Privacy Policy

What we collect

We collect only what we need to assess you safely and get your order to you.

• Your name, date of birth, email address, phone number and delivery address
• Your consultation answers, including symptoms, medical history, medication and allergies
• Records of prescriptions issued, and of medicines dispensed to you including batch and expiry
• Order and payment records — card details are handled by our payment provider and never stored by us
• Technical information such as your IP address, used for security and fraud prevention

Our lawful basis

For health data, we rely on Article 9(2)(h) of the UK GDPR — processing necessary for the provision of health care and the management of health care systems — alongside Article 6(1)(b), performance of a contract with you.

Where we send you marketing, we rely on your consent, which you can withdraw at any time.

Who sees your information

Your consultation is seen by the prescriber reviewing it and by the pharmacy team dispensing your order. Both are bound by professional duties of confidentiality.

We share your delivery details with the courier carrying your order, and payment details with our payment provider. We do not sell your data, and we do not share it with advertisers.

We contact your GP only with your agreement, or in the uncommon situation where a prescriber judges it necessary to protect you from serious harm.

How long we keep it

Health records, including consultations and dispensing records, are kept for ten years from your last interaction with us, in line with professional record-keeping requirements. Order and financial records are kept for six years for tax purposes.

After those periods, records are securely destroyed.

Your rights

Under the UK GDPR you have the right to:

• Ask for a copy of the information we hold about you
• Ask us to correct anything inaccurate
• Ask us to delete information, where we are not legally required to keep it
• Object to processing, or ask us to restrict it
• Ask for your data in a portable format
• Withdraw consent for marketing at any time

Security

Data is encrypted in transit and at rest. Access to consultation records is limited to staff who need it for your care, and every access and clinical decision is logged.

If a breach occurs that is likely to risk your rights and freedoms, we will tell you and the Information Commissioner's Office without undue delay.

Contact and complaints

Contact our data protection lead at support@homingo.example. If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.