At Click2Pharmacy, we’re committed to protecting and respecting your privacy. This Privacy Policy explains when and why we collect personal data (also referred to as personal information) about you, how we use it, the conditions under which we may disclose it to others, how we keep it safe and secure and your rights and choices in relation to your information. Please read the following carefully to understand our practices regarding your personal data and how we will treat it.
Click2Pharmacy is owned and operated by the UK registered company Patel’s Chemist Limited. Company No 04454193.
Patel’s Chemist are registered as a data controller with the Information Commissioner’s Office (‘ICO’) and our registered number is ZA508877.
Postal address:
33 Werneth Hall Road
Oldham
Lancashire
OL8 4BB
Email: hello@click2pharmacy.co.uk
We use different methods to collect information from and about you when you visit or create an account on our website, or contact us. This includes information you provide about yourself to access our services, when you purchase our products online, engage with us on social media, visit our website or sign up for an account. It also includes information that may be shared with us by third parties and from other healthcare professionals in relation to your medical history and records.
As a Click2Pharmacy customer, it’s important that the personal data we hold about you is accurate and up-to-date. Please keep your account information up to date in your My Account area and notify us if any other personal data changes during your time as a patient.
Personal data means any information about an you from which you can be identified. It does not include data where your identity has been removed, known as anonymous data.
Personal data we may collect, use, store and transfer about you, are as follows:
This is not an exhaustive list and we may need to collect additional data for the purposes set out in this Policy. Some of the above personal data is collected directly, for example when you set up an account on our website when you make a purchase or contact us via our website or social media.
Where we need to collect personal information by law, legitimate interest or under the terms of a contract we have with you, and you fail to provide that data, we may not be able to provide prescription medicines, treatments and/or our services. In this case, we may have to cancel a service you have with us, which we will notify you about at the time.
In order to provide you with prescriptions for medicines and health care services we may have to collect personal data about you from other organisations. This may include medical records which include personal data about your tests and diagnosis, clinic and hospital visits and medicines administered from your GP, healthcare professional, the NHS or private healthcare organisations and mental health providers.
The confidentiality of your medical information is important to us. All your personal information is processed in line with this policy, and in compliance with all applicable medical confidentiality guidelines.
We will only use your personal data when the law allows us to do so. The law on data protection sets out a number of different reasons for which a company may collect and process your personal data.
Our online pharmacy processes sensitive health data, such as your prescription details or medical queries, to provide healthcare services. This is necessary under Article 9 (Processing of special categories of personal data) of the UK GDPR for the provision of healthcare, with a legal basis of fulfilling our contract with you, as per Article 6 (Lawfulness of processing). If required, we may also process health data to comply with legal obligations, such as reporting to healthcare industry regulators.
We will also use your personal data in the following circumstances:
When collecting your personal information, we will always make it clear to you which data is necessary in connection with the particular activity.
In certain circumstances, we need your personal information to comply with our contractual obligations or to pursue our legitimate interests in a way which might be reasonably expected as part of our running our business.
If you have given your consent to receive marketing emails you can withdraw this at any time in your My Account area. If you have received a marketing email from us and no longer wish to receive them, the easiest way to let us know is to click on the unsubscribe link at the bottom of our marketing emails. This will not stop you from receiving emails related to your orders, which are essential for us to fulfil our contract with you as a customer.
Our website uses cookies to distinguish you from other users of our websites. This helps us to provide you with a seamless experience when you browse our websites and allows us to improve our website for all customers. Please see our cookies policy for information on how we use cookies.
We will keep your personal information for as long as necessary to fulfil the purposes it was collected for, including meeting legal or regulatory requirements.
We typically retain order and account data for no longer than 6 years after your last interaction with us, in line with standard UK limitation periods. Prescription and health-related data may be kept longer, such as up to 8 years, to comply with healthcare regulations. If required by law, such as for tax or safety reporting, we may retain data beyond these periods.
If you would like further information regarding the periods for which your personal data will be held, please contact us using the information above.
In circumstances where we anonymise your data so that it can no longer be associated with you, we may use this information indefinitely without further notice for analytical or statistical purposes.
We work hard to keep your information and personal information safe. We use a combination of technical, administrative, and physical controls to maintain the security of your personal information and protect against accidental, unlawful or unauthorised destruction, loss, alteration, access, disclosure or use.
All information you provide to us is stored on our secure servers or within secure filing systems. We utilise industry “good practice” standards to support the maintenance of a robust information security management system. Some of the controls we have in place to protect your personal data include technological controls such as firewalls and strong data encryption. Any payment transactions will be encrypted.
Your information will only be stored within the United Kingdom except where international transfers are authorised by law.
As part of our security controls we use data entry and retrieval which is encrypted using an SSL certificate provided by InMotion and secured by Let’s Encrypt. This ensures that no one else can read or change information as it travels over the internet.
We use a trusted third-party payment gateway, SagePay, to process your payments securely. When you make a purchase on our website, your payment information is collected and processed directly by these providers. We do not store your full payment details on our servers; however, we may retain limited information (e.g., transaction ID, date, and amount) for order fulfilment, accounting, and legal purposes. SagePay are responsible for handling your payment data in accordance with their own privacy policies and applicable data protection laws.
We share your personal information with specific third parties to operate our services and meet legal duties. Our selected third-party processors, such as delivery companies (e.g. Royal Mail), payment providers (e.g. SagePay), and IT support firms (e.g. cloud storage providers), access your data only to the extent necessary for their tasks, like delivering your order or processing payments.
We may also share data with marketing agencies if you’ve consented, professional advisors (e.g. accountants), or regulators like HMRC when required by law. Each recipient is bound by strict confidentiality and data protection rules. Below is a list of the organisations to help us provide and/or support us provide services to you.
| Third party provider | Service provided |
| SagePay | Payment processing |
| Click2Pharmacy staff | Treatment & services |
| GPHc | Regulatory audits & inspections |
| NHS | Treatments, medical records & services |
| Delivery companies (such as Royal Mail) | Delivery services |
| Doctors | Treatment & services |
| Review platforms (such as TrustPilot) | Customer review collection |
| Internet service providers | Internet services |
| CRM tools (such as ThriveDesk) | Patient communication |
| Marketing tools (such as MailChimp) | Marketing communication |
Please also see our cookies policy for further information.
Whenever you have given us your consent to use your personal information, you have the right to change your mind at any time and withdraw that consent. This will not affect the lawfulness of any processing carried out before you withdraw your consent.
Under UK data protection law, you have certain rights over the personal information that we hold about you:
We aim to be transparent within our Privacy Policy and provide you with information about how we use your personal information.
You have the right to request access to the personal data that we hold about you and to request a copy of it, and we will provide you with this unless legal exceptions apply.
You have the right to have inaccurate or incomplete information we hold about you corrected.
You can request the erasure of your personal information when it is no longer necessary, you withdraw consent, or you object to its processing. Some information held by us is required by law to be held for a period of time.
You can request that we restrict the processing of your personal information providing this processing is not required for us to complete our contractual obligations with you and our regulators.
In some circumstances you have the right to stop the processing of your personal information for reasons connected to your individual circumstances. We must then do so unless we believe we have a legitimate overriding reason to continue processing your personal information.
If you want to exercise any of the above rights, please contact us using contact details stated in this Privacy Policy. We may be required to ask for further information and/or evidence of identity before we can process your request.
Please note that exceptions apply to a number of these rights, and not all rights will be applicable in all circumstances. For more details we recommend you consult the guidance published by the UK’s Information Commissioner’s Office.
Please see our Comments and Complaints procedure for more information.
Any changes we may make to this Privacy Policy in the future will be posted on our website, so please check occasionally to ensure that you’re happy with any changes. If we make any significant changes to the way we process your personal data, we’ll make this clear on our websites.
This Privacy Potice was last updated on 08/04/2025.
