Privacy Policy

1. What information do we collect about you and how do we collect it?
You are not required (by law or by any contract with us) to provide personal information to us when you visit our website. We will only require you to provide personal information to us where it is necessary for us to provide you with a service at your request, such as when you contact us, register an account on our website or undergo an online consultation and purchase our products.

1.1 Information you provide to us
We may collect personal information about you whenever you use our services, such as by doing the following:

Enquiring about our products or service
Undergoing our online clinical consultation
Purchasing our medicines or other products or services
Supplying us with your products or services
Using and browsing our website
Telephoning, texting, writing by post or emailing us
Enquiring about, or applying for, job vacancies.
This information may include the following:

Normal identification information, such as your full name and title, date of birth, age, gender, and marital status
Contact information, such as your postal address, email address and telephone numbers
Information about your health, including your current health and wellbeing status, your medical history and records, and details of any medicines or treatment that you are receiving
Correspondence or information provided by you in your patient area (such as prescriber chat messages, pharmacy chat messages or messages you send to our customer care team)
Information about your purchase (including your purchase history with us)
Payment information (this is securely collected and processed by our payment service provider; where you hold a subscription plan, a tokenised payment mandate is retained by our provider to take recurring charges — see clause 2.3)
Additional information relevant to your use of our website and services, such as your marketing preferences, survey responses and feedback
We understand that any information concerning your health is particularly sensitive (known as "special categories" of personal data). We take extra precautions to ensure that any special category data is kept secure and confidential and we will only retain this data for as long as necessary for the purposes for which we collect it.

1.2 Information we collect about you on our website
We collect information using cookies and other similar technologies to help distinguish you from other users of our website. These can streamline your online experience by saving you from re-inputting some information and allow us to make improvements to our website and analyse user statistics. For more information about how and why we use cookies, please take a look through our Cookie Policy.

When you visit our website we may collect the following information:

Which pages you view and which links you follow
Your IP address and general location
Details of the hardware and software that you are using to access the website
Any passwords that you use on our website
A device identifier (cookie or IP address) for fraud prevention
Details of your visits to our website and the resources that you access, including, but not limited to, traffic data, location data, web logs and other communication data
You must be at least 18 years old to use our website and services. We do not knowingly collect any personal data relating to children.

1.3 Cookies
1.3.1 What is a cookie? A cookie is a small text file that is sent by a website server to your browser and stored on your computer. Cookies allow website operators to accumulate useful information, such as whether the computer (or its user) has visited the site before. Cookies are needed for a number of functions which make websites work, or work more efficiently, and they can provide information to website owners about how you use their website. Cookies can also be used to show you adverts that are relevant to you, based on your browsing habits, to personalise your user experience.

1.3.2 How do we use cookies? We use cookies to monitor how people use our website, including estimating audience size and patterns of use, to help us provide you with a better service. Cookies also make it easier for you to use the website on future visits, and allow us to personalise the content of the website to you by recording information about your preferences.

We use both persistent cookies (which expire on a specified date) and session cookies (which expire when you close your browser). The cookies used on this site have been categorised based on definitions given in the ICC UK Cookie Guide. We use strictly necessary, functionality, analytical/performance, and targeting/advertising cookies.

Please note that third parties (including, for example, web-traffic analysis services such as Google Analytics, or advertising services and vendors) may also use cookies, over which we have no control. We also use services provided by Google and Meta (Facebook) that work in a similar way to interest-based cookies used in marketing and targeting. These help us to show you adverts when you interact with these platforms, and display our content to existing or potential users of our site. To do this, we share a masked ID, which is an encrypted alias of your email address to ensure you remain anonymous unless additional data about you is provided (which we do not share). You can opt out of our marketing communications and these adverts will no longer be shown to you on these networks. You can read more at www.youronlinechoices.com/uk/.

You can configure cookie settings in your web browser. However, please bear in mind that if you don't allow us to use certain cookies it may prevent you from accessing parts of our website or result in a loss of functionality which degrades your experience of the website.

1.3.3 Further information about cookies. For more information about cookies generally visit allaboutcookies.org.

1.3.4 Get in touch. Please contact us at [email protected] if you have any questions about how we use cookies or about your privacy.

1.4 Information we collect about you from other sources
We may collect information about you from other sources. This may include the following:

Publicly available information, from sources such as the Electoral Roll or Companies House
Information you have shared publicly, including on social media (particularly in respect of job applications)
Information from third party databases such as identity and credit reference agencies, which may include details about your home
Information from your other healthcare providers (only with your consent, or where it is necessary for us to provide our service, or to comply with our legal obligations)
This list is not exhaustive and, in specific instances, we may need to collect additional data for the purposes set out in this policy.

1.5 Information we receive about you from other sources
Sometimes you will have given your consent for other websites, services or third parties to provide information to us. This could include information we receive if you use any of the other websites or services that we operate, or information from third parties that we work with to provide our products and services, such as payment processors, delivery companies, technical support companies and advertising companies. Whenever we receive information about you from these third parties, we will let you know what information we have received and how and why we intend to use it.

2. How and why do we use your personal information?
We take data protection law seriously, so below we have set out exactly how and why we use your information, and what our legal basis is to be able to use your information in each way.

2.1 Patient Accounts
When you register an account on our website as a patient, we will collect and use your personal information in order to maintain and administer your patient account. This may be necessary in order for us to perform our contract with you or, otherwise, we have a legitimate interest to manage our patients' accounts to facilitate purchases and communication between us. You may contact us at any time to close your patient account. However, please bear in mind that we may be required to retain your personal information in order to comply with our legal obligations.

2.2 Online consultations
If you wish to purchase medicines on our site, you will be required to complete an online clinical consultation questionnaire. This information is reviewed by one of our GPhC-registered pharmacy prescribers. If our clinicians feel that they require further information from you after reviewing your answers, they will ask you to provide this via our secure chat facility.

The information you provide during the consultation is essential to the clinical decision-making process. Our prescribers and pharmacists need to know about your current health, your medical history and any other treatment you are receiving, so that they can make sure that the treatment being consulted for is safe and suitable for you.

Because your consultation involves special category (health) data, we process it under Article 9(2)(h) of the UK GDPR(the provision of health care and treatment by, or under the responsibility of, a health professional) and, where relevant, Article 9(2)(a) (your explicit consent). The underlying processing is necessary to perform our contract with you and to comply with our legal and professional obligations as a registered pharmacy.

2.3 Supplying our medicines and other products
It is necessary for us to use personal information about you to enter into and perform the contracts that we make with you, such as when you purchase medicines or other products on our website. Using your information in this context is necessary so that we can:

Provide you with information about our products and services
Administer your order, including take payments and arranging delivery
Provide you with information about your purchase and your contract with us
Make decisions about your purchase, including about the suitability of any medicines
Provide you with alerts regarding repeat prescription orders, plan renewals and any failed or missed payments
Verify your identity
Deal with any complaints you may have
Contact you about any changes that we make to our products or services
Administer our website, including troubleshooting problems, analysing statistics, conducting research and tests and keeping the website secure
Subscription plans and recurring payments. Where you purchase a subscription plan, our payment service provider securely retains a tokenised payment mandate so that we can take the recurring monthly plan charges, any renewal payments and any early-exit charge in accordance with our Terms. We do not store or have access to your full card details.

Part of our service as a pharmacy involves notifying you when your medicine is due to run out. We will therefore send a courtesy email so that you can reorder your treatment if you are on a continuous prescription, and (for subscription plans) reminders relating to your plan renewal. We estimate when to send you a reminder based on the quantity you have ordered, and only send these for treatments taken on a repeat basis.

When you purchase any test kits from us, we will use the information you provide to notify you of your result and, if appropriate, suggest a course of treatment.

2.4 Telling you about other products or services that we think may be of interest to you
We may use your information to identify and tell you about our products or services that we think may be of interest to you. We will only do this where you have informed us that you would like to receive marketing communications, such as where you subscribe to our newsletter. You may update your preferences at any time by contacting us. We may also use your information to invite you to participate in patient feedback surveys and other market research; you do not have to participate. Whether you choose to receive marketing communications, or market research communications, is entirely up to you and will not affect any products or services that you have purchased from us.

2.5 Telling you about products or services that are similar to ones that you have already bought
If you have already bought medicines or other products from us, we may contact you with information about similar products and services that we offer. We have a legitimate interest to contact you for this purpose, but you may object to receiving these messages at any time. We will only contact you by email or text message and you can choose not to receive these messages at any time by following the unsubscribe instructions in the message, or contacting us.

2.6 Making our business better
We always want to offer the best products, services and user experience that we can. We have a legitimate interest to use your information to improve our business, and we will only use your information where it is necessary so that we can review and improve our existing products, services and new ones; review and improve the performance of our systems, processes and staff (including training); improve our website; and measure and understand the effectiveness of advertising we serve to you and others, and deliver relevant advertising to you.

2.7 Research and analysis
We may use anonymised data related to your order or use of our site for research or public-facing purposes, for example in statistical analyses of users accessing our service for a specific purpose.

2.8 Contacting you
We want to stay in touch with you. Sometimes we may need to use the information that we have about you in order to respond to your questions or let you know about important changes. We have a legitimate interest to keep in contact with you, as a customer, but this may also be necessary in connection with our contract with you. We will primarily contact you via email, SMS messaging and your patient area on our website to update you on your order. In certain cases, where our customer service team needs to contact you regarding your order, we may contact you by telephone. If one of our prescribers needs to contact you regarding your consultation, or needs more information, they will usually do this via your patient area (you will be notified by email of a new message), though on some occasions they may need to contact you by telephone. If we have made several attempts to reach you by email or telephone and have been unsuccessful, we may contact you by sending a written letter to your home address.

2.9 Verifying your identity
We may use your information where it is necessary for us to do so in order to meet our legal obligations and to detect and prevent fraud, money-laundering and other crimes.

2.10 Protecting you and others from harm
We may use your information where it is necessary to protect your interests, or the interests of others, in accordance with our legal obligations and the pursuit of legitimate interests. This may include in the event of criminality such as identity theft, piracy or fraud.

2.11 Change of purpose
We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose we will notify you and we will explain the legal basis which allows us to do so. Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

3. Who do we share your personal information with?
3.1 Sharing your information within our organisation
We are Express Healthcare Limited (trading as Bliss). We share the information that you provide to us with our staff so that we can provide our products and services to you. In particular, the following have access to the data that you provide to us:

Our UK pharmacy prescribers, who are also responsible for reviewing your order
Our clinical lead, who supervises our practice
Our patient services team, which processes your order
Express Healthcare Limited also operates other services (including PharmacyOnline.co.uk), and shared teams within our organisation may handle some customer care operations across those services.

3.2 Sharing your information with third parties
We may share your data with selected third parties. For example, we may share your information with:

Our payment service provider, to process payments on our behalf. We will share your full name, address, phone number, email address and details of your order for this purpose. Our payment provider will collect and process your payment details; we will not store or have access to your full credit or debit card details.
Onfido, our identity-verification provider, for carrying out identity checks. All orders made through our site are subject to identity checks in order to prevent online fraud. Your full name, date of birth and home address will be shared for this purpose.
Third party couriers (e.g. DPD, Royal Mail or UPS) in order to arrange delivery of your order. We will only share your full name, postal address and phone number or email address.
Your GP. During consultation we will ask whether you would like us to inform your GP about the consultation you have taken and the treatment you have ordered. If you do, we will share with your doctor the type and quantity of treatment prescribed, the date it was prescribed and, where appropriate, details of the consultation. If there is any specific part of your record you would prefer not to be shared, you can let us know and we will respect this. We strongly recommend that you permit us to inform your GP of the treatment you have received, so that they can continue to provide you with the best possible care.
Clinical auditors and regulatory bodies. Our pharmacy is registered with the General Pharmaceutical Council and our prescribers are registered with the General Pharmaceutical Council. Medicines are regulated by the Medicines and Healthcare products Regulatory Agency. Our practices are routinely inspected by these regulatory bodies, and during an inspection we may be required to share information about your consultation with an approved auditor.
Communication, marketing and messaging platforms, to send emails, SMS messages, instant messages and social media messages, and to run lifecycle and advertising campaigns (for example, Klaviyo, Meta and Google).
An accredited pathology laboratory, for processing samples where you order any test kit from us. We will share your name, date of birth and test reference number for this purpose. ⚑ name the specific laboratory here once your testing provider is confirmed.
There are certain other exceptional circumstances in which we may disclose your information to third parties — where the disclosure is required by law or to comply with judicial or regulatory proceedings; necessary to protect the safety of our employees, our property or the public; necessary for the prevention or detection of crime; or proportionate as part of a merger, business or asset sale.

3.3 International transfers
Some of the third parties we work with — including our email/SMS marketing and lifecycle platform, and the advertising platforms we use (such as Klaviyo, Meta and Google) — are based outside the United Kingdom, including in the United States. Where we transfer your personal information outside the UK, we ensure a similar degree of protection by relying on one of the following safeguards:

transfers to countries covered by UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework, where the recipient is certified); or
the UK International Data Transfer Agreement (IDTA), or the EU Standard Contractual Clauses together with the UK Addendum, supported by a transfer risk assessment where required.
You may contact us for more information about the safeguards we use for a particular transfer.

4. How long do we keep your personal information?
We will only store your personal information for as long as we need it for the purposes for which it was collected. Where we provide you with any service, such as where you register an account as a patient on our website, we will retain any information you provide to us at least for as long as we continue to provide that service to you.

We retain personal data relating to patient health care and prescriptions in accordance with the guidance issued by the Information Governance Alliance and the NHS. On the expiry of these periods, we will review the information that we hold and, unless we have a legitimate reason to keep holding that information, it will be securely deleted. Generally, we may retain personal data relating to prescriptions issued and dispensed and other care records for a period of 13 years (for adult patients) or 25 years (for any patient who is pregnant). In all other circumstances (such as where you contact us without making a purchase), we will keep your information for a period of no more than 3 years.

5. How do we protect your personal information?
We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this policy. We try to ensure that all information you provide to us is transferred securely via the website (always check for the padlock symbol in your browser, and "https" in the URL, to ensure that your connection is secure).

Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our website; any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access. All information you provide to us is stored on secure servers. Where we have given you (or where you have chosen) a password which enables you to access certain parts of our website, you are responsible for keeping this password confidential. We ask you not to share a password with anyone.

6. What rights do you have in respect of your personal information?
If you require any further information about your rights as explained below, or if you would like to exercise any of your rights, please contact us.

6.1 You have the right to be informed. We have a legal obligation to provide you with concise, transparent, intelligible and easily accessible information about your personal information and our use of it. We have prepared this policy to do just that, but please contact us if you have any questions.

6.2 You have the right to access your personal data. You have the right to ask us to confirm whether or not we hold any of your personal information. If we do, you have the right to have a copy of your information and to be informed of why we have been using it, what categories of information we used, who we have shared it with, and how long we envisage holding it. In order to maintain the security of your information, we will have to verify your identity before we provide you with a copy. The first copy is provided free of charge; for further copies we may charge a reasonable administrative fee.

6.3 You have the right to correct any inaccurate or incomplete personal data. If you believe that any of the information we hold about you is inaccurate, incomplete, or out of date, you have the right to require us to rectify it. You can update your personal information in the patient area on our website, or contact us so that we can correct our records.

6.4 You have the right to be forgotten. There may be times where it is no longer necessary for us to hold personal information about you. In these situations you have the right to require us to delete your personal data (although please be aware that we may be required to retain certain information in order to comply with our legal obligations).

6.5 You have the right to have your data transferred to you or a third party in a common format. Also known as data portability, you have the right to require us to transfer your personal information, in a structured, commonly used and machine-readable format, either to you or to another service provider. If you would like us to do this, please contact us. There is no charge for exercising this right.

6.6 You have the right to object to direct marketing. You can tell us at any time that you would prefer that we do not use your information for direct marketing purposes, by contacting us or using the links provided in any of our marketing communications.

6.7 You have the right to object to us using your information for our own legitimate interests. If you believe that the way we are using your data is not justified due to its impact on you or your rights, you have the right to object. Unless we have a compelling reason to continue, we must stop using your personal data for these purposes.

6.8 You have the right to withdraw your consent. Where we rely on your consent (such as where you subscribe to our newsletter), you have the right to withdraw that consent at any time, using the "unsubscribe" links in any of the communications that we send you, or by contacting us.

6.9 You have the right to restrict how we use your personal data. You have the right to ask us to stop using your personal data in any way other than simply keeping a copy of it, in certain circumstances. If you wish to exercise this right please contact us.

6.10 You have rights related to automated decision-making and profiling. Any automated decision-making or profiling we undertake is solely for the purpose of tailoring the information which we provide to you. We will not use automated decision-making or profiling to make any decisions which will have a legal effect upon you or otherwise significantly affect you, and you have the right not to be subject to such decisions.

7. Changes to our Privacy Policy
Any changes we make to our privacy policy in the future will be posted on this page and, where appropriate, notified to you by email. Please check back frequently to see any updates or changes to our privacy policy. This version was last updated on [DATE] and historic versions can be obtained by contacting us.

8. Complaints
If you wish to make a complaint about our collection or use of your personal data, please contact us in the first instance so that we may seek to resolve your complaint. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the statutory body which oversees data protection law in the UK. Please visit the ICO website if you wish to lodge a complaint with the ICO.

9. Contact Us
If you have any questions about your privacy or our use of your personal data, please contact our Data Protection Officer at [email protected], or by post at 32 Welbeck Road, Glasgow, G53 7SD. If you would like to speak to us, or you have any questions about our website, please get in touch using the contact page or by telephone.