Legal
Privacy policy.
What we collect, why, how long we keep it and how to ask us about it.
What we collect
When you order a prescription or book a service on this website we collect your name, phone number, email address and postcode, what you are ordering or booking, whether you want collection or delivery, and anything you write in the message box. The form also records the time it was sent and your IP address, used only to block automated submissions.
When you use the pharmacy we keep a patient medication record: your prescriptions and what was dispensed, allergies and conditions you tell us about, the services we provide (vaccinations, blood pressure readings, common ailments consultations, medicines reviews, travel consultations) and their outcomes, delivery addresses and signatures, and the NHS claim for each service. Health records are special category data and are held under the stricter rules that apply to them.
Why we use it
- To dispense, deliver and provide services safely, which includes checking interactions and allergies (contract and our professional obligations under the General Pharmaceutical Council).
- To request prescriptions from your GP and to tell your GP about services we provide, through NHS Wales systems (legal obligation and public task).
- To claim payment from NHS Wales for prescriptions and services (legal obligation).
- To text you when a prescription is ready or a delivery is on its way (contract).
- To remind you of repeat items or a vaccination you are due, which you can stop at any time (legitimate interest).
How long we keep it
Website orders and bookings that do not become a dispensing or a service are deleted after six months. Patient medication records are kept for the periods NHS Wales and the GPhC require: prescription records for two years after dispensing, controlled drug registers for two years after the last entry, service records including vaccinations for eight years, and children's records until they are twenty-five. Delivery signatures are kept for one year.
Who sees it
The pharmacists, the dispensing and counter staff, the delivery driver (name, address and what to collect a signature for), NHS Wales for claims and prescription transfers, your GP, and the NHS Wales systems that hold your summary record. The forms are delivered by email to the pharmacy; we do not use third-party form services or marketing platforms. We do not sell or share your details for marketing.
Cookies
This site sets a single session cookie to limit repeat form submissions. It contains no personal data and expires when you close the browser. The embedded map on the booking and find-us pages is served by Google and may set cookies under Google's own policy. The open-now badge runs in your browser from the published hours and sends nothing.
Your rights
You can ask for a copy of what we hold, ask us to correct or delete it within the limits of what we are required to keep, or object to how we use it. Email hello@castlepharmacy.co.uk or write to the address above. You can also complain to the Information Commissioner's Office at ico.org.uk.