Privacy Notice - pharmacy.cureclinics.uk

Privacy Notice.

First Issue: October 2025  Issue Version: 3 

Purpose of Issue / Description of Change: Addition of third-party ID verification platform

Planned Review Date: May 2027 

Named Responsible Officer: Michael Ball, Managing Director

Approved By: Michael Ball, Managing Director 

Date: January 2026 

This privacy notice (“Notice”) sets out how Cure Clinics Dispensing Services Limited t/a Pharmacy by Cure Clinics collects, uses, shares, and protects your personal data through the use of our services and website including any data you may provide when you engage with our platform, Connect by Cure Clinics (https://connect.cureclinics.uk/) (“Connect”), which includes when you contact us, or purchase a product or service from us in accordance with UK data protection law.

Cure Clinics Dispensing Services Limited is the data controller (“CCDS”, “we”, “us” or “our”) responsible for the personal data of users of our services including our website and Connect (“you”, “your”, or “yours”).

Connect is a platform provided by CCDS as a licenced provider for provision of CCDS’s products and services. This Notice covers both CCDS and Connect.

CCDS has its registered office at 10 Cable Court Pittman Way, Fulwood, Preston, Lancashire, United Kingdom, PR2 9YW and has the registration number 14242324.

Links

Our website may contain links to other websites or other organisations that have their own privacy notices. Please make sure you read their terms and conditions and privacy notices carefully before providing any personal data as we are not responsible for the content of these websites, their own privacy notices or for the way in which they hold and treat information about their users. In particular, unless expressly stated, we are not agents for these sites, nor are we authorised to make representations on their behalf.

Data Protection Principles 

Under UK data protection law, all personal data obtained and held by us must be processed according to a set of core principles. In accordance with these principles, we will ensure that: 

Processing is fair, lawful, and transparent.

Data is collected for specific, explicit, and legitimate purposes.

Data collected is adequate, relevant, and limited to what is necessary for the purposes of processing.

Data is kept accurate and up to date. Data which is found to be inaccurate will be rectified or erased without delay.

Data is not kept for longer than is necessary for its given purpose.

Data is processed in a manner that ensures appropriate security of personal data including protection against unauthorised or unlawful processing, accidental loss, destruction, or damage by using appropriate technical or organisation measures.

What information do we collect? 

The personal data we hold and use about you include your name, age, contact details, home address, date of birth, NHS number, information about your appointments, treatment, or query, medical and health details to you, any additional information we may need to help meet your specific requirements (we will be clear with you about any information we request), purchase data, technical data (e.g. your website use), and marketing and communications preferences.

We may also collect technical details of your use of our website including, but not limited to, cookies, traffic data, location data and other communication data and the resources and services that you access via the website. For further details on our use of cookies, please see our Cookies Policy.

Our pharmacy professionals may consult relevant records to support your care, such as NHS summary care records or local shared care records. We need to do this to ensure safety when dispensing. We align with NHS protocols for use of records. We may also ask you if, whilst you remain under our care, our pharmacy professionals can consult relevant records. If you allow us to see those health records this will help to ensure that relevant medical information is visible to our professionals.

Why do we use your information? 

The information you provide may be used in a number of ways, for example: 

to enable us to contact you when required

to assess, consider, arrange, obtain, and provide treatments to you

to enable us to provide related support services

for statistical purposes when we evaluate our range of services

as may be reasonably and lawfully required in emergencies

to manage patient queries

to help us to provide details or information you may have requested.

Information about you may also be needed for the following reasons: 

to ensure that our services meet your needs

to assist staff to review the care that they provide and to ensure that it is of the highest standard

to investigate complaints or legal claims

to prepare anonymous statistics on our performance in order to manage, improve and extend the services we are able to provide to you

to administer and protect our business and our website (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data)

to use data analytics to improve our website, marketing, relationships and experiences

to send you our email updates where you have requested us to do so

to send you marketing communications where you have requested us to do so.

When information is used for statistical or financial purposes, strict measures are taken to ensure that you cannot be identified from your information. You have the right to withhold information unless the law requires us to obtain it. 

Who will you be seen by? 

Whilst in our care your health information and other personal data will be seen by health care professionals and support workers. They will keep records which may be written and/or held digitally about your health and the treatment that you receive from them. 

On what legal (lawful) bases will we process your information? 

We will always process your personal information on lawful grounds and in particular on the grounds set out below: 

Consent 

At your specific request we may send your records to another health or medical practitioner.  You can withdraw your consent at any time. Such records may include all or any of your name, age, contact details, home address, date of birth, information about your appointments, treatment, or query, medical, and health details relating to you, and any additional information we may need to help meet your specific requirements

We will also obtain your consent to send you our updates via email, where you have requested us to do so.

Legal Obligation

We may also use, process and disclose your personal data for compliance purposes, as required by any legal, regulatory, law enforcement, professional or taxation authority and to the extent that we are required to do so by law or regulation.

Entering into/ Performance of a Contract

We may also process your personal data in order to perform our services for you. This will generally include all or most of your name, age, contact details, home address, date of birth, information about your appointments, treatment, or query, medical, and health details relating to you, and any additional information we may need to help meet your specific requirements.

Protect vital interests

We may need to process your personal data to protect yours or somebody else’s life. For example, where we need to provide your personal data to emergency services where you are incapable of giving us consent for this, such as where you have fallen unconscious.

Public task

We process your personal data in the performance of a task in the public interest for the provision of healthcare and treatment. A pharmacist is responsible for the confidentiality of your information.

Legitimate Interests

We want to give you the best possible patient experience whilst respecting your privacy. 

We may also use some of your personal information for statistical purposes when we evaluate our range of services. 

This is in addition to where we may need to use your personal data such as name, age, contact details, home address, date of birth to ensure we provide you with the right product/ service, and for running our business, provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganisation or group restructuring exercise

We may also make use of your personal data to the extent required to establish, exercise, protect, enforce, or defend our legal rights and to take legal advice. 

The following sets out the types of information we collect and use, the purpose for that, and the law:

Information

Purpose/Activity

Legal Basis

Name, age, contact details, home address, date of birth, and NHS number

this information is essential for us to set you up in our CRM system

to manage our relationship with visitors to our website

to enable us to contact you when required

to assess, consider, arrange, obtain, and provide treatments to you i.e. dispensing

in the recommendation of treatments and procedures suitable for you

to refer you to other health practitioners for treatment

to enable us to provide related support services

for statistical purposes when we evaluate our range of services

as may be reasonably and lawfully required in emergencies

to manage patient queries

to help us to provide details or information you may have requested

to ensure that our services meet your needs

to assist staff to review the care that they provide and to ensure that it is of the highest standard

to investigate complaints or legal claims

to administer and protect our business and our website (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data)

to use data analytics to improve our website, marketing, relationships and experiences

to send you our email updates where you have requested us to do so

Consent

Entering into/ performance of a contract

Legal obligation

Protect vital interests

Public task

Necessary for our legitimate interests in running our business, provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganisation or group restructuring exercise

Information about your appointments, treatment, or query

to enable us to contact you when required

to assess, consider, arrange, obtain, and provide treatments to you

in the recommendation of treatments and procedures suitable for you

to refer you to other health practitioners for treatment

to enable us to provide related support services

for statistical purposes when we evaluate our range of services

as may be reasonably and lawfully required in emergencies

to manage patient queries

to help us to provide details or information you may have requested

to ensure that our services meet your needs

to assist staff to review the care that they provide and to ensure that it is of the highest standard

to investigate complaints or legal claims

to prepare anonymous statistics on our performance in order to manage, improve and extend the services we are able to provide to you

to administer and protect our business and our website (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data)

to use data analytics to improve our website, marketing, relationships and experiences

Consent

Entering into/ performance of a contract

Legal obligation

Protect vital interests

Public task

Necessary for our legitimate interests in running our business, provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganisation or group restructuring exercise

Your medical and health details (including GP details, prescribed medicines, over-the-counter medicines, medical history, any other provided services e.g. vaccinations and medicine reviews, and health practitioner notes)

to enable us to contact you when required

to assess, consider, arrange, obtain, and provide treatments to you

in the recommendation of treatments and procedures suitable for you

to refer you to other health practitioners for treatment

to enable us to provide related support services

for statistical purposes when we evaluate our range of services

as may be reasonably and lawfully required in emergencies

to manage patient queries

to help us to provide details or information you may have requested

to ensure that our services meet your needs

to assist staff to review the care that they provide and to ensure that it is of the highest standard

to investigate complaints or legal claims

to prepare anonymous statistics on our performance in order to manage, improve and extend the services we are able to provide to you

to administer and protect our business and our website (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data)

to use data analytics to improve our website, marketing, relationships and experiences

to send you our email updates where you have requested us to do so

Consent

Entering into/ performance of a contract

Legal obligation

Protect vital interests

Public task

Automated ID verification (Automated Verification)

using results of biometric verification provided by our third-party provider, Veriff, to confirm your identity in order to provide relevant products (i.e. prescription drugs) to you in compliance with industry regulations

Necessary for our legitimate interests in ensuring we are providing the correct individual with the correct product(s)/ service(s), prevent fraud or misuse of our products and meet our professional and regulatory obligations as an online pharmacy

Manual ID verification (Manual Verification)

carrying out a manual verification to confirm your identity in order to provide relevant products (i.e. prescription drugs) to you in compliance with industry regulations

Legal obligation

Additional information

to enable us to contact you when required

to assess, consider, arrange, obtain, and provide treatments to you

in the recommendation of treatments and procedures suitable for you

to refer you to other health practitioners for treatment

to enable us to provide related support services

for statistical purposes when we evaluate our range of services

as may be reasonably and lawfully required in emergencies

to manage patient queries; and

to help us to provide details or information you may have requested

to ensure that our services meet your needs

to assist staff to review the care that they provide and to ensure that it is of the highest standard

to investigate complaints or legal claims

to prepare anonymous statistics on our performance in order to manage, improve and extend the services we are able to provide to you

to administer and protect our business and our website (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data)

to use data analytics to improve our website, marketing, relationships and experiences

to send you our email updates where you have requested us to do so

Consent

Entering into/ performance of a contract

Legal obligation

Protect vital interests

Public task

Legitimate interests

Purchase data

to assess, consider, arrange, obtain, and provide treatments to you.

for statistical purposes when we evaluate our range of services

to ensure that our services meet your needs

to investigate complaints or legal claims

to prepare anonymous statistics on our performance in order to manage, improve and extend the services we are able to provide to you

to administer and protect our business and our website (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data)

to use data analytics to improve our website, marketing, relationships and experiences

Entering into/ performance of a contract

Necessary for our legitimate interests in ensuring we are providing you with the correct product(s)/ services)

Technical Data

for statistical purposes when we evaluate our range of services

to prepare anonymous statistics on our performance in order to manage, improve and extend the services we are able to provide to you

to administer and protect our business and our website (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data)

to use data analytics to improve our website, marketing, relationships and experiences

Necessary for our legitimate interests to better understand visitors to our website and their use of our services, to keep our website up to date, to develop our business and to inform our marketing strategy

Marketing and communications preferences

to help us to provide details or information you may have requested

to send you our email updates

to send you marketing communications

Consent

Legitimate interests

Special category data

Where we process more sensitive “special category data” such as your medical records or information relating to your health, we will process your personal information using conditions (in addition to one or more of the grounds stated above) as set out in data protection law, including but necessarily only, the following:

For Medical Purposes and Pursuant to a Contract with a Health Professional 

We may process your health, medical and other related records, and details where necessary for the purposes of medical diagnoses, the provision of health care or treatment, the management of health care systems and services subject to UK law and/or pursuant to your contract with us as health professionals subject to all applicable conditions and safeguards. 

Explicit Consent 

At your specific request we may send your records to another health or medical practitioner. You can withdraw your consent at any time.

Who will you share my information with? 

Where necessary or required, we may share your personal information as follows:

With third party service providers, in connection with services performed on our behalf.  For example, website hosting, our email provider, our software provider, our IT provider and analytics and search engine providers that assist us in the improvement and optimisation of our website, and delivery providers for delivering our products

Veriff – Where you choose Automated Verification, your biometric data (such as a facial image or facial matching data) is collected and processed by Veriff, our third-party identity verification provider on our behalf to verify your identity. Veriff acts as our processor and your personal data is protected by legal and technical safeguards. We receive the result of the verification and dispense depending on the result. Please refer to Veriff’s privacy notice here: Veriff’s Privacy Notice for how and why Veriff and its partners collect and process personal data, and Veriff’s retention periods here: Data Retention in Veriff’s Service – Veriff.
(Please note, if you prefer not to use Automated Verification, please select the Manual Verification option or email contact@pharmacy.cureclinics.uk to tell us your preference.)

With other companies within our group company, such as Cure Clinics Technology Services Ltd, and to third-party prescribing organisations to whom we have granted access to use our dispensing platform(s). We have agreements in place between these organisations to ensure your personal data is protected, and processed in a way we permit.

With government bodies, regulators, authorities and law enforcement agencies.

With the NHS bodies including NHS Digital

Public health authorities.

With our insurers and legal advisers.

if we are under a duty to disclose or share your personal data in order to comply with any legal obligation, or in order to enforce or apply or terms of use and other agreements, or to protect the rights, property, our safety, our customers, or others;

disclose information about you as required by law, to enforce this Agreement and to preserve our rights;

With third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this Privacy Notice.

This list is not exhaustive and we may use and disclose your personal data without your permission: 

(a) in connection with any legal proceedings or claims or prospective legal proceedings or claims, 

(b) to legal, judicial, regulatory, law enforcement, public health, governmental, professional and taxation authorities, 

(d) to take legal advice; and 

(e) to establish, exercise, protect, enforce or defend our legal rights 

Marketing and market research

This section explains the choices you have when it comes to receiving marketing communications and taking part in market research.

We will send you details regarding the following:

Product/ service information;

Newsletters.

We may do this via email, text message, WhatsApp, phone call, and/ or post. Information on methods used will be provided when you provide your consent.

When you register with us, we will ask if you would like to receive marketing communications, and you can change your marketing choices online, over the phone or in writing at any time.

The consent you provide for receiving marketing communications will apply to all of the entities within the Cure Clinics group company (our ‘family of services’) meaning any of these entities can send you marketing communications. This information will be included when you provide your consent. You can find more information on these entities on our website: Cure Clinics UK | Modern healthcare made personal | cureclinics.uk.

Personal information of under 18s

As per our terms and conditions, individuals must be aged 18 or over to register for and use our services. Where individuals are under 18, a parent or legal guardian must register and act on their behalf in connection with our services.

The relevant parent or legal guardian should ensure the relevant child understands how their personal data will be processed according to this privacy notice.

Where we process personal data of individuals aged under 18, we will process such data with this in mind according to data protection laws.

It is important to note that users of our site are assumed to be aged 18 or over in accordance with our terms and conditions and so our site and services are not to be accessed or used by under 18s.

How do we manage your information? 

We may from time to time appoint other members of our group of companies, or third-party service providers, to help us manage efficient systems within the business. Some of these systems may for operational reasons be located in countries overseas including the USA. 

We will only transfer your information to service providers who help manage our systems, or overseas, where we are satisfied that this is lawful and that adequate levels of protection are in place to protect the integrity and security of any information being processed and in compliance with UK data protection law. 

We do not, as a matter of routine, transfer personal data abroad. If we transfer your personal data to service providers outside the United Kingdom, then we will always use a lawful method to do so. In the case of transfers to other countries outside the UK or the European Economic Area then this will be an agreement in a legally approved form. 

Updating Your Details 

If you would like to change any of your preferences relating to the way in which we may use your information for direct marketing, then please update your user preferences or send an email to: contact@pharmacy.cureclinics.uk or write to us at 10 Cable Court Pittman Way, Fulwood, Preston, Lancashire, United Kingdom, PR2 9YW. 

Other People’s Information

If you provide us with information about another person, you confirm that they have appointed you to act for them i.e. you are their Carer, Parent or Guardian, they consent to the processing of their personal data and that you have informed them of our identity and the purposes (as set out above) for which their personal data will be processed. You will produce clear evidence to show you have been appointed and are able to share their personal information. When we first speak to them, we may tell them where we have got their information from.

How long will we hold your information for? 

We have a system of retention periods in place to ensure that your information is only stored whilst it is required for the relevant purposes such as to assist us in case of any complaint/ dispute, and/ or to meet legal requirements. Where your information is no longer required, we will ensure it is disposed of or deleted in a secure manner. 

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purpose for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements. We take into account NHS guidance.

Your rights 

You have the right to ask us at any time: 

to confirm whether we hold any of your personal data.

to send you a copy of any personal data that we hold about you.

to correct any inaccuracies in your personal data and to add relevant details where the personal data we hold is incomplete.

to delete (to the extent possible) any of your personal data, where we are required by law to do so.

to stop processing your personal data, where we are required by law to do so.

to let you have a portable copy of the personal data we hold about you, where we are required by law to do so.

to stop processing any of your personal data that we process on the basis of our legitimate interests; and

to stop sending you marketing material. However please note that we may continue to send you service related (i.e., non-marketing) communications, such as email updates relating to your treatment.

We also comply with the NHS Code of Practice on Confidential Information and pharmacists have a requirement under their professional standards to keep records about you confidential, secure and accurate.

All of our staff contracts of employment contain a requirement to keep patient information confidential.

You may choose to opt out of the NHS using your data for planning and research purposes – details are obtained by:

visiting the nhs.uk/yournhsdatamatters website portal;

using the NHS App;

writing by post using the instructions at the web link above; or

by calling the NHS Digital contact centre – 0300 303 5678 (open workdays Monday-Friday, 9am-5pm).

Specifically, you have the right to ask for a copy of all pharmacy records about you (generally in paper or electronic form).

Generally, there will be no charge for a printed copy of the information we hold about you. We are required to respond to your request within one month.

You will need to give adequate information in order for pharmacy staff to identify you (for example, full name, address and date of birth). You will be required to provide ID, for example a passport, full driving licence or credit/debit card before any information is released to you.

We do not currently use automated decision making, but may do in the future. Please check this notice for any update on this. Where we have reached a decision that affects you by processing your personal data automatically then you have the right to speak to someone to discuss that decision. 

We do not use your personal data for the purpose of profiling.

We refer you to our Connect privacy notice regarding Connect’s processing of personal data. 

Where we process your personal data on the basis that you have given us your consent to do so then you may contact us at any time to withdraw your consent 

If you wish to exercise any of these rights or wish to object to our use of your personal information, please write to us at the address given below. 

Forbes Solicitors LLP, Data Protection Officer CCDS-DPO@forbessolicitors.co.uk. By email to: CCDS-DPO@forbessolicitors.co.uk or write to us at 10 Cable Court Pittman Way, Fulwood, Preston, Lancashire, United Kingdom, PR2 9YW. 

When do you monitor telephone calls? 

We may from time-to-time record telephone calls you have with members or our staff for training purposes and to improve the quality of our service. If we plan to record any telephone call, your express consent will be sought prior to any recording. You may withdraw or not give your consent at any time. 

How do we update this privacy notice? 

We keep our privacy notice under regular review, and we will place any updates on our webpage. 

Who can I contact if I have queries about this privacy notice? 

You can also contact us directly if you have any questions about our privacy notice or information we hold about you. 

Please write to us using the following details:

Forbes Solicitors LLP, Data Protection Officer. By email to: CCDS-DPO@forbessolicitors.co.uk or write to us at 10 Cable Court Pittman Way, Fulwood, Preston, Lancashire, United Kingdom, PR2 9YW.
If you are dissatisfied with our handling of any query or complaint you, also have the right to raise concerns with The UK Information Commissioner: https://ico.org.uk or at: 

Customer Contact

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

SK9 5AF