Legal
Privacy notice
Last reviewed: placeholder date. This notice explains how we handle your personal and health data under the UK GDPR and the Data Protection Act 2018.
Who controls your data
Biswas Medical Limited is the data controller for the personal data described here. Our Data Protection Officer can be reached at dpo@biswasmedical.co.uk or at our registered office. We are registered with the Information Commissioner's Office, registration ZA123456 (placeholder).
What we collect
Contact details, date of birth and NHS number where you give it; clinical information you provide in consultations and prescription uploads; appointment and dispensing records; order and delivery details; and technical data such as device type and pages visited, used only to keep the service secure and working.
Why we use it, and our lawful basis
We process health data to provide care under Article 6(1)(b) and Article 9(2)(h) UK GDPR — the provision of health care by professionals bound by a duty of confidentiality. We use contact details to run your account and orders. We only send marketing if you opt in, and you can withdraw at any time.
Prescription uploads
Files you upload are stored encrypted in a private area that is not publicly reachable. Access is restricted to you and the pharmacy staff involved in dispensing your medicine. Access is logged.
Who we share it with
Your GP or prescriber where needed for your care; NHS bodies for NHS services and reimbursement; our delivery partners (name and address only); and our hosting and payment providers acting under contract. We never sell your data. Payment card details are handled by our payment provider and never stored on our systems.
How long we keep it
Adult health records are kept for the periods in the NHS Records Management Code of Practice — generally eight years after the last episode of care, and longer for children. Order and financial records are kept for six years for tax purposes. Account data is deleted when you close your account, subject to those retention rules.
Where your data is held
Data is hosted in the United Kingdom and the European Economic Area. If any provider processes data outside those areas, we use UK-approved safeguards such as the International Data Transfer Addendum.
Your rights
You can ask for a copy of your data, ask us to correct it, object to certain processing, ask for erasure where retention rules allow, and request portability. Contact dpo@biswasmedical.co.uk. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.
Cookies
We use strictly necessary cookies to keep you signed in and keep your basket. Analytics cookies are only set with your consent and can be withdrawn at any time.