GDPR & Data Protection

Who We Are

Kimberworth Pharmacy is a registered pharmacy operating at Langdon Road, Rotherham, S61 3QH. We are the Data Controller for personal data we process through our website and pharmacy services.

Our Principles

We process personal data in accordance with the following GDPR principles:

• Lawfulness: We only collect and process data where we have a legal basis to do so.
• Fairness & Transparency: We are clear about what data we collect and why.
• Purpose Limitation: Data is used only for the purpose stated at the point of collection.
• Data Minimisation: We only collect data that is necessary for the purpose.
• Accuracy: We take steps to keep data accurate and up-to-date.
• Storage Limitation: Data is kept only as long as needed.
• Integrity & Confidentiality: Data is kept secure and protected at all times.

We process personal data under the following lawful bases as set out in GDPR Article 6:

• Consent: When you agree to us processing your data (e.g., marketing emails).
• Contract: When processing is needed to fulfil a service you have requested from us.
• Legal Obligation: When required by law (e.g., NHS regulations, health records retention).
• Vital Interests: To protect your health and safety or that of another person.
• Public Task: When carrying out functions in the public interest.
• Legitimate Interests: When we have a legitimate business reason that does not override your rights.

Patient Health Data

We process health data to provide pharmacy services, including prescription information and medication history, allergy and adverse reaction records, consultation notes, and NHS and private health records.

Website Data

When you visit our website, we may collect your name, email address, and contact details; any messages or enquiries you submit; IP address and browsing information via cookies; and device and browser information.

Special Category Data

Health data is treated as special category data under GDPR Article 9. We process this only where you have given explicit consent or where we have a lawful basis such as the provision of health services.

Under UK GDPR, you have the following rights regarding your personal data:

Subject Access Requests (SAR)

To request a copy of your personal data, please submit a Subject Access Request. We will respond within 30 calendar days. In most cases, this is free of charge, though we may charge a reasonable fee for repeat or excessive requests.

Other Requests

To exercise any other right, please contact us in writing with your request and evidence of your identity. We will respond within 30 days. Please send requests to:

• Email: info@kimberworthpharmacy.co.uk
• Post: Kimberworth Pharmacy, Langdon Road, Rotherham, S61 3QH

We retain personal data only for as long as necessary to fulfil the purpose for which it was collected:

We may share your personal data with the following types of organisations:

• NHS Services: Doctors, hospitals, and healthcare providers for continuity of care.
• Regulatory Bodies: The pharmacy regulator (GPhC) and health authorities.
• Payment Processors: For processing payments securely.
• Website Hosts: To store and maintain our website.
• Legal Requirements: When required by law or court order.

We never sell your data to third parties. Any third parties who process data on our behalf are contractually obligated to protect it.

We take data security seriously and employ appropriate technical and organisational measures:

In the event of a personal data breach, we will:

• Notify affected individuals within 72 hours where there is high risk to their rights and freedoms.
• Notify the Information Commissioner's Office (ICO) where legally required.
• Provide details of the nature of the breach and steps taken to mitigate harm.
• Make reasonable efforts to assist you in protecting your information.

We operate within the UK and do not routinely transfer personal data outside the UK/EEA. If any transfer is necessary, we ensure appropriate safeguards are in place in accordance with GDPR Chapter V.