Draft privacy notice, awaiting sign-off by Karsons Pharmacy. Items marked “To be confirmed” are not final.
Privacy notice
Who we are
Karsons Pharma Limited · Registered in England, company no. 05643409 · Registered office: 33 Pattens Lane, Chatham, England, ME4 6JR. We are the controller of the information described here.
- ICO registration number
- To be confirmed
- Data protection contact
- To be confirmed
- info@karsonspharmacy.com
What we collect and why
| For | What we collect | Why | Legal basis |
|---|---|---|---|
| Your account | Name, email, password (stored scrambled), and whether you have confirmed your email | To let you sign in and keep your requests together | Contract |
| Appointments | Patient name, date of birth, phone, email, the service and any notes you add | To hold your time, let the branch confirm it and contact you about it | Contract; health care for health details |
| Nominating us for your NHS prescriptions | Name, date of birth, address, phone, email, GP practice and your consent | To set Karsons as your nominated pharmacy. The details are emailed to the branch’s secure NHSmail inbox | Health care |
| Repeat prescription reminders | Name, contact details, when your repeat is due and how you collect it | To remind you to order from your GP. We never order from your GP for you | Consent; health care |
| “Tell me when it opens” lists | Your email address | To tell you when the online shop or K-beauty range opens | Consent (you can ask us to remove you at any time) |
| Online consultations (when the shop reopens) | Your answers to the pharmacist’s questions and the pharmacist’s decision | So a pharmacist can decide whether a medicine is safe for you | Health care; legal obligation to keep pharmacy records |
| Emails we send | A record that an email was sent, never the medicine or clinical details | Confirmations, reminders and password resets | Contract |
“Health care” means UK GDPR Article 9(2)(h): information about your health used to provide pharmacy care, handled by or under the responsibility of a health professional.
Who we share it with
- Your GP: only if you agree, or where we must by law or to protect someone from serious harm.
- Companies that run our systems for us, under contract and only on our instructions:
- Supabase: our database and sign-in (servers in Frankfurt, EU)
- Vercel: hosts the website (London)
- Resend: sends our emails. It may process data in the US; the safeguards for that transfer are: To be confirmed
- Google Workspace: our email inbox
- NHSmail: secure NHS email between us and our branches
- When online ordering opens: Ryft (payments) and Yoti (identity checks)
- Peachy Healthcare provides our private blood tests and is a separate controller: their own privacy notice applies when you order from them.
Online orders are dispensed and sent from Karsons City Way (GPhC 1090819), 69–71 City Way, Rochester, ME1 2BA.
How our pharmacist contacts you
Our pharmacist may phone or email you about your answers or your appointment. You can always phone the branch to speak to them.
How long we keep it
Pharmacy records are kept for the periods set by law and NHS guidance. Our periods for each record type: To be confirmed.
Your rights
You can ask for a copy of your information, ask us to correct it, object to or restrict how we use it, ask us to delete it where the law allows (some pharmacy records must be kept), and withdraw consent at any time where we rely on it. Email info@karsonspharmacy.com.
If you’re unhappy with how we’ve handled your information, please tell us first. You can also complain to the Information Commissioner’s Office.
See also our terms.