact
- Vaccination records: retained for at least 7 years
- Website analytics and cookies: retained for periods set out in our cookie banner / cookie policy
- General enquiries: retained only as long as necessary to deal with the enquiry, then deleted
After the relevant retention period, your information is securely destroyed.
8. Cookies
Our website uses cookies — small text files placed on your device when you visit. We use:
- Strictly necessary cookies — required for the website to function. These do not require your consent.
- Analytics cookies — to understand how visitors use the site so we can improve it. These are only set with your consent.
- Functional cookies — to remember your preferences (e.g. cookie consent choices).
When you first visit our website, you will see a cookie banner asking for your consent to non-essential cookies. You can change your preferences at any time via the banner or your browser settings.
We do not currently use advertising or tracking cookies for marketing purposes.
9. Your rights
Under UK GDPR you have the following rights in relation to your personal data:
- Right of access — to request a copy of the information we hold about you
- Right to rectification — to ask us to correct inaccurate or incomplete information
- Right to erasure — to ask us to delete your information in certain circumstances (note: this right is limited where we are legally required to retain clinical records)
- Right to restrict processing — to ask us to limit how we use your information
- Right to data portability — to receive your data in a structured, commonly used format
- Right to object — to object to certain types of processing, including processing for our legitimate interests
- Right to withdraw consent — where we rely on your consent (you can withdraw it at any time, without affecting earlier lawful processing)
- Rights in relation to automated decision-making — we do not use automated decision-making or profiling in providing our services
To exercise any of these rights, contact us using the details in section 1. We will respond within one month. There is normally no charge.
Right to opt out of NHS data use for planning and research
You can opt out of your data being used by the NHS for purposes beyond your direct care (such as planning and research). This is done through your GP or via the NHS National Data Opt-Out: https://www.nhs.uk/your-nhs-data-matters/
10. Keeping your information secure
We take the security of your information seriously and have appropriate technical and organisational measures in place, including:
- Password protection and access controls on our clinical and booking systems
- Secure smart-card access for NHS systems
- Staff training in confidentiality and data protection, refreshed annually
- Encryption of data in transit (HTTPS on our website; encrypted connections to NHS systems)
- Locked storage for any paper records
- Restricted access on a “need to know” basis — only staff involved in your care can see your clinical information
Despite these measures, no system is completely secure. If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and, where required, notify you directly.
11. Children’s data
We provide services to children (for example, childhood travel vaccinations) and will process their data with the consent of a parent or legal guardian. Where a child is competent to consent to treatment in their own right, they may also exercise their data protection rights in relation to that treatment.
12. Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or in the law. The most current version will always be posted on our website. The “Last updated” date at the top of the policy indicates when it was most recently amended.
13. How to make a complaint
If you are concerned about how we have handled your personal information, please contact us first using the details in section 1. We take all concerns seriously and will respond as quickly as we can.
If you remain unsatisfied, you have the right to complain to the Information Commissioner’s Office (ICO):
- Website: https://ico.org.uk
- Helpline: 0303 123 1113
- Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
You may also raise concerns about NHS data handling with NHS England or your local Integrated Care Board.
14. Contact us
For any questions about this Privacy Policy or how we handle your information:
Church Pharmacy
99 Queens Road, Weybridge, Surrey, KT13 9UQ
Telephone: 01932 842 632
Email: ku.oc.cinilcycamrahphcruhc@ofni
For matters specifically for the attention of our Data Protection Officer, please mark your correspondence “FAO Data Protection Officer”.
