Wellway & Central Pharmacies Privacy Policy
We take your privacy seriously – whether it be online, or at all of our pharmacy sites. We’re guided by the principles of patient confidentiality and data security, to ensure high quality care for all of our patients. Find our website and pharmacies’ privacy policy below.
Information Recorded
As part of providing a professional, safe and efficient service, there is certain information that we record. This includes details of drugs and appliances dispensed against NHS prescriptions as well as significant advice given, and referrals made to other health professionals and any other relevant information.
Information recorded may include:
- basic details about you, such as address, date of birth, next of kin.
- records of medicines you have been prescribed by your doctor or another qualified prescriber, and which have been supplied by this pharmacy.
- details of medicines purchased from the pharmacy without a prescription (“over the counter medicines”).
- other details and notes about your health and medical treatment.
- information relevant to your continued care from other people who care for you and know you well, such as other health professionals and relatives.
- any other services we provide to you, for example, a flu or COVID-19 vaccination.
- your email and phone numbers to provide other pharmacy services, such as our prescription collection service.
Processing your Information
We process your personal data, which includes information from your prescriptions and any other pharmacy and health care services we provide to you (including new medicines service reviews, flu vaccinations, stop smoking services etc.) for the purposes of:
- your care – providing pharmacy services and care to you and, as appropriate, sharing your information with your GP and others in the wider NHS.
- provision of online services – by using our online services, you consent to our website storing cookies on your device – for the essential functioning of our website, and for usage statistics and analytics. (See Cookie Policy). If you have opted-in to marketing emails, we will use the contact information provided to share updates and promotions from Wellway and Central Pharmacies.
- our payments – sharing your information with the NHS Business Services Authority, others in the wider NHS, and sometimes Local Authorities, and only limited information to those external to the NHS who negotiate and check the accuracy of our payments.
- management – sharing only limited information with the NHS Business Services Authority and others in the wider NHS, and sometimes Local Authorities; as well as those external to the NHS who ensure we maintain appropriate professional and service standards and that your declarations and ours are accurate.
We hold your information for as long as advised by the NHS.
We process your personal data in the performance of a task in the public interest for the provision of healthcare and treatment. Our Superintendent Pharmacists are responsible for the confidentiality of your information.
Your Rights
You have the right to confidentiality under the General Data Protection Regulation, the Data Protection Act 2018 and the common law duty of confidence. We also comply with the NHS Code of Practice on Confidential Information and pharmacists have a requirement under their professional standards to keep records about you confidential, secure and accurate.
All of our staff contracts of employment contain a requirement to keep patient information confidential.
You may choose to opt out of the NHS using your data for planning and research purposes – please ask for details.
Our guiding principle is that we process your records in strict confidence.
We hold your information for as long as advised by the NHS. You have a right to a copy of the information we hold about you, generally without charge. You may seek to correct any inaccurate information. Please contact our data protection officers (outlined below) to exercise this right.
We process your personal data in the performance of a task in the public interest for the provision of healthcare and treatment and the management of healthcare systems. Our Superintendent Pharmacists are responsible for the confidentiality of your information.
You may object to us holding your information. You may also lodge a complaint with the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Please ask us if you would like further information.
Our Data Protection Officers
Central Ashington Limited (Central Pharmacy)
Ashington Healthcare Limited (Ashington Pharmacy)
Sukhpreet Kullar (Superintendent Pharmacist)
Lintonville Surgery, Lintonville Terrace, Ashington, NE63 9UT
Email: contact@wellwaycentral.co.uk
Wellway Pharmacy Limited (Morpeth and Pegswood)
Sharon Williams (Superintendent Pharmacist)
Wellway Pharmacy Limited, Wellway Surgery, Wellway, Morpeth, NE61 1BJ
Email: contact@wellwaycentral.co.uk
Information Collected
All Website Users
Website Security Data
The following data is monitored, transferred and processed to our website security provider, WordFence, in order to maintain website security and protect our users.
– Visitor IP Address
– Visitor Proxy IP Address
– URL accessed
– Complete HTTP header
– HTTP request body
– Names of uploaded files if malware is detected within them
– Website Admin Email Addresses
This data is transferred securely to WordFence, Defiant Inc, and any approved sub-processors deemed necessary to protect the website. A data transfer agreement is in-place between the parties to lawfully and securely process this data. WordFence does not collect or otherwise process personally identifiable sensitive data as defined under the GDPR.
Lawful basis for processing: legitimate interests of the website provider and user, by protecting the website from malicious interference, hacking attempts, and thereby protecting user data.
Masked IP Address & Cookie Consent
When you set or amend your cookie consent settings, a masked IP address and cookie preference alongside a geolocation based upon the IP address is stored with our cookie consent manager software (CookieYes) to ensure a log of your consent. This information is stored externally with CookieYes in a secure server in London, and is only accessible by website administrators for audit purposes.
Lawful basis for processing: legitimate interests of the website provider and user, by logging the user’s cookie preference to enhance privacy protections and demonstrate compliance with privacy regulations and laws.
Cookies
We use cookies to optimise our web services and view useful analytics. We also embed content on our site which enables cookies from some third-party providers. Please view our cookie policy for a list of cookies used on our webpages.
When you set or amend your cookie consent settings, a masked IP address and cookie preference is stored with our cookie consent manager software (CookieYes) to ensure a log of your consent. This information is stored externally with CookieYes in a secure server in London, and is only accessible by website administrators for audit purposes.
Lawful basis for processing: your consent, when you enter into the cookie agreement upon first visiting the website. Essential cookies are enabled automatically and are required for the website to function.
Embedded Content
Pages on this site include embedded content (e.g. videos, images, maps, etc.) from reputable, mainstream sources (e.g. Google Maps). Embedded content from other websites behaves in the exact same way as if the visitor has visited the other website. These websites may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with that embedded content, including tracking your interaction with the embedded content if you have an account and are logged in to that website. We are not responsible for setting or governing these policies, and these are managed by your privacy agreements with the individual provider(s). These external sites will only be enabled if third-party cookies are accepted when first visiting this website.
Online Resources (if used by website visitor)
Contact Form Data
We collect form information filled from our contact forms, and these are stored securely on our site, and transmitted via secure email (provided by Hostinger International Ltd) to our pharmacy teams to respond to (on NHSmail), at which point your data will be processed in line with our pharmacy privacy policies outlined above.
Lawful Basis for processing: your consent to process the information you provide, when you fill out the form.
Registration Form Data
Registration to our 24/7 Prescription Collection Service, and Nomination Forms to all of our pharmacy sites are provided by Jotform LLC, and held securely by Jotform in compliance with GDPR. This is securely passed to our pharmacy teams via email to be processed, and your information will then be subject to our pharmacy privacy policies outlined above.
Text message registration form information is stored securely on our site, and transmitted via secure email (provided by Hostinger International Ltd) to our pharmacy teams to respond to (on NHSmail), at which point your data will be processed in line with our pharmacy privacy policies outlined above.
Lawful Basis for processing: your consent to process the information you provide, when you fill out the form.
User Registration Data
For users that register on our website (currently limited to pharmacy staff), we also store the personal information they provide in their user profile. Users can see, edit, or delete their personal information at any time (except they cannot change their username). Website administrators can also view (excluding passwords) and amend that information.
Comments Posted
By default, commenting on our webpages should be disabled. If comments are left on the site, we collect the data shown in the comments form, and also the visitor’s IP address and browser user agent string to help spam detection.
An anonymized string created from your email address (also called a hash) may be provided to the Gravatar service to see if you are using it. The Gravatar service privacy policy is available here: https://automattic.com/privacy/. After approval of your comment, your profile picture is visible to the public in the context of your comment.
Media
By default, uploading media to our webpages should be disabled. If you upload images to the website, you should avoid uploading images with embedded location data (EXIF GPS) included. Visitors to the website can download and extract any location data from images on the website.
Password Reset
If you request a password reset, your IP address will be included in the reset email.
Who we share your data with, and where it is sent
We share your data for the purposes of providing our website and pharmacy services only, and in very exceptional circumstaces where required upon the request of the authorities for law enforcement purposes, or to defend ourselves legally. We hold Data Protection or Standard Contractual Clause Agreements with all data processors we work alongside.
Web Hosting Services
Our website is hosted by Hostiger International Ltd, and website data is stored securely in a remote server based in the United Kingdom. Sever data is held securely (except when held in our public repositories for our webpages) and is only shared within our organisation or to those listed in our privacy policy wording (for the pharmacy and website) for the purposes of providing healthcare.
Website Security Data
Website security data (including IP addresses, as outlined above) is shared with Defiant Inc via our security system WordFence, this data is then stored securely in the United States, and is only accessible by employees or sub-processors of WordFence, Inc as needed.
WordFence Inc, Attn: Legal Department, 1700 Westlake Ave N Ste 200, Seattle, WA 98109. Authorised sub-processors (as of 25th September 2024): Amazon Web Services Inc, Twilio, Freshworks, Mode Analytics, Google LLC.
Contact Queries, Registrations, Pharmacy Nominations, Bookings and Signups to Pharmacy Services
Form responses on our webpages via Jotform LLC are held securely in a remote server located within the EU. Contact form responses, text registrations and website registrations are held securely on our web domain. They are transferred to our pharmacy teams via secure (TLS/SSL) email. By completing a form, you consent to us processing your data for the provision of healthcare, and, where necessary, securely sharing your data with other NHS organisations, local authorities, and organisations who commission our services and provide our payments. (See our Pharmacy Privacy Policies above).
Masked IP Address & Cookie Consent
When you set or amend your cookie consent settings, your masked IP address and cookie preference is stored with our cookie consent manager software (CookieYes), alongside a geolocation based on your IP address, to ensure a log of your consent. This information is stored externally with CookieYes in a secure server in London, and is only accessible by website administrators for audit purposes.
How long we retain your data
Website Security Data
Defiant Inc, our security data processor, will retain personal data for as long as necessary to provide the services and fulfil the transactions requested by the data exporter, or for other business purposes such as complying with legal obligations, resolving disputes, and enforcing their agreements. Sub-processors retain personal data for the duration of time necessary to perform sub-processing activities under the agreement between Defiant Inc and the sub-processor.
Form Responses
Contact Queries, Registrations, Pharmacy Nominations, Bookings and Signups to Pharmacy Services are retained as long as mandated by the NHS. (e.g. for the period of having our pharmacy nominated, for Pharmacy Nominations). These are subject to our pharmacy privacy policies, as outlined above.
Masked IP Address & Cookie Consent
We retain records of cookie consent options and masked IP addresses for the duration of our agreement with CookieYes, this is to ensure we can demonstrate data protection compliance and recordkeeping.
Account Registrations (Wellway and Central Pharmacies Staff Only)
Account information and registrations are retained indefinitely to provide you web services. You can login to your account and delete/amend this information at any time.
Rights over your data
Right to access
If you have an account on this site, have left comments, or provided any personal information any of our online forms, you can request to receive an exported file of the personal data we hold about you, including any data you have provided to us.
Right for accuracy and deletion
You can also request that we update personal data to ensure accuracy, or erase any personal data we hold about you – whether stored through ourselves, or any partner company we have a data agreement in-place with. (This does not apply to external third-party sites embedded on this webpage). This also does not include any data we are obliged to keep for administrative, legal, or security purposes.
Any requests should be made to contact@wellwaycentral.co.uk with the title ‘Data Rights’ in the subject.
Disclaimer
We endeavour to ensure this page is kept up-to-date with all information regarding our privacy policy and data processing partners. Changes in privacy policy from our data processing partners will be reflected as soon as possible once we have been notified of the change.