Batley Pharmacy — Privacy Notice (How We Use Your Information)

This notice explains how Eightlands Limited uses your personal information when you use Batley Pharmacy and when you use this website, including online appointment booking, NHS repeat prescription requests and our prescription delivery service. A shorter version is displayed in the pharmacy, and a paper copy is available from any member of staff on request.

1. Who we are

Batley Pharmacy is run by Eightlands Limited, which is the data controller for your information. Eightlands Limited is part of the Eightlands Group, the collective trading name of Eightlands Limited, Kirklees Limited and TIMPAS Limited.

Registered office: 157 Upper Commercial Street, Batley, West Yorkshire, WF17 5DH.

Our pharmacists and their teams are part of your local healthcare team and keep records about you, your health and the care we provide.

Data Protection Lead: Inam-ul Haq — dataprotection@eightlands.co.uk — or by post, marked for the attention of the Data Protection Lead, at our registered office. You can also contact the pharmacy using the details on its page of this website.

2. Information we record

When you use our pharmacy services, this may include basic details such as your name, address, date of birth, NHS number and next of kin; records of medicines prescribed and supplied; medicines bought without a prescription; notes about your health and treatment; relevant information from others involved in your care; and details of other services we provide, such as a vaccination or a blood pressure check.

When you use this website, we also record:

• your name, contact details and date of birth, the service, pharmacy and time you choose, and your answers to any questions asked when you book an appointment;
• whether you have paid the booking payment, and any refund. Card payments are handled by the booking platform's payment provider; we do not see or keep your full card number;
• when you request a repeat prescription: your name, date of birth, address, GP practice, the medicines you ask for and how you would like to receive them;
• for home delivery: your delivery address, any delivery instructions and a record of the delivery;
• anything you tell us when you send an enquiry, feedback or complaint through the website or by email; and
• limited technical information about how the website is used, as explained in our Cookie Notice.

If you book or request a prescription for someone else, such as your child or a person you care for, we record your details as well as theirs. Please only do this if you are entitled to act for them.

3. How and why we use it

We use your personal information for three main purposes:

• your care — providing pharmacy services, and sharing information with your GP and others in the wider NHS who are involved in your care;
• our payments — sharing information with the NHS Business Services Authority and, where needed, others who check the accuracy of our NHS payments; and
• management — sharing information with the NHS Business Services Authority, NHS England, NHS West Yorkshire Integrated Care Board and others to maintain professional and service standards.

Through the website we also use your information to manage your bookings and send you confirmations and reminders, to take and refund booking payments, to ask your GP for the repeat prescriptions you request, to arrange delivery, to reply to your enquiries and complaints, and to keep the website secure and working properly. If you agree to analytics cookies, we also use information about how the website is used to improve it.

Messages we send you about a booking, prescription or delivery you have asked for are service messages. We do not sell your information or use it for marketing. We do not make decisions about you by automated means alone: a member of the pharmacy team deals with every booking and prescription request.

4. Our lawful basis

For NHS services, we process your information in the performance of a task in the public interest for the provision of healthcare (UK GDPR Article 6(1)(e)). For private services you ask us for, including booking and paying for a private appointment, we process it to provide the service you have asked for (Article 6(1)(b)) and to keep the records the law requires of pharmacies, such as records of medicines supplied and financial records for tax purposes (Article 6(1)(c)). For health information, we rely on Article 9(2)(h) (the provision of health and social care) and paragraph 2 of Schedule 1 to the Data Protection Act 2018. A pharmacist is responsible for the confidentiality of your information. We do not rely on your consent to keep your pharmacy records, and your care does not depend on it.

Where we handle a general enquiry that is not about your care, or keep the website secure, we rely on our legitimate interests (Article 6(1)(f)). We use analytics cookies only if you agree to them (Article 6(1)(a)), and you can withdraw that agreement at any time.

You do not have to give us your information, but we need it to care for you safely. If you do not give us the information we ask for when you book or request a prescription, we may not be able to provide that service.

5. Who we share it with

We share information only where it is needed for the purposes above: with your GP and others involved in your care in the wider NHS; with the NHS Business Services Authority, NHS England and NHS West Yorkshire Integrated Care Board; with the commissioner of a local service where you receive that service; and where the law requires or permits us to — for example, to protect someone from serious harm, to help prevent or detect crime, or when our regulator, the General Pharmaceutical Council, inspects us. We may also share information with our insurers and professional advisers where this is needed to deal with a claim or complaint.

Prescriptions are delivered by our own employed drivers. We also use suppliers who handle information on our behalf, only on our instructions and under a written contract — including our pharmacy computer system supplier, our website and booking platform provider (see section 6), and the services they use to send you text messages and emails and to take payments.

6. Our website and online services

Our website, online booking and repeat prescription request service are provided for us by Charac Limited (company number 12504326). When you book or make a request with us, Charac handles your information on our behalf and Eightlands Limited remains the data controller.

If you create an account with Charac itself, for example in the Charac app, Charac is responsible for that account as a separate data controller and its own privacy notice applies.

If you accept analytics cookies, we use Google Analytics to understand how the website is used. Google processes this information for us. It does not include your health information or the details you enter in a booking or request form. See our Cookie Notice.

7. Transfers outside the UK

Your pharmacy records, and the records held for us on the Charac platform, are stored in the UK. We do not transfer your information outside the UK unless the destination is covered by UK adequacy regulations, or appropriate safeguards — such as the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses — are in place, and we are satisfied that the standard of protection is not materially lower than in the UK.

Google Analytics data may be processed in the United States. Google is certified under the UK Extension to the EU–US Data Privacy Framework, which the UK recognises as adequate.

8. Electronic prescriptions and the national data opt-out

We may ask whether you wish to nominate our pharmacy to receive your electronic prescriptions. Nomination is always your choice: you can change or cancel it at any time, and using this website or our delivery service does not change your nomination. The national data opt-out lets you choose that your confidential patient information is not used for research and planning; it does not affect information used for your care. Find out more at nhs.uk/your-nhs-data-matters.

9. How long we keep it

We keep your pharmacy records — including bookings and repeat prescription requests made through the website — for the periods set in our records retention schedule, which follows the current NHS Records Management Code of Practice.

Records of payments are kept for 6 years after the end of the financial year in which they were made, as tax law requires.

10. Your rights

You have rights under the UK GDPR, including to see your records and to have errors corrected. In some circumstances you can also ask us to delete or restrict the use of your information, object to how we use it, or receive information you gave us in a portable format. If we rely on your consent for anything, such as analytics cookies, you can withdraw it at any time. To exercise any of these rights, contact the Data Protection Lead. We will respond within one month and there is normally no charge; if your request is complex we may extend this by up to two further months, and we will tell you within the first month if we need to.

11. Complaints about how we use your information

If you are unhappy with how we have used your information, please tell us first. You can complain:

• by email to the Data Protection Lead at dataprotection@eightlands.co.uk;
• by post, marked for the attention of the Data Protection Lead, at our registered office; or
• in person to any member of staff at the pharmacy.

We will acknowledge your complaint within 30 days, look into it and tell you the outcome without undue delay. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113 at any time, whether or not you have complained to us first.

Complaints about our pharmacy service, rather than about your information, are explained at batleypharmacy.co.uk/complaints.

12. Changes to this notice

We review this notice at least once a year and whenever the way we use information changes. The current version is always available on this website and in the pharmacy.