1. Who We Are

Singh Pharmacy is a family-run independent pharmacy serving the communities of West Bridgford and Nottingham.

Data Controller: Singh Pharmacy Company No: 06938361 VAT No: 352409315 Superintendent Pharmacist: Gurminder Singh (GPhC No: 2078908)

Our locations:

Singhs Ladybay Pharmacy 145 Trent Boulevard, West Bridgford, Nottingham, NG2 5BX Tel: 0115 9455412

Singh Pharmacy (Tudor Square) 6 Tudor Square, West Bridgford, Nottingham, NG2 6BT Tel: 0115 9813048

Email: [your contact email] Website: www.singh-pharmacy.co.uk

2. What This Policy Covers

This Privacy Policy explains how we collect, use, store and share your personal information when you:

• Visit our website (singh-pharmacy.co.uk)

• Use any of our pharmacy or clinical services

• Book an appointment with us

• Contact us by phone, email or through our website

• Sign up to receive marketing communications from us

We are committed to protecting your privacy and handling your data in a transparent, fair and lawful way in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

3. The Information We Collect

3.1 Information You Provide to Us

We may collect the following personal information from you:

• Identity data: Full name, date of birth, gender

• Contact data: Address, email address, telephone number

• Health and medical data: Medical history, current medications, conditions, symptoms, test results, prescriptions and clinical notes (this is "special category" data under UK GDPR and is handled with additional care)

• NHS data: NHS number (where applicable to your service)

• Financial data: Payment information for private services (payments are processed securely — we do not store full card details)

• Marketing preferences: Your consent to receive communications from us

3.2 Information We Collect Automatically

When you visit our website, we may automatically collect:

• Technical data such as your IP address, browser type and version, operating system, and device type

• Usage data such as pages visited, time spent on pages, and links clicked

• Cookie data (see Section 10 on Cookies)

3.3 Information From Third Parties

We may receive information about you from:

• NHS systems and referrals where relevant to your care

• Accredited laboratories (for private blood test results)

• Other healthcare professionals involved in your care (with your knowledge)

4. How We Use Your Information

We use your personal information for the following purposes:

4.1 Providing Healthcare Services

What we use: Identity, contact and health data Legal basis: Processing is necessary for the provision of health or social care (Article 9(2)(h) UK GDPR and Schedule 1, Part 1, DPA 2018)

This includes:

• Dispensing NHS and private prescriptions

• Ear wax removal consultations and treatment

• IV vitamin drip therapy

• Private GP consultations

• Private blood testing

• Weight loss services (Wegovy / Mounjaro)

• Travel clinic and vaccination services

• Minor ailments consultations

• Stop smoking clinic

• Blood pressure monitoring

• Any other clinical services we provide

4.2 Booking and Appointment Management

What we use: Identity and contact data Legal basis: Contract — to fulfil your booking and provide the service you have requested

4.3 Communicating With You About Your Care

What we use: Identity, contact and health data Legal basis: Legitimate interests and/or legal obligation (to ensure continuity and safety of care)

This includes sending appointment reminders, follow-up messages, prescription notifications and results.

4.4 Marketing Communications

What we use: Identity, contact and marketing preference data Legal basis: Consent

With your explicit consent, we may contact you about:

• New services and treatments available at Singh Pharmacy

• Health tips, seasonal campaigns and promotions

• Service updates relevant to your care

You can withdraw your consent at any time by replying STOP to any message, clicking unsubscribe in any email, or contacting us directly. Withdrawing consent does not affect any communications related to your ongoing care.

4.5 Legal and Regulatory Compliance

What we use: Any relevant data Legal basis: Legal obligation

We are required to retain certain records (including prescription records and clinical notes) in compliance with NHS and GPhC regulatory requirements.

4.6 Improving Our Services

What we use: Anonymised usage and feedback data Legal basis: Legitimate interests

We may use anonymised, aggregated data to understand how our website is used and how we can improve our services. This data cannot identify you individually.

5. Special Category Data (Health Information)

As a pharmacy and clinical services provider, much of the information we handle is classed as "special category data" under UK GDPR — specifically, data concerning health.

We process this data under the following conditions:

• It is necessary for the provision of health or social care services

• It is necessary for reasons of public interest in the area of public health

• You have given explicit consent for a specific purpose

We apply additional technical and organisational safeguards to all health data, including restricted staff access, secure systems, and staff training on data confidentiality.

6. Who We Share Your Information With

We do not sell your personal data. We may share it only in the following circumstances:

6.1 Healthcare Partners

• Accredited UK laboratories (for processing private blood test samples)

• GPs, consultants or specialists (where a referral is required and with your knowledge)

• NHS systems (where applicable to your NHS services)

6.2 Technology Service Providers

We use the following trusted third-party platforms to operate our business:

• GoHighLevel (GHL): Our CRM, booking, and communications platform. Data is processed in accordance with their Data Processing Agreement.

• Payment processors: For secure processing of payments for private services.

• Website hosting and CDN providers

All third-party processors are contractually required to handle your data securely and only for the purposes we specify.

6.3 Legal Requirements

We may disclose your data where required to do so by law, court order, or regulatory authority (such as the GPhC, CQC, or NHS).

6.4 Safeguarding

In exceptional circumstances, we may share information with appropriate authorities where we have a safeguarding concern, without your consent, where the law permits or requires this.

7. How Long We Keep Your Information

We retain your personal data for as long as necessary to fulfil the purposes for which it was collected, or as required by law and regulatory guidance.

Data TypeRetention PeriodPrescription records2 years (NHS guidance)Clinical consultation notes8 years from last contact (or until age 25 for minors)Private blood test results8 yearsBooking and appointment data2 yearsMarketing consent recordsUntil consent is withdrawn + 1 yearWebsite usage / cookie dataUp to 13 monthsFinancial transaction records7 years (HMRC requirement)

After the applicable retention period, your data is securely deleted or anonymised.

8. Your Rights Under UK GDPR

You have the following rights in relation to your personal data:

Right of access — You can request a copy of the personal data we hold about you (also known as a Subject Access Request).

Right to rectification — You can ask us to correct any inaccurate or incomplete data we hold about you.

Right to erasure — In certain circumstances, you can ask us to delete your personal data. Note that this right may be limited where we are required to retain records for legal or regulatory reasons.

Right to restriction — You can ask us to restrict how we use your data in certain circumstances.

Right to data portability — Where we process your data by automated means based on consent or contract, you can ask us to provide it to you in a structured, machine-readable format.

Right to object — You have the right to object to processing based on our legitimate interests, and to direct marketing at any time.

Rights related to automated decision-making — We do not currently use automated decision-making or profiling that produces significant effects on individuals.

To exercise any of these rights, please contact us using the details in Section 12. We will respond within one month. If your request is complex, we may extend this by a further two months, and will notify you if so.

9. How We Keep Your Data Secure

We take the security of your personal data seriously and have implemented appropriate technical and organisational measures including:

• Secure, password-protected systems with restricted staff access

• Encrypted data transmission (SSL/TLS) on our website

• Regular staff training on data protection and confidentiality

• Physical security at our pharmacy premises

• Secure disposal of paper records

No method of electronic transmission or storage is 100% secure. If you have any concerns about the security of your data, please contact us immediately.

10. Cookies

Our website uses cookies — small text files stored on your device — to help the site function correctly and to understand how visitors use it.

We use the following types of cookies:

• Strictly necessary cookies: Essential for the website to function. These cannot be disabled.

• Analytics cookies: Help us understand how visitors interact with the website (e.g. pages visited, time on site). We use anonymised data only.

• Marketing cookies: Used to track the effectiveness of our advertising (only active if you consent).

You can control cookies through your browser settings. Disabling certain cookies may affect your experience of the website.

For full details, please see our Cookie Policy.

11. Links to Other Websites

Our website may contain links to third-party websites (for example, NHS, Facebook, or booking platforms). We are not responsible for the privacy practices of those sites and encourage you to read their privacy policies.

12. How to Contact Us

If you have any questions about this Privacy Policy, wish to exercise your data rights, or have a concern about how we handle your data, please contact us:

By post: Data Queries — Singh Pharmacy 145 Trent Boulevard, West Bridgford, Nottingham, NG2 5BX

By telephone: Ladybay: 0115 9455412 Tudor Square: 0115 9813048

By email: [your contact email address]

13. Your Right to Complain

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) — the UK's independent data protection authority.

ICO contact details: Website: www.ico.org.uk Helpline: 0303 123 1113 Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

We would, however, always appreciate the opportunity to address your concerns directly before you approach the ICO, so please contact us in the first instance.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal obligations, or the way we handle data. When we make significant changes, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically.

Singh Pharmacy is registered with the Information Commissioner's Office (ICO). Registration number: [your ICO registration number]

Superintendent Pharmacist: Gurminder Singh | GPhC No: 2078908 | Company No: 06938361