Privacy policy

This policy explains what we do with your personal information. It covers the Muirend Pharmacy website at muirendpharmacy.co.uk and the pharmacy services we provide from our premises in Glasgow.

1. Who we are

Muirend Pharmacy is a trading name of Muirend Pharmacy Ltd, a company registered in Scotland. Our pharmacy is at 521–523 Clarkston Road, Muirend, Glasgow, G44 3PN.

Our premises are registered with the General Pharmaceutical Council (GPhC), registration number 1042294. Our Superintendent Pharmacist is James McKeever (GPhC 2042490).

Muirend Pharmacy Ltd is the data controller for the information described in this policy. That means we decide why and how your information is used, and we are responsible for looking after it.

To ask anything about your data, contact the Superintendent Pharmacist:

• Phone: 0141 637 2014
• In writing: Superintendent Pharmacist, Muirend Pharmacy, 521–523 Clarkston Road, Glasgow, G44 3PN
• Online: our contact page

2. What we collect

When you use this website

You can read every page of this website without giving us any information. We only collect data when you choose to send it.

• Prescription and Pharmaself24 forms, and the chat assistant: your name, date of birth, phone number, address and postcode, GP practice, the medicines you are asking for (name, strength and quantity), how you want to collect, and the consent boxes you tick.
• Online booking: the details you enter into the booking tool — usually your name, contact details, the service you want and your chosen appointment time.
• Technical data: our hosting provider records your IP address, browser type and the pages requested in standard server logs, so the site can be delivered and kept secure.

This website does not use analytics, advertising or tracking tools, and sets no cookies of its own. See our cookie policy.

When you use our pharmacy services

• Identity data: name, date of birth, and where relevant your CHI number
• Contact data: address, phone number, email address
• Health data: medicines, allergies, medical history, consultation notes, test results and treatment records — this is special category data and gets extra protection
• GP data: the name and address of your GP practice
• Service and payment data: records of the services we have given you and anything you have paid for

3. Our lawful bases

UK GDPR requires us to have a lawful basis for everything we do with your data. Ours are:

• Public task (Article 6(1)(e)) — delivering NHS Scotland pharmaceutical services under our contract with NHS Greater Glasgow and Clyde, such as Pharmacy First Scotland and dispensing NHS prescriptions
• Contract (Article 6(1)(b)) — providing a private service you have asked for, such as a travel appointment or a private vaccination
• Legal obligation (Article 6(1)(c)) — keeping the records that medicines law and GPhC standards require us to keep
• Vital interests (Article 6(1)(d)) — in an emergency where someone's life is at risk
• Legitimate interests (Article 6(1)(f)) — keeping this website secure, stopping spam and abuse of our forms, and running the pharmacy safely
• Consent (Article 6(1)(a)) — optional extras you tick, such as an SMS to tell you your prescription is ready. You can withdraw consent at any time.

For health information we also rely on Article 9(2)(h) — the provision of health care and the management of health care services — together with the condition at Schedule 1, Part 1, paragraph 2 of the Data Protection Act 2018. Everyone who handles this data is under a duty of confidentiality.

4. How we use your data

• Dispensing and checking your prescriptions safely
• Requesting repeat prescriptions from your GP practice on your behalf
• Providing NHS Scotland and private clinical services, and recording what we did
• Setting up and running Pharmaself24 collection, counter collection or home delivery
• Texting you when your prescription is ready, or sending your Pharmaself24 access code, if you asked us to
• Managing appointments you book online
• Answering your enquiries
• Meeting our NHS, GPhC and legal obligations, including responding to complaints
• Protecting our website and forms from spam and misuse

We do not sell or rent your data, and we do not share it with advertising platforms, marketing companies or social media networks. Health data is never used for advertising or profiling.

5. Who we share your data with

We share personal data only where we need to:

• Your GP practice — when we request or query a prescription for you
• NHS Scotland — including NHS Greater Glasgow and Clyde, NHS National Services Scotland (Practitioner Services) for payment and reimbursement, and NHS clinical systems used in community pharmacy such as the Pharmacy Care Record
• Other health professionals — where it is needed for your care, for example referring you to your GP or to NHS 24
• Regulators and public bodies — the GPhC, Healthcare Improvement Scotland, or the police and courts, where the law requires it
• Our service providers — listed in section 6, each acting on our written instructions as a data processor

6. Service providers used by this website

These are the third parties this website relies on. We name them so you can read their own privacy terms.

• Vercel — hosts this website and keeps standard server logs. Privacy notice
• Formspark — receives our prescription request, Pharmaself24 sign-up and chat assistant submissions, and forwards them to our clinical inbox at pharm.cp1042294clinical@nhs.scot. Your submission reaches Formspark only after passing our own anti-spam check, described below. Privacy notice
• DigiPharma — provides our online appointment booking. It loads only when you choose to open booking, inside a separate window on the page. Privacy notice
• Google Fonts — supplies the typefaces used across the site. Your browser requests these from Google, which receives your IP address. Privacy notice
• Unsplash — supplies some of the photographs on our service pages, loaded directly from their image service. Privacy notice

Our maps link opens Google Maps in a new tab. Nothing is sent to Google Maps unless you click it.

Our anti-spam check

We do not use a third-party CAPTCHA. When you submit a prescription request, Pharmaself24 sign-up or chat assistant form, the submission is first checked by our own software running on this website, before it is passed to Formspark. That check does three things: it confirms the form was genuinely opened in a browser rather than sent automatically by a bot, it discards submissions that arrive impossibly quickly, and it briefly holds your IP address in memory so that a single computer cannot flood our clinical inbox.

Your IP address is used only to count recent submissions and is held for no more than five minutes. It is not written to a database, not stored alongside your health information, not used to identify you, and never shared. The lawful basis is our legitimate interest in protecting a clinical inbox that pharmacy staff rely on, under Article 6(1)(f) UK GDPR.

7. Sending data outside the UK

Some of the providers in section 6 are based in, or store data in, countries outside the UK — mainly the United States and the European Economic Area.

Where that happens, the transfer is covered by UK GDPR safeguards: an adequacy decision made by the UK government (including the UK Extension to the EU–US Data Privacy Framework, where the provider is certified), or the ICO's International Data Transfer Agreement or Addendum to the standard contractual clauses.

Your NHS clinical records are held within the UK.

8. How long we keep your data

• Clinical and pharmacy records — kept for the periods set by the Scottish Government's Records Management: NHS Code of Practice (Scotland) and by medicines law. Prescriptions we have dispensed are kept for at least two years under the Human Medicines Regulations 2012, and controlled drug registers for at least two years from the last entry under the Misuse of Drugs Regulations 2001. Most clinical records are kept for considerably longer.
• Website form and chat submissions — held by our form provider for up to 30 days, then deleted. Anything clinically relevant is transferred into your pharmacy record and kept under the periods above.
• Appointment booking records — kept for as long as needed to provide the service and to evidence the care given
• Complaints — kept for as long as we need to show how the complaint was handled
• Server logs — kept by our hosting provider for a short period for security and troubleshooting

9. How we protect your data

• All connections to this website are encrypted with TLS
• Form submissions are protected by an anti-spam check and are sent to an NHS Scotland secure mailbox
• Access to clinical records is limited to staff who need it for your care
• All our staff are bound by confidentiality and receive information governance training
• Paper records are stored securely on the premises

If a data breach happens that is likely to put your rights at risk, we will report it to the ICO within 72 hours and tell you if you are likely to be seriously affected.

10. Your rights

Under UK GDPR you have the right to:

• Be informed — which is what this policy is for
• Get a copy of the personal data we hold about you (a subject access request)
• Have mistakes corrected
• Ask us to delete data — though we cannot delete clinical records we are legally required to keep
• Ask us to restrict what we do with your data while a concern is looked into
• Data portability — for data you gave us that we process by consent or under a contract
• Object to processing based on our legitimate interests or public task
• Withdraw consent at any time, for anything you agreed to by consent — such as SMS updates. This does not affect anything done before you withdrew it.

To use any of these rights, contact us on 0141 637 2014, write to the Superintendent Pharmacist at the pharmacy, or use our contact page. We may ask you to confirm who you are before we release records.

We will respond within one month. If your request is complex we may extend this by up to two further months, and we will tell you if we do. There is normally no charge.

11. Cookies

This website sets no cookies of its own and uses no analytics or advertising cookies. Our cookie policy explains the small number of third-party cookies that can appear if you open online booking, and how to control them.

12. Children and young people

We provide services to people of all ages. Where a child is not able to make their own decisions, a parent or carer can act for them. Young people who are able to understand what they are agreeing to can consent to their own care and to how their information is used, and we will respect their confidentiality.

13. Changes to this policy

We may update this policy when our services or the law change. The current version is always on this page, with the date it was last updated at the top. If we add any analytics or tracking to this website, we will update this policy and ask for your consent first.

14. How to complain

If you are unhappy with how we have handled your information, please tell us first — see our complaints procedure. We would rather put things right ourselves.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator:

• Website: ico.org.uk/make-a-complaint
• Phone: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

The ICO has a Scotland office at 45 Melville Street, Edinburgh, EH3 7HL.