Privacy Policy and Patient Privacy Notice

1.Introduction

Blue House Retail Limited owns and operates Blue House Pharmacy, a pharmacy registered with the General Pharmaceutical Council at 1 Heworth Road, Concord, Washington. We dispense NHS and private prescriptions, supply medicines over the counter, deliver medicines to patients, and dispense prescriptions issued by the prescribers who work with the online clinic at trimu.com.

Handling information about your health is central to what we do, and the law treats that information as deserving the highest level of protection. This notice explains, in plain terms, what information we hold about you, where it comes from, what we do with it, who else sees it, how long we keep it, how we keep it safe and what rights you have. We have written it to meet our obligations under the UK General Data Protection Regulation and the Data Protection Act 2018, our professional obligations under the standards set by the General Pharmaceutical Council, and the common law duty of confidence that every healthcare professional owes their patients.

We are the controller of the information described in this notice. That means we decide why and how it is used, and we are legally accountable for it.

1.1Who this notice applies to

This notice applies to you if you are any of the following.

• A patient who has an NHS or private prescription dispensed by us, whether you collect it from the pharmacy or we deliver it to you.
• A patient of the online clinic at trimu.com whose prescription is sent to us to dispense and deliver.
• A customer who buys a medicine or other product over our counter, or who asks our team for advice.
• Someone who uses one of our NHS or private services at the pharmacy, such as Pharmacy First, a blood pressure check or a medicines review.
• A carer, parent, representative or nominated person collecting or ordering on someone else's behalf.
• A visitor to our website or our premises.
• Someone who contacts us with a question, a compliment or a complaint.
• A supplier, contractor or job applicant. Section 25 deals with you specifically.

1.2What this notice does not cover

This notice does not cover what other organisations do with your information under their own responsibility. In particular, it does not cover the online consultation you complete at trimu.com, the clinical assessment carried out by the prescribers there, or the decision to issue you with a prescription. Those are the responsibility of AO Health Ltd, and section 3 explains the split. It also does not cover websites you reach by following a link from ours.

2.Who we are and how to reach us

If you have a question about this notice, want to exercise one of your rights, or are unhappy about how we have handled your information, please contact us first. The quickest route is by email.

We are registered with the Information Commissioner's Office, the UK's independent data protection regulator, under registration number ZB930745, and we pay the annual data protection fee. Our entry can be checked by anyone on the ICO's public register at www.ico.org.uk.

3.How the trimu.com arrangement works

Many of the medicines we dispense are prescribed through the online clinic at trimu.com. It is important that you understand which organisation is responsible for which part of your care, because each of us is separately accountable for the information we hold.

3.1We are an entirely separate organisation

Blue House Pharmacy and AO Health Ltd are separate and independent companies. We are not part of the same group, we are not owned or controlled by AO Health Ltd, and we do not share a data controller. We each have our own data controller registration, our own information governance arrangements and our own named data security lead. Ours is Babar Arshad, as recorded in our NHS Data Security and Protection Toolkit submission. AO Health Ltd cannot instruct us on how to handle the records we create, and we cannot access their records.

3.2What crosses between us, and what does not

We have a written agreement with AO Health Ltd governing exactly what information passes between us. Under that agreement, information reaches us in one direction only and only for a specific prescription.

• We receive information through a shared portal, and only for a patient who has agreed that their prescription should be sent to us to dispense. If a patient has not chosen us, nothing about them appears on the portal and we never see it.
• For a patient who has chosen us, we receive only what we need in order to dispense safely and deliver to you: your name, date of birth, contact and delivery details, the prescription itself, and the clinical information a pharmacist needs to carry out the legally required checks, such as your relevant medical history, allergies, current medicines and, where applicable, measurements such as your height and weight.
• There is no other flow of data between the two organisations. We have no access to AO Health's wider patient database, to consultations that did not result in a prescription sent to us, or to any patient who uses a different pharmacy. There is no shared or overlapping record.

3.3The records we create and keep

Once a prescription reaches us, the law places duties directly on us. We must satisfy ourselves that the prescription is valid and that the medicine is clinically appropriate for you, we must record the sale and supply of a prescription only medicine, and we must be able to account for those records to the General Pharmaceutical Council and to the Medicines and Healthcare products Regulatory Agency. To meet those duties we keep:

• A private prescription register, held digitally, recording every prescription we dispense that originates from trimu.com.
• An electronic patient medication record for you, holding your personal details and a record of every medicine we have supplied to you, including the drug name, its strength, the form, the quantity supplied, the directions, the date of supply and the delivery details.

If your question is about your consultation, your diagnosis, your prescription or your suitability for a treatment, AO Health Ltd is the right organisation to ask. If your question is about the medicine we dispensed, how it was supplied, its delivery, or the records we hold about the dispensing, we are the right organisation to ask.

4.The information we hold about you

What we hold depends on which of our services you use. Not every category below will apply to you.

What we do not collect. We do not ask about your race, ethnic origin, religion, political opinions, trade union membership, sex life or sexual orientation, and we do not collect genetic or biometric information, unless a particular NHS service requires it and you have been told so at the time, or unless it is clinically relevant to a treatment you have asked for and you have chosen to tell us. We do not store your full payment card number, and we do not collect criminal offence information about patients.

5.Where your information comes from

• From you. When you hand in a prescription, order a repeat, speak to our team in person or by telephone, email or message us, complete a form, buy something from us, or set up an account.
• From AO Health Ltd, which operates trimu.com. The prescription and the clinical information we need to dispense it safely and deliver it to you, as described in section 3.
• From your GP practice, hospital or another prescriber. Prescriptions, and information we ask for or give when we need to clarify a prescription, resolve a query or tell them about a supply we have made.
• From NHS systems. The NHS Spine and the Electronic Prescription Service, where an NHS prescription has been sent to us electronically, and your Summary Care Record, which our pharmacists may view where it is necessary for your care and, other than in an emergency, with your permission.
• From NHS commissioning bodies. Where you have been referred to us for a service, or where we are told you are eligible for one.
• From someone acting for you. A carer, family member, representative or care home, where that is appropriate and lawful.
• From our suppliers. Our delivery partners tell us about the progress of a delivery. Our payment provider tells us whether a payment succeeded.
• Automatically. Through cookies and similar technologies when you use our website, as described in section 15.

6.Why we use your information, and our lawful bases

We only use your information where the law allows. In each case we rely on a lawful basis under Article 6 of the UK GDPR and, where health information is involved, an additional condition under Article 9 of the UK GDPR together with a condition in Schedule 1 to the Data Protection Act 2018.

Where we rely on legitimate interests. We have weighed our interests against your interests, rights and freedoms and concluded that ours are not overridden. You can ask us for our assessment, and you have the right to object, as explained in section 20.

Where we rely on consent. You can withdraw it at any time. That does not affect anything we did while the consent was in force. Withdrawing consent to marketing or to analytics cookies has no effect on the pharmacy services we provide to you.

Information you have to give us. Some information we are required by law to collect, and some we need in order to fulfil a contract with you. If you do not give it to us we will not be able to dispense your medicine or provide the service. We will tell you at the time if that is the case.

Using your information for a new purpose. If we ever need to use your information for something not described here, we will tell you first and explain the lawful basis, unless the law allows or requires us to act without telling you.

7.NHS services and the National Data Opt-Out

Where we provide services for the NHS, we handle your information in line with NHS information governance requirements as well as data protection law. NHS bodies including NHS England, the NHS Business Services Authority and your Integrated Care Board receive information about the NHS services we provide to you, so that prescriptions can be processed, payments verified and services assured.

The NHS National Data Opt-Out lets you stop your confidential patient information being used for research and planning, as opposed to your own care. We apply the national data opt-out where it is relevant to information we hold. It does not affect information used to provide your care, and it does not affect information we are required by law to hold or disclose. You can set or change your choice at www.nhs.uk/your-nhs-data-matters or by calling 0300 303 5678.

8.Photographs and images

Sometimes a photograph is relevant to a supply, for example an image showing a skin or scalp condition, an injection site, or a prescription you have photographed and sent to us. Where we receive such an image, we treat it as health information and hold it in the clinical record with the same protection as any other clinical note.

We will not publish an image of you, use it for training, or use it in any marketing, without asking you separately and obtaining your written consent, which you are free to refuse and free to withdraw. Please do not send us images through social media or other unsecured channels.

9.Automated decision-making and profiling

Our systems carry out automated checks. Our dispensing system flags interactions, allergies, doses outside the expected range and duplicate supplies. Our ordering process carries out automated fraud and identity checks. These checks support our pharmacists, they do not replace them.

We do not make any decision that produces a legal effect concerning you, or that similarly significantly affects you, based solely on automated processing. A pharmacist reviews every supply, and a person reviews any automated refusal before it takes effect. If you believe a decision has been reached unfairly, you can ask us to review it, ask for a person to look at it again, and put your own point of view.

10.Artificial intelligence

We do not use your personal or health information to train artificial intelligence or machine learning models, and we do not provide your information to any third party to train theirs.

11.Who we share your information with

We do not sell your personal information, and we never sell, rent or trade health information. We share only what is necessary, only with organisations that have a proper reason to receive it, and only where the law permits.

Every organisation that handles your information on our behalf does so under a written contract requiring it to keep the information secure, to use it only for the purpose we specify, to impose the same duties on anyone it engages, and to return or destroy the information when it is no longer needed.

12.Discretion in how we deliver and package

We know that the medicines we supply can reveal something private about you. Our parcels are plain, they carry no branding that identifies the contents or the condition being treated, and no clinical information appears on the outside. Delivery drivers are told only where to deliver and what your delivery instructions are. We make all our deliveries using the Royal Mail. We comply with all regulations for data protection as per requirements on their privacy policy.

13.Marketing

We send marketing to patients only where you have given us your permission to do so. We ask for that permission separately from anything else, we do not pre-tick any box, and we do not treat buying a medicine from us as permission to market to you. The law would in some circumstances allow us to market to an existing customer without asking first, under what is known as the soft opt-in, but we have chosen not to rely on it. If you have not told us we may contact you, we will not.

Every marketing message contains an unsubscribe link, and you can opt out at any time by using it, by replying STOP to a text, by changing your preferences in your account, or by contacting us using the details in section 2. We act on an opt-out promptly and keep a record of it so that we do not contact you again by mistake.

Opting out of marketing does not stop messages we need to send you about a specific order, a delivery, your medicine, a safety matter or your account. Those are service messages, not marketing.

14.Reviews, surveys and feedback

We may invite you to review our service or take part in a short survey. Taking part is entirely voluntary and declining has no effect on the service you receive. If a review you write would identify you, we will not publish it without your consent. Please do not include clinical details about yourself in a public review.

15.Cookies and similar technologies

A cookie is a small file placed on your device when you visit a website. We also use similar technologies such as pixels, tags and browser storage. We group them into four types.

• Strictly necessary. These make the site work: keeping you signed in, remembering your basket, balancing load and protecting against fraud and attack. They do not need your consent and cannot be switched off.
• Functional. These remember choices you have made, such as your preferences or your region.
• Analytics. These tell us how many people visit, which pages they use, and where they run into problems.
• Advertising. These measure how well our advertising works and help show you relevant adverts elsewhere.

Apart from strictly necessary cookies, nothing is set until you consent through the banner shown on your first visit. You can change or withdraw your choices at any time through the "Cookie settings" link in the footer of every page.

The table below lists the cookies and similar technologies we use, what each does, who sets it and how long it lasts.

Your browser also lets you block or delete cookies. Blocking strictly necessary cookies will stop parts of our site working. Where your browser or device sends an automated privacy signal that the law requires us to honour, such as Global Privacy Control, we honour it.

16.How we keep your information safe

We have technical and organisational measures in place to protect your information against loss, destruction, alteration and unauthorised access or disclosure. They include the following.

• Every page of our website that collects or displays personal information, and every page relating to orders and payments, is served over an encrypted TLS connection. Personal and clinical information is encrypted in transit and when stored.
• Access to patient records is limited to those members of our team who need it to do their job. Access is through individual named accounts with multi-factor authentication, and it is logged so that we can see who viewed a record and when.
• Payment card details are captured directly by our payment provider, which is certified to the Payment Card Industry Data Security Standard. We never see or store your full card number.
• Our premises are secured, controlled drugs are held in a compliant cabinet, and paper records are held in areas that patients and visitors cannot access.
• All members of our team complete information governance and confidentiality training when they join and refresh it annually, and are bound by contractual confidentiality obligations. Our pharmacists are additionally bound by professional duties of confidentiality enforced by the General Pharmaceutical Council.
• We maintain written standard operating procedures covering information governance, access control, confidentiality, secure disposal, business continuity and incident response, and we test our backups.
• We complete the NHS Data Security and Protection Toolkit, which is the assessment the NHS uses to confirm that an organisation is handling personal information correctly and meeting the national data security standards. Our most recent submission, for 2026-27 under version 9 of the Toolkit, was published on 22 September 2026 with a status of Standards Met, and is valid to 30 June 2028. It is held under our NHS organisation code FPP24 and can be viewed by anyone at www.dsptoolkit.nhs.uk.
• We have a procedure for dealing with a suspected personal data breach. Where the law requires it we will report a breach to the Information Commissioner's Office within 72 hours of becoming aware of it, and we will tell you without undue delay where a breach is likely to result in a high risk to your rights and freedoms.

No method of sending information over the internet is completely secure. Please do not send clinical information to us through social media or other unsecured channels. Use your account, our secure forms, the telephone, the post, or speak to us in the pharmacy.

17.Sending information outside the United Kingdom

We aim to keep your information in the United Kingdom. Some of our suppliers, in particular IT, hosting and communications providers, may store or access information outside the UK.

Where that happens, we make sure the information is properly protected by relying on one of the safeguards permitted by Chapter V of the UK GDPR: a UK adequacy regulation covering the destination country; the UK International Data Transfer Agreement or the UK Addendum to the European Commission's Standard Contractual Clauses, supported by a transfer risk assessment; or the UK Extension to the EU-US Data Privacy Framework where the recipient is certified under it.

You can ask us which transfers we make and which safeguard applies to each.

18.How long we keep your information

We keep your information only for as long as we need it, and for as long as the law and our professional obligations require. Where more than one period applies to the same record, we apply the longest. The main periods are below.

When information is no longer needed we delete it securely or anonymise it so that it can no longer be connected to you. Paper records are destroyed by confidential shredding.

19.Your rights

You have the following rights under the UK GDPR and the Data Protection Act 2018. Some apply only in particular circumstances.

• The right to be informed. To know what we do with your information, which is what this notice is for.
• The right of access. To get a copy of the information we hold about you, and information about how we use it. This is often called a subject access request.
• The right to rectification. To have inaccurate information corrected and incomplete information completed.
• The right to erasure. To have information deleted, subject to the important limits in section 20.
• The right to restrict processing. To have us pause our use of your information while a concern you have raised is looked into.
• The right to object. To object to our use of your information where we rely on legitimate interests, and to object to direct marketing at any time, which we will always honour.
• The right to data portability. Where we process information you gave us by automated means on the basis of consent or a contract, to receive it in a commonly used machine-readable format or have it sent to another organisation.
• The right to withdraw consent. Where we rely on your consent, at any time.
• Rights relating to automated decisions. To ask for human involvement, as described in section 9.
• The right to complain. To the Information Commissioner's Office, as set out in section 29.

To exercise a right, contact us using the details in section 2. We will ask for proof of identity so that we do not disclose your information to the wrong person, and if you are asking on someone else's behalf we will ask for evidence of your authority. We respond within one month. If a request is complex, or if you have made several, we may extend that by up to two further months and will tell you if we do. There is no charge unless a request is manifestly unfounded or excessive.

20.Why we do not delete records of medicines we have supplied

People are sometimes surprised that a pharmacy cannot simply delete their record on request, so it is worth setting out plainly.

We do not erase clinical records of medicines we have supplied. Our private prescription register and your electronic patient medication record are retained for eight years from the date of supply, in line with the period the NHS Records Management Code of Practice sets for an adult clinical record, and longer where a period in section 18 requires it. We keep them because the law obliges us to and because a record of what medicine a person has taken can matter years later, to another prescriber, to a coroner, or to the person themselves.

The right to erasure in Article 17 of the UK GDPR does not apply where processing is necessary for compliance with a legal obligation, for reasons of public interest in the area of public health, for the purposes of health care under Article 9(2)(h), or for the establishment, exercise or defence of legal claims. Our dispensing records fall into those exceptions. We will therefore refuse a request to delete them, and we will tell you in writing why and what you can do about it.

There is a great deal we can still do. We will close your online account, stop all marketing, delete anything we are not required to keep, and limit who inside the pharmacy can open your record. Where you dispute the accuracy of a clinically significant entry, we record your account of it alongside the entry rather than removing the entry, which is what the NHS and the GPhC expect of a health record.

20.1Keeping a record is not the same as sharing it

Holding a record for eight years does not mean anyone can ask us for it. Your record is confidential, under data protection law and under the separate common law duty of confidence that our pharmacists owe you. We do not disclose it to a family member, an employer, an insurer, a solicitor, a landlord or anyone else simply because they ask. The circumstances in which we may lawfully disclose without your consent are narrow, and they are set out below.

None of these is a blanket permission. A police request does not compel us to hand over a record: it is for us to decide, each time, whether the disclosure is necessary and proportionate, and we will refuse where it is not. We disclose the minimum information needed, to the person entitled to receive it, and we record what we disclosed, to whom, on what basis and why. Where we hold an appropriate policy document because the condition we rely on requires one, we maintain it and will provide it to the Information Commissioner on request. Wherever it is safe, lawful and practical, we will tell you before we disclose, or afterwards if telling you first would defeat the purpose.

21.Children and young people

The medicines dispensed against prescriptions from trimu.com are supplied only to people aged 18 and over, and our online services are not directed at children. We do serve children and young people at our premises, for example when a parent collects a prescription for a child or asks our advice about a minor illness. We do not provide vaccination services.

22.Carers, representatives and people acting for you

You may ask someone to collect a prescription, place an order or speak to us for you. We will check that they have your authority and we will share only what they need in order to do what you have asked. We do not discuss your care with a family member or friend who has no authority, however well meant the enquiry. Where you lack capacity to make a decision, we act in your best interests under the Mental Capacity Act 2005 and involve the person with lasting power of attorney or court-appointed deputy where there is one.

23.Confidentiality and safeguarding

Everything you tell us is held in confidence, both under data protection law and under the separate common law duty of confidence that our pharmacists owe you. There are narrow circumstances in which we may disclose confidential information without your consent: where you or someone else is at risk of serious harm, where a child or an adult at risk may be being abused or neglected, where we are required to by a court or by law, or where there is an overriding public interest. We disclose the minimum necessary, to the right person, and we record what we disclosed and why. Wherever it is safe and practical to do so, we will tell you first.

24.CCTV at our premises

We operate CCTV at the pharmacy for the safety of patients, staff and stock, and to meet the security requirements that apply to the storage of controlled drugs. Signs are displayed so that you know when you are in a monitored area. Cameras do not cover any area where you would reasonably expect privacy, such as a consultation room or a toilet. Footage is held securely, viewed only by authorised people and only when there is a proper reason, and retained for the period shown in section 18. You have the right to ask for a copy of footage of yourself.

25.Suppliers, contractors and job applicants

25.1Suppliers and contractors

If you supply goods or services to us, we hold your business contact details, the details of the people who deal with us, your bank details for payment, and where relevant evidence of your insurance, registration and right to work. We use it to manage the contract, to pay you and to meet our own regulatory obligations, relying on Article 6(1)(b) and Article 6(1)(c). We keep it for six years after the end of the relationship.

25.2Job applicants

If you apply to work with us, we hold your application, CV, references, right to work evidence, professional registration details and interview notes. For roles that qualify, we obtain a Disclosure and Barring Service check, and we handle criminal offence information under Article 10 of the UK GDPR with the relevant condition in Schedule 1 to the Data Protection Act 2018, in line with our written policy. We keep applications from unsuccessful candidates for six months and then delete them. If you join us, your records are covered by our separate staff privacy notice.

26.Our registrations, and how to check them

You are entitled to know who you are dealing with, and you should not have to take our word for it. Every registration below is on a public register and can be checked independently.

27.Links to other websites

Our website links to other sites, including trimu.com, NHS websites, medicines manufacturers and the registers of our regulators. Once you follow a link you are on a site we do not control and this notice no longer applies. We encourage you to read the privacy notice of any site you visit.

28.Changes to this notice

We review this notice at least once a year and whenever our services or the law change. The version number and effective date at the top tell you when it was last updated. Where a change materially affects how we use your information we will bring it to your attention, for example by email or by a prominent notice on our website, rather than relying on you to notice it. Previous versions are available on request.

29.How to complain

If you are unhappy with how we have handled your information, please tell us first using the details in section 2, so that we have the chance to put things right. We will acknowledge your complaint promptly and tell you who is dealing with it.

You can also complain to the Information Commissioner's Office at any time, and you do not have to come to us first.

If your complaint is about the pharmacy service itself rather than your information, you can contact the General Pharmaceutical Council at www.pharmacyregulation.org. If it concerns an NHS service we provided, you can also complain to NHS England. If it concerns your online consultation, your prescription or the clinical decision to prescribe, that is a matter for AO Health Ltd, which operates trimu.com and is registered with the Care Quality Commission.

30.Dispensing pharmacy details

All medicines ordered through our website, and all medicines dispensed against prescriptions issued through trimu.com, are dispensed and supplied by the registered pharmacy below.