First Issue: October 2025  Issue Version: 1 

Purpose of Issue / Description of Change: First issue for Cure Clinics Dispensing Services Ltd

Planned Review Date: May 2027 

Named Responsible Officer: Michael Ball, Managing Director

Approved By: Michael Ball, Managing Director 

Date: October 2025 

This privacy notice (“Notice”) sets out how Cure Clinics Dispensing Services Limited t/a Pharmacy by Cure Clinics  collects, uses, shares, and protects your personal data through the use of our services and website including any data you may provide when you engage with our platform, Connect by Cure Clinics (https://connect.cureclinics.uk/) (“Connect”), which includes when you contact us, or purchase a product or service from us in accordance with UK data protection law.

Cure Clinics Dispensing Services Limited is the data controller (“CCDS”, “we”, “us” or “our”) responsible for the personal data of users of our services including our website and Connect (“you”, “your”, or “yours”).

Connect is a platform provided by CCDS as a licenced provider for provision of CCDS’s products and services. This Notice covers both CCDS and Connect.

CCDS has its registered office at 10 Cable Court Pittman Way, Fulwood, Preston, Lancashire, United Kingdom, PR2 9YW and has the registration number 14242324.

Links

Our website may contain links to other websites or other organisations that have their own privacy notices. Please make sure you read their terms and conditions and privacy notices carefully before providing any personal data as we are not responsible for the content of these websites, their own privacy notices or for the way in which they hold and treat information about their users. In particular, unless expressly stated, we are not agents for these sites, nor are we authorised to make representations on their behalf.

Data Protection Principles 

Under UK data protection law, all personal data obtained and held by us must be processed according to a set of core principles. In accordance with these principles, we will ensure that: 

• Processing is fair, lawful, and transparent. 
• Data is collected for specific, explicit, and legitimate purposes. 
• Data collected is adequate, relevant, and limited to what is necessary for the purposes of processing. 
• Data is kept accurate and up to date. Data which is found to be inaccurate will be rectified or erased without delay. 
• Data is not kept for longer than is necessary for its given purpose. 
• Data is processed in a manner that ensures appropriate security of personal data including protection against unauthorised or unlawful processing, accidental loss, destruction, or damage by using appropriate technical or organisation measures. 

What information do we collect? 

The personal data we hold and use about you include your name, age, contact details, home address, date of birth, NHS number, information about your appointments, treatment, or query, medical and health details to you, any additional information we may need to help meet your specific requirements (we will be clear with you about any information we request), purchase data, technical data (e.g. your website use), and marketing and communications preferences.

We may also collect technical details of your use of our website including, but not limited to, cookies, traffic data, location data and other communication data and the resources and services that you access via the website.  For further details on our use of cookies, please see our Cookies Policy.

Our pharmacy professionals may consult relevant records to support your care, such as NHS summary care records or local shared care records. We need to do this to ensure safety when dispensing. We align with NHS protocols for use of records. We may also ask you if, whilst you remain under our care, our pharmacy professionals can consult relevant records.  If you allow us to see those health records this will help to ensure that relevant medical  information is visible to our professionals.

Why do we use your information? 

The information you provide may be used in a number of ways, for example: 

• to enable us to contact you when required 
• to assess, consider, arrange, obtain, and provide treatments to you 
• to enable us to provide related support services 
• for statistical purposes when we evaluate our range of services
• as may be reasonably and lawfully required in emergencies
• to manage patient queries
• to help us to provide details or information you may have requested. 

Information about you may also be needed for the following reasons: 

• to ensure that our services meet your needs 
• to assist staff to review the care that they provide and to ensure that it is of the highest standard 
• to investigate complaints or legal claims
• to prepare anonymous statistics on our performance in order to manage, improve and extend the services we are able to provide to you 
• to administer and protect our business and our website (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data)
• to use data analytics to improve our website, marketing, relationships and experiences
• to send you our email updates where you have requested us to do so
• to send you marketing communications where you have requested us to do so.

When information is used for statistical or financial purposes, strict measures are taken to ensure that you cannot be identified from your information. You have the right to withhold information unless the law requires us to obtain it. 

Who will you be seen by? 

Whilst in our care your health information and other personal data will be seen by  health care professionals and support workers. They will keep records which may be written and/or held digitally about your health and the treatment that you receive from them. 

On what legal (lawful) bases will we process your information? 

We will always process your personal information on lawful grounds and in particular on the grounds set out below: 

Consent 

At your specific request we may send your records to another health or medical practitioner.   You can withdraw your consent at any time. Such records may include all or any of your name, age, contact details, home address, date of birth, information about your appointments, treatment, or query, medical, and health details relating to you, and any additional information we may need to help meet your specific requirements

We will also obtain your consent to send you our updates via email, where you have requested us to do so.

Legal Obligation

We may also use, process and disclose your personal data for compliance purposes, as required by any legal, regulatory, law enforcement, professional or taxation authority and to the extent that we are required to do so by law or regulation.

Entering into/ Performance of a Contract

We may also process your personal data in order to perform our services for you. This will generally include all or most of your name, age, contact details, home address, date of birth, information about your appointments, treatment, or query, medical, and health details relating to you, and any additional information we may need to help meet your specific requirements.

Protect vital interests

We may need to process your personal data to protect yours or somebody else’s life. For example, where we need to provide your personal data to emergency services where you are incapable of giving us consent for this, such as where you have fallen unconscious.

Public task

We process your personal data in the performance of a task in the public interest for the provision of healthcare and treatment. A pharmacist is responsible for the confidentiality of your information.

Legitimate Interests

We want to give you the best possible patient experience whilst respecting your privacy. 

We may also use some of your personal information for statistical purposes when we evaluate our range of services. 

This is in addition to where we may need to use your personal data such as name, age, contact details, home address, date of birth to ensure we provide you with the right product/ service, and for running our business, provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganisation or group restructuring exercise

We may also make use of your personal data to the extent required to establish, exercise, protect, enforce, or defend our legal rights and to take legal advice. 

The following sets out the types of information we collect and use, the purpose for that, and the law:

Special category data

Where we process more sensitive “special category data” such as your medical records or information relating to your health, we will process your personal information using conditions (in addition to one or more of the grounds stated above) as set out in data protection law, including but necessarily only,the following:

For Medical Purposes and Pursuant to a Contract with a Health Professional 

We may process your health, medical and other related records, and details where necessary for the purposes of medical diagnoses, the provision of health care or treatment, the management of health care systems and services subject to UK law and/or pursuant to your contract with us as health professionals subject to all applicable conditions and safeguards. 

Explicit Consent 

At your specific request we may send your records to another health or medical practitioner. You can withdraw your consent at any time.

Who will you share my information with? 

Where necessary or required, we may share your personal information as follows:

• With third party service providers, in connection with services performed on our behalf.  For example, website hosting, our email provider, our software provider, our IT provider and analytics and search engine providers that assist us in the improvement and optimisation of our website, and delivery providers for delivering our products
• With other companies within our group company, such as Cure Clinics Technology Services Ltd, and to third-party prescribing organisations to whom we have granted access to use our dispensing platform(s). We have agreements in place between these organisations to ensure your personal data is protected, and processed in a way we permit.
• With government bodies, regulators, authorities and law enforcement agencies.
• With the NHS bodies including NHS Digital
• Public health authorities.
• With our insurers and legal advisers.
• if we are under a duty to disclose or share your personal data in order to comply with any legal obligation, or in order to enforce or apply or terms of use and other agreements, or to protect the rights, property, our safety, our customers, or others;
• disclose information about you as required by law, to enforce this Agreement and to preserve our rights;
• With third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this Privacy Notice.

This list is not exhaustive and we may use and disclose your personal data without your permission: 

(a) in connection with any legal proceedings or claims or prospective legal proceedings or claims, 

(b) to legal, judicial, regulatory, law enforcement, public health, governmental, professional and taxation authorities, 

(c) to prevent crime; 

(d) to take legal advice; and 

(e) to establish, exercise, protect, enforce or defend our legal rights 

Marketing and market research

This section explains the choices you have when it comes to receiving marketing communications and taking part in market research.

We will send you details regarding the following:

• Product/ service information;
•  Newsletters.

We may do this via email, text message, WhatsApp, phone call, and/ or post. Information on methods used will be provided when you provide your consent.

but only if you have previously agreed to receive these marketing communications. When you register with us, we will ask if you would like to receive marketing communications, and you can change your marketing choices online, over the phone or in writing at any time.

The consent you provide for receiving marketing communications will apply to all of the entities within the Cure Clinics group company (our ‘family of services’) meaning any of these entities can send you marketing communications. This information will be included when you provide your consent. You can find more information on these entities on our website: Cure Clinics UK | Modern healthcare made personal | cureclinics.uk.

How do we manage your information? 

We may from time to time appoint other members of our group of companies, or third-party service providers, to help us manage efficient systems within the business. Some of these systems may for operational reasons be located in countries overseas including the USA. 

We will only transfer your information to service providers who help manage our systems, or overseas, where we are satisfied that this is lawful and that adequate levels of protection are in place to protect the integrity and security of any information being processed and in compliance with UK data protection law. 

We do not, as a matter of routine, transfer personal data abroad. If we transfer your personal data to service providers outside the United Kingdom, then we will always use a lawful method to do so. In the case of transfers to other countries outside the UK or the European Economic Area then this will be an agreement in a legally approved form. 

Updating Your Details 

If you would like to change any of your preferences relating to the way in which we may use your information for direct marketing, then please update your user preferences or send an email to: contact@pharmacy.cureclinics.uk or write to us at 10 Cable Court Pittman Way, Fulwood, Preston, Lancashire, United Kingdom, PR2 9YW. 

Other People’s Information

If you provide us with information about another person, you confirm that they have appointed you to act for them i.e. you are their Carer, Parent or Guardian, they consent to the processing of their personal data and that you have informed them of our identity and the purposes (as set out above) for which their personal data will be processed. You will produce clear evidence to show you have been appointed and are able to share their personal information. When we first speak to them, we may tell them where we have got their information from.

How long will we hold your information for? 

We have a system of retention periods in place to ensure that your information is only stored whilst it is required for the relevant purposes such as to assist us in case of any complaint/ dispute, and/ or to meet legal requirements. Where your information is no longer required, we will ensure it is disposed of or deleted in a secure manner. 

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purpose for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements. We take into account NHS guidance.

Your rights 

You have the right to ask us at any time: 

• to confirm whether we hold any of your personal data. 
• to send you a copy of any personal data that we hold about you. 
• to correct any inaccuracies in your personal data and to add relevant details where the personal data we hold is incomplete. 
• to delete (to the extent possible) any of your personal data, where we are required by law to do so. 
• to stop processing your personal data, where we are required by law to do so. 
• to let you have a portable copy of the personal data we hold about you, where we are required by law to do so. 
• to stop processing any of your personal data that we process on the basis of our legitimate interests; and 
• to stop sending you marketing material. However please note that we may continue to send you service related (i.e., non-marketing) communications, such as email updates relating to your treatment. 

We also comply with the NHS Code of Practice on Confidential Information and pharmacists have a requirement under their professional standards to keep records about you confidential, secure and accurate.

All of our staff contracts of employment contain a requirement to keep patient information confidential.

You may choose to opt out of the NHS using your data for planning and research purposes – details are obtained by:

visiting the nhs.uk/yournhsdatamatters website portal; using the NHS App; or

• writing by post using the instructions at the web link above; or by
• calling the NHS Digital contact centre – 0300 303 5678 (open workdays Monday-Friday, 9am-5pm).

Specifically, you have the right to ask for a copy of all pharmacy records about you (generally in paper or electronic form).

Generally, there will be no charge for a printed copy of the information we hold about you. We are required to respond to your request within one month.

You will need to give adequate information in order for pharmacy staff to identify you (for example, full name, address and date of birth). You will be required to provide ID, for example a passport, full driving licence or credit/debit card before any information is released to you.

We do not currently use automated decision making, but may do in the future. Please check this notice for any update on this. Where we have reached a decision that affects you by processing your personal data automatically then you have the right to speak to someone to discuss that decision. 

We do not use your personal data for the purpose of profiling. 

Where we process your personal data on the basis that you have given us your consent to do so then you may contact us at any time to withdraw your consent 

If you wish to exercise any of these rights or wish to object to our use of your personal information, please write to us at the address given below. 

Forbes Solicitors LLP, Data Protection Officer CCDS-DPO@forbessolicitors.co.uk. By email to: CCDS-DPO@forbessolicitors.co.uk or write to us at 10 Cable Court Pittman Way, Fulwood, Preston, Lancashire, United Kingdom, PR2 9YW. 

When do you monitor telephone calls? 

We may from time-to-time record telephone calls you have with members or our staff for training purposes and to improve the quality of our service. If we plan to record any telephone call, your express consent will be sought prior to any recording. You may withdraw or not give your consent at any time. 

How do we update this privacy notice? 

We keep our privacy notice under regular review, and we will place any updates on our webpage. 

Who can I contact if I have queries about this privacy notice? 

You can also contact us directly if you have any questions about our privacy notice or information we hold about you. 

Please write to us using the details below. 

Forbes Solicitors LLP, Data Protection Officer. By email to: CCDS-DPO@forbessolicitors.co.uk or write to us at 10 Cable Court Pittman Way, Fulwood, Preston, Lancashire, United Kingdom, PR2 9YW If you are dissatisfied with our handling of any query or complaint you also have the right to raise concerns with The UK Information Commissioner: https://ico.org.uk or at: 

Customer Contact

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

SK9 5AF