Data protection policy.

Last updated: 27 October 2026

Who is responsible for your information

SAMPLUS LIMITED, trading as Hollytree Pharmacy, decides how and why your personal information is used, which makes us the data controller under UK data protection law. Within the pharmacy, our Superintendent Pharmacist is accountable for how information is handled and is the person to contact with any question about it.

Confidentiality is part of every pharmacist’s professional duty. This policy explains how we meet that duty and the law.

The information we hold

We only collect what we need to look after you and run the pharmacy. Depending on how you use us, that can include:

• Who you are and how to reach you — your name, date of birth, address, phone number and email, and your NHS number where an NHS service needs it.
• Your health and care — prescriptions and the medicines we supply, allergies, notes from consultations, vaccinations you’ve had with us, and information you give when a pharmacist checks whether a medicine or service is right for you.
• Orders — what you’ve bought from our online shop, where it was delivered and whether payment went through. Your card number goes straight to our payment provider; we never see or store it.
• Messages — what you tell us through our contact form, by email, by phone or in a job application.
• Website data — limited technical information such as your IP address and browser type, which our systems record to keep the site secure and working. Our cookie policy explains what’s stored in your browser.

Why we use it, and the legal grounds

Data protection law only lets us use personal information when we have a lawful reason. Health information counts as “special category” data, so it needs an extra condition as well. Our reasons are:

• Giving you care — dispensing prescriptions and providing NHS and private services. For NHS work we rely on carrying out a task in the public interest (UK GDPR Article 6(1)(e)); for private services, on our agreement with you (Article 6(1)(b)). The health-care condition (Article 9(2)(h)) covers the clinical information involved.
• Selling and delivering shop orders — performing our contract with you (Article 6(1)(b)).
• Meeting legal and professional duties — for example keeping the pharmacy records that medicines law, our regulator and our NHS contract require (Article 6(1)(c)).
• Protecting public health and safety — such as reporting a suspected side effect to the medicines regulator, or acting on a safeguarding concern (Articles 6(1)(e) and 9(2)(i)).
• Answering your enquiries and job applications — our legitimate interest in responding to you (Article 6(1)(f)).
• Marketing — only if you have opted in, and you can opt out at any time (Article 6(1)(a)).

Some medicines can be misused or become habit-forming. Where repeated requests raise a concern, a pharmacist may contact you before supplying again — this is a safety check, not a judgement.

Who can see your information

Inside the pharmacy, staff see only what they need for their role. Outside it, we share information only when it’s needed and only as much as is needed:

• NHS organisations that commission and pay for NHS services, such as NHS England, the NHS Business Services Authority and the local Integrated Care Board.
• Your GP and other professionals directly involved in your care, for example to tell your surgery about a vaccination or a Pharmacy First consultation.
• The Medicines and Healthcare products Regulatory Agency, if we report a suspected side effect through the Yellow Card scheme.
• Companies that run systems for us, under contracts that only allow them to act on our instructions. These include our technology partner, App & Tap, which provides online booking, prescription ordering, patient accounts and the online shop (see their privacy policy), our payment provider, and our website and email hosting.
• Our delivery service, which receives only the name, address and phone number needed to get an order to you.
• Others where the law requires it, such as the police or a court with the proper authority.

We do not sell personal information and we never share it with advertisers.

How long we keep it

We keep information for as long as we need it and then dispose of it securely. Clinical and prescription records are kept for the periods set out in the NHS records management code of practice and the medicines regulations, which can be longer for children. Shop orders and other financial records are kept for six years for tax purposes. Website enquiries are deleted once they’ve been dealt with, unless they become part of your care record.

Keeping it safe

• Electronic records are held in password-protected systems, and access is limited to staff who need it.
• Information sent through our website is encrypted in transit.
• Paper records stay in the dispensary, away from public areas, and are shredded when no longer needed.
• Everyone who works here is bound by confidentiality and trained in data protection.

If a security incident puts your information at risk, we will report it to the Information Commissioner’s Office within 72 hours where required, and contact you directly if the risk to you is high.

Your rights

You can ask us to:

• give you a copy of the information we hold about you (usually free of charge and within one month);
• correct anything that’s wrong or incomplete;
• delete information, where we have no legal reason to keep it — medical records usually have to be kept;
• limit how we use your information, or object to a particular use;
• transfer information you gave us electronically to another organisation;
• stop using your information for anything you consented to, such as marketing.

To protect you, we may ask for proof of identity before acting on a request. We don’t make decisions about you by purely automated means.

Questions and complaints

To ask about your information or use any of your rights, contact the Superintendent Pharmacist by email at contact@hollytreepharmacy.co.uk, by phone on 020 8300 6857, or in writing to Hollytree Pharmacy, 2-3 Hollytree Parade, Sidcup Hill, Footscray, Sidcup, DA14 6JR.

If you’re not happy with our answer, you can complain to the Information Commissioner’s Office on 0303 123 1113 or at ico.org.uk. We’d be grateful for the chance to sort things out with you first.

Related: privacy policy · cookie policy · complaints policy.