Privacy notice

1. Who we are

Push Pharmacy is a trading name of Push Healthcare Ltd, registered in England and Wales, company no. 10958811. We're the "controller" of your personal information, which means we decide how it's used and are responsible for looking after it.

Data protection officer: Imran Patel, Superintendent Pharmacist. Contact him using the details above, or through our secure contact form.

2. What information we hold

• Your details: name, date of birth, address, phone number, email address and NHS number.
• Your GP practice and your choice of nominated pharmacy.
• Your prescriptions and medicines, including what we've dispensed and delivered.
• Health information from consultations with our pharmacists, for example for Pharmacy First or the New Medicine Service, and information about allergies or other medicines.
• Whether you pay for prescriptions or are exempt.
• Communication needs, such as large print or an interpreter.
• Details of a family member or carer who helps you with your medicines, if you tell us.
• Records of our contact with you, including messages, feedback and complaints.
• CCTV images of anyone at our premises, such as staff, couriers and visitors.

Health information is "special category" information under data protection law, and we protect it with extra care.

3. Where we get it from

• from you, or someone acting for you
• from your GP practice or other prescriber, through the NHS Electronic Prescription Service or on a paper prescription
• from NHS national systems, such as the Personal Demographics Service (to check your details) and your Summary Care Record (with your permission)
• from other health and care services involved in your care, such as a hospital when you're discharged

4. How we use it, and our legal reasons

Data protection law says we must have a lawful reason to use your information. For health information we also need an extra condition.

Our pharmacists and staff also have a duty of confidentiality to you. We don't use your information for marketing, we don't sell it, and we don't make decisions about you by automated means.

5. Our website and forms

• Forms: when you send us a form, your answers travel to our website over an encrypted connection, then are emailed to our NHS email account (NHS.net Connect) through our website host's email service, which holds them only while delivering them. They're not saved on the website. We then add what we need to your pharmacy record. Wholesale enquiries go to our separate wholesale email account.
• Spam protection: to stop automated spam, we keep a scrambled (hashed) version of your internet address for a short time, normally about an hour. On its own it doesn't show who you are.
• Server logs: our website host, GoDaddy, keeps standard web server logs (internet address, date and time, pages visited and browser type) for security and troubleshooting. These are kept for up to two months.
• Cookies: our website doesn't use cookies or any tracking. See our cookies page.
• Links: our Healthy living page links to the NHS website, which has its own privacy notice.
• WhatsApp and social media: if you message us on WhatsApp, Facebook, Instagram or X, that company also handles your message under its own privacy policy. WhatsApp messages are end-to-end encrypted. We move anything about your care into your pharmacy record. For detailed health questions, please call us or use our secure contact form instead.

6. Who we share it with

We only share what's needed, and only for the reasons above:

• your GP practice, for example to request your repeat prescriptions or to tell them about a Pharmacy First consultation
• NHS England (or the body that takes over its role), which runs the national systems we use, like the Electronic Prescription Service and Summary Care Record
• the NHS Business Services Authority, which pays pharmacies for NHS prescriptions and checks prescription charge exemptions
• NHS North East London, which commissions our NHS services and handles NHS complaints
• other health and care professionals involved in your care, when needed
• companies that provide services to us, such as our pharmacy record system supplier, video consultation provider (Microsoft Teams, through NHS.net Connect), delivery companies (for example Royal Mail), NHS.net Connect email, IT support and our website host (GoDaddy). They may only use your information on our instructions, under a contract.
• regulators, the police or courts, when the law requires it, for example the General Pharmaceutical Council during an inspection

7. Your Summary Care Record

Your Summary Care Record holds key information from your GP record, such as your medicines and allergies. Our pharmacists can view it through the NHS National Care Records Service when it helps your care. We'll always ask your permission first, except in an emergency. Every time it's viewed, this is recorded and checked.

You can choose what your Summary Care Record includes, or opt out, by speaking to your GP practice.

8. The national data opt-out

The national data opt-out lets you choose whether your confidential patient information is used for research and planning. We don't use your information for research or planning, so the opt-out doesn't change how we use it. You can find out more or set your choice at nhs.uk/your-nhs-data-matters, in the NHS App, or by calling 0300 303 5678.

9. Where your information is stored

Our pharmacy systems keep your information in the UK. Our website is hosted in GoDaddy's European data centre, and the UK recognises the European Economic Area as giving equivalent protection. If a supplier ever needs to process information outside these areas, we'll make sure UK-approved safeguards are in place first.

10. How long we keep it

We follow the NHS Records Management Code of Practice and the law on pharmacy records. The main periods are:

11. Your rights

You have the right to:

• see the information we hold about you, and get a copy
• ask us to correct anything that's wrong
• ask us to delete your information, although we often have to keep health records by law
• ask us to limit how we use your information
• object to how we use your information, where our reason is public task or legitimate interests
• ask for a copy of information you've given us in a format you can move to another provider, where our reason is a contract with you

These requests are free. We'll reply within one month, and tell you if we need longer. To make a request, contact our data protection officer using the details in section 1.

12. Wholesale customers

Push Healthcare Ltd also supplies medicines wholesale to healthcare organisations, under its MHRA wholesale dealer's licence. If you contact us about wholesale supply, we use:

• your business contact details and your organisation's details, including its registration or licence number, to reply to you and set up an account (to take steps towards a contract, and our legitimate interest in running our business)
• checks on your organisation's registration, which the law requires before we supply medicines (legal obligation)
• records of what we supply, which we must keep so medicines can be traced and recalled (legal obligation)

Wholesale enquiries go to our business email account. We keep enquiries that don't lead to an account for 1 year, and customer and supply records for at least 5 years, as the Good Distribution Practice guidelines require.

13. Complaints

If you're unhappy with how we've used your information, please complain to us first. We'll acknowledge your complaint within 30 days, look into it, keep you updated and tell you the outcome.

You can also complain to the Information Commissioner's Office (ICO), the UK's independent data protection regulator:

Last updated: 29 September 2026. We'll update this notice when anything changes.