Privacy Policy

PRIVACY POLICY

Chestnut (Carcroft) Ltd T/A Chestnut Pharmacy is committed to protecting the privacy and security of your personal information. This privacy notice describes how we collect and use personal information about you during and after your working relationship with us, in accordance with the General Data Protection Regulation (“the GDPR”). 

Purpose and scope of this privacy policy

This privacy policy provides information about how we handle information about people who visit our website and mobile app, and who use our services.

Our privacy policy provides you with a lot of information. We have organised it into sections to make it easier for you to read and understand. Some information is in expandable sections to make it easier to read.

Your privacy matters to us, so whether you are new to Chestnut Pharmacy or a long-time patient, please do take the time to read this policy. If you have any questions, please contact us. We respect your right to privacy and are committed to explaining clearly and honestly how we use the information we hold about you. This privacy policy will help you to understand what information we collect, why we collect it, and what we do with it.

We do not knowingly collect information from children or other persons who are under 18 years old via our website. If you are under 18 years old, you must not submit any personal information to us directly or subscribe to our services.

The information we collect, how and why we use it

Website and app visitors

When you visit our website we collect information about your visit, including information about which pages you visit and for how long, the website you came from and went to before and after visiting our website, and information about the device you used to access our websites such as the type of phone/PC, operating system, and IP address. We may also place cookies on the device you use to access our website, further information about this is in our cookie policy.

We collect this information to help us to understand how people use our website and access our services so that we can ensure they are developed to meet customer needs.

The law allows us to collect and use this information for these purposes pursuant to our legitimate interests of operating a commercial business and providing high-quality web services. We retain this type of information for no longer than we need it. The information we collect is used as anonymised, high-level data to help us understand website traffic trends. Our website is currently hosted by third party providers who may on occasion have access to the information we collect.

We may also disclose information collected for the purposes listed above with our professional advisors such as marketing agencies and security advisors.

For Nomination form Type of information & purpose(s)

Name and address

1. To enable us to identify you

2. Personalise your experience on our website and app

3. Correspond with you

4. Send your orders to you

5. To create an account for you on our website and database

6. To verify who you are when you complete an online doctor consultation (we may need to ask for your passport or driving licence if we cannot identify you through your name and address)

Date of birth and gender

to enable us to identify you

Email address and phone numbers

to communicate with you

We use the information to locate you on NHS spine and change your nominated pharmacy to our self.

Communication

Service Messages

We send automated communications to customers in addition to manual communications which react to a specific inquiry or order. In line with ICO guidance, routine customer service messages do not count as direct marketing – in other words, correspondence with customers to provide the information they need about a current contract, services they requested, or past purchases. You will receive these messages, even if you have not opted into marketing or unsubscribed from our email communication.

The ICO also clarifies that general branding, logos, or straplines in these messages do not count as marketing. The sending of service messages without explicit consent is lawful as it is communication in regards to the fulfilment of our contract with you and it is in our legitimate interest to keep our customer base up to date and informed about the service, pursuant to Art.6.1(f) UK GDPR, whereby processing is lawful where it is necessary for the legitimate interest of the controller. Further information is also available on the ICO website.

NHS Service Information Messages

As part of our commitment to providing high-quality healthcare services, Chestnut Pharmacy may send communications to patients about relevant NHS services, such as our new NHS oral contraception service. These messages are sent in compliance with NHS direct marketing guidance and are considered necessary communications regarding available NHS services pertinent to your healthcare. They are not classified as 'direct marketing' but are vital to inform you about relevant healthcare options and services that you are eligible for.

The legal basis for sending these NHS Service Information Messages is our legitimate interest in keeping our customers informed about essential healthcare services, as outlined in Article 6(1)(f) of the UK GDPR. This interest aligns with ensuring that you have access to the most relevant and beneficial healthcare services available to you.

While these communications are part of our effort to ensure you are informed about healthcare services that may benefit you, we respect your preference regarding such communications. If you wish not to receive informational messages about NHS services, you may contact our Data Protection Officer at dpo@chestnutpharmacy.co.uk

Public Health Messages

Occasionally, we process your personal data for purposes directly connected with ensuring that you receive high-quality healthcare through the NHS and informing you of services that may be relevant to you. This includes information about the COVID-19 vaccination programme and the seasonal flu vaccination programme.

If we do this directly on the request of the NHS to support their statutory functions, this can be done without your consent as the NHS is established by Act of Parliament and is required by law to carry out these functions, under Data Protection law they are allowed to process your personal data because the processing is ‘necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.‘.

If not instructed directly, the legal basis for sending these messages is legitimate interest.

Your rights

The UK’s data protection laws provide you with certain rights: the right to request access to, rectification or erasure and portability of information relating to you as well as the right to request the restriction of our processing/use of information concerning you and the right to object to our processing in certain circumstances. You have the right to withdraw consent at any time for processing that is based on your consent and to information about how we are using information relating to you. You may lodge a complaint about us with the Information Commissioner’s Office (www.ico.org.uk).

Access

· You can ask us for a copy of all the personal information we hold about you. We will respond to your request within one calendar month without any charge.

· You will need to give us enough information for us to identify you (for example, your full name, address, and date of birth). If we cannot identify you from this basic personal information, you will need to provide us with a copy of your ID (for example, your passport, full driving licence, credit card or debit card) before we send you any information; this can be emailed or posted to us.

Rectification/Correction

· You can ask us to correct any incomplete or inaccurate personal information that we hold about you.

Erasure

· You can ask us to delete or remove the personal information we hold about you in certain circumstances. There are exceptions set out in the law where we may be able to refuse to delete information (for example, if we need the information to keep to any relevant law or in connection with any claims, legal or otherwise, which may arise).

Restriction

· You can ask us to suspend using certain personal information about you (for example, if you want us to make sure it is accurate) or restrict how we can use it.

Portability/Transfer

· You can ask us to transfer certain information that we hold about you to a third party in certain circumstances.

Objection

· You may object to our processing personal data relating to you where that processing is based on our claim of legitimate interests provided that we are not able to demonstrate compelling legitimate grounds that override your interests, rights and freedoms.

· You may object to our using your information for direct marketing purposes including profiling to the extent that the profiling is used for direct marketing purposes.

· You may also object to our use of information relating to you in scientific research or statistical purposes in some circumstances.

· We may contest your objection where we have grounds to do so in the law.

Information Commissioner’s Office

If you think that we have not handled your information in line with any legal or regulatory requirement, you can make a complaint to the Information Commissioner's Office.

 

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

 

Email: casework@ico.org.uk

 

Phone: 0303 123 1113

 

To exercise any of your rights please 

contact our Data Protection Officer.

Keeping to data-protection and related regulations

We are committed to keeping to all data-protection laws that apply, including the Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR, 2003) and the General Data Protection Regulation (GDPR).

If you have any questions about data protection and your rights, you can contact our team at  dpo@chestnutpharmacy.co.uk 

As a ‘data controller’, we try to be open about how we hold and use your personal information. You can claim compensation if you can prove you have suffered as a result of how we have handled your personal information.

Changes to this policy

We may change our privacy policy from time to time.

If we change anything important (the information we collect, how we use it or why), we will undertake reasonable endeavours to make you aware of the changes such as by providing a link to the change on the website or telling you by email.