Privacy & Data Protection Policy
Last updated: September 2026 • Compliant with UK GDPR & Data Protection Act 2018
Strict Confidentiality
Your medical assessment data and personal information are encrypted using bank-grade AES-256 protocols and stored on secure UK-based servers.
Special Category Data
Medical history, BMI metrics, and treatment records are treated as Special Category Health Data with extra legal protections under UK GDPR Article 9.
No Data Sales
We strictly never sell, rent, or trade your personal or health data to third-party marketing companies or advertising networks under any circumstances.
1. Introduction & Data Controller
Medical Weight Pharmacy (“we”, “us”, “our”) is committed to protecting your privacy and ensuring the security of your personal and health information. This Privacy Policy explains how we collect, use, store, and share your personal data when you use our website and online consultation services.
Medical Weight Pharmacy operates as the Data Controller under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We are registered with the Information Commissioner’s Office (ICO) and regulated by the General Pharmaceutical Council (GPhC).
2. Information We Collect
To provide safe clinical evaluation and fulfill prescription weight management treatments, we collect several categories of information:
A. Personal Identity & Contact Information
- Full name, date of birth, gender, and photographic ID (where age verification or clinical safety requires it).
- Billing address, shipping address, email address, and telephone number.
B. Special Category Health Data
- Online medical questionnaire responses, current height, weight, BMI calculations, medical history, and existing health conditions.
- Current medications, allergies, and clinical consultation notes written by our prescribing team.
- Your registered GP practice details (if provided for clinical notification purposes).
C. Technical & Order Data
- IP address, browser type, device information, and page interaction logs.
- Order history, transaction amounts, and delivery tracking status (payment card details are processed directly by PCI-DSS compliant payment gateways and are never stored on our servers).
3. Lawful Basis for Processing
Under UK GDPR, we must have a valid legal basis to process your personal data. The table below outlines how we use your information and our legal grounds for doing so:
| Purpose / Activity | Type of Data | Lawful Basis under UK GDPR |
|---|---|---|
| Processing orders & delivery | Contact, Identity, Financial | Performance of a Contract (Art. 6(1)(b)) |
| Clinical consultations & prescribing decisions | Special Category Health Data | Provision of Healthcare & Treatment (Art. 9(2)(h)) |
| Notifying your GP (with consent) | Health Data, Contact Info | Explicit Consent (Art. 9(2)(a)) / Vital Interests |
| Prescription record retention & audit obligations | Health Data, Order Records | Legal Obligation (Art. 6(1)(c) & GPhC Standards) |
| Customer service & site improvement | Technical, Usage, Contact | Legitimate Interests (Art. 6(1)(f)) |
4. How We Share Your Information
We share your data only with trusted partners essential to providing your healthcare and logistics services:
- Healthcare Professionals: GPhC-registered prescribers and pharmacists who review your consultation and dispense medication.
- Couriers & Logistics Partners: Royal Mail and DPD receive your delivery name, address, and tracking phone number to perform cold-chain delivery.
- Your NHS GP Practice: In accordance with UK clinical safety guidelines, we notify your GP of prescribed weight loss medication, subject to your consent or clinical duty-of-care requirements.
- Regulatory Bodies: GPhC, MHRA, or legal authorities if required by law, regulation, or public health protection.
Clinical Confidentiality: All clinical staff and prescribers are bound by strict professional duties of confidentiality under the General Pharmaceutical Council (GPhC) code of conduct.
5. Data Storage & Retention
Your data is stored securely within the UK/EEA using end-to-end encryption. As an accredited pharmacy, legal regulations require us to retain prescription records and consultation logs for set periods:
- Prescription & Medical Records: Retained for a minimum of 2 to 10 years following your last treatment, in compliance with NHS and GPhC record management guidance.
- Financial Transaction Records: Retained for 6 years to satisfy UK tax and accounting laws.
- General Account Data: Maintained while your account is active or until you request account closure (subject to mandatory medical retention overrides).
6. Your Legal Rights Under UK GDPR
Under UK data protection law, you hold rights regarding your personal information:
- Right of Access (Subject Access Request): Request a free copy of the personal and medical data we hold about you.
- Right to Rectification: Ask us to correct inaccurate or incomplete health or contact records.
- Right to Erasure (‘Right to be Forgotten’): Request deletion of your data, provided it does not conflict with our statutory pharmacy record retention duties.
- Right to Restrict or Object: Restrict processing or object to direct marketing communications at any time.
- Right to Data Portability: Receive your personal data in a structured, commonly used digital format.
7. Cookies & Tracking Technologies
Our website uses necessary cookies for core functionality (session management, shopping cart, secure checkout) and analytical cookies to improve user experience. You can manage your cookie preferences through your browser settings at any time.
8. Contact Our Data Protection Officer
If you have any questions about this Privacy Policy, wish to exercise your legal rights, or have concerns about how your data is handled, please contact us:
Medical Weight Pharmacy – Data Protection Team
If you remain dissatisfied with our response, you have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) at ico.org.uk.