PRIVACY NOTICE
Saxmundham Pharma Limited
Last Updated: July 2026
Saxmundham Pharma Limited values your privacy and is strongly committed to protecting your personal information.
The purpose of this Privacy Notice is to explain how Saxmundham Pharma Limited handles personal information about you and to outline the rights that you have under applicable data protection legislation. We respect your privacy and want to be transparent about how your personal information will be processed, stored and used when you visit our website, use our online services or otherwise engage with us as a customer, a patient, a supplier or have any other commercial contract with us.
Please read the following carefully to understand our practices regarding your personal information and how we will treat it.
This Privacy Notice, together with our terms and conditions and any additional terms of use, applies to your use of any of the services which are accessible through our website or Platform or any other website of ours.
It is important that the personal information that we hold about you is accurate and current. Please keep us informed if your personal information changes during our relationship with you.
Compliance with Data Protection Legislation
All personal information that we collect or are provided with will only be held and stored in accordance with this Privacy Notice and the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018 and any other legislation relating to the protection of personal information.
This notice covers the following areas:
· 1. Information about who we are
· 2. What information do we collect about you?
· 3. If you fail to provide personal information
· 4. Third party links
· 5. Information you provide to us
· 6. Information we receive from others
· 7. Online Account, Acuity Scheduling Booking Platform and Website
· 8. Payment information
· 9. Why do we process your personal information and what is our legal basis?
· 10. Automated decision making
· 11. Who do we share your information with and why?
· 12. Marketing
· 13. Where is your personal information processed?
· 14. What are my privacy rights?
· 15. How do we protect your personal information?
· 16. Cookies
· 17. How long do we retain your personal information?
· 18. Can this Privacy Notice change?
· 19. How can we help you further?
1. Information about who we are
We are Saxmundham Pharma Limited ("we", "us" or "our").
We are registered with the Information Commissioner's Office ("ICO").
Saxmundham Pharma Limited will be the controller of your personal data unless otherwise stated.
You may contact us at:
Postal address: 7 High Street, Saxmundham, Suffolk, IP17 1DF
Email address: info.saxmundhampharmacy@gmail.com
Telephone: 01728 602051
2. What information do we collect about you?
Personal information or personal data means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).
Personal information we may collect, use, store and transfer about you includes:
· Identity data, which includes your name, age/date of birth and gender;
· Contact data, which includes postal address including billing and delivery addresses, telephone numbers and email address;
· Special category data, also known as sensitive personal data, which includes information about your physical or mental health and health conditions;
· Transaction data, which includes purchases and/or orders made by you and your payment card or bank transfer details;
· Technical data, which includes your online browsing activities, IP address, browser type and identifiers associated with cookies;
· Profile data, which includes your account login details, username and password(s), interests, preferences, feedback and survey responses;
· Marketing and communications data, which includes your marketing preferences and correspondence with us; and
· Other publicly available personal information, including any which you have shared via a public platform.
All your personal information will be processed in accordance with this Privacy Notice and in compliance with all applicable confidentiality guidelines.
In some circumstances, we may anonymise your personal information for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.
3. If you fail to provide personal information
Where we need to collect personal information by law, legitimate interest or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract. In this case, we may have to cancel a service you have with us, but we will notify you if this is the case at the time.
4. Third party links
Our website (powered by Squarespace) and our appointment booking system (powered by Acuity Scheduling) may include links to third party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements or policies.
When you leave our website or the Acuity Scheduling booking platform, we encourage you to read the privacy policy or privacy notice of every website you visit.
5. Information you provide to us
Most of the personal information we process is provided to us directly by you for the purpose of providing you with our services. When you provide us with your personal information, it is for the following reasons:
Account and contact details:
When you create an account or make a booking, you provide us with at least your basic details including your full name, email address, phone number, date of birth, gender and marketing preferences.
Special category personal information:
Some of the information you provide whilst using our Platform may be considered special or sensitive. When you interact with us, for example when booking consultations and/or ordering prescriptions, the information provided may infer or identify information relating to your health.
Billing or bank details:
When you make a payment, you provide us or our chosen payment service provider, Stripe, with certain information which is necessary to process your payment, including your debit or credit card number, card holder name, card expiry, CVV and billing address. Your card details are processed securely by Stripe and are not stored by us.
Customer service:
You can contact our customer services team via email or telephone. We collect the information that you give to us during the interaction.
6. Information we receive from others
In addition to the information you provide us directly, we may receive information and personal information about you from third parties. We will only use this information where we have a lawful basis.
Doctors' Surgeries / Hospitals:
Surgery and/or hospital staff may provide information about you for the purposes of facilitating the services. Your surgery or hospital is the controller for any personal information that you provide to it.
Other Partners:
Any data which is obtained from third parties will be kept in accordance with this Privacy Notice, and with any additional restrictions imposed by the third party that shared your personal information with us.
7. Online Account, Acuity Scheduling Booking Platform and Website
Our website is hosted on Squarespace and has been designed to improve the online accessibility of information about our services. Appointment booking is provided through Acuity Scheduling, which enables you to book consultations and appointments from the comfort of your own home.
When you sign up to use Acuity Scheduling or our online services, we require some of your personal information, including your name and contact details.
We collect information about your activity on our Squarespace website, for instance how you use and interact with it (e.g., date and time you visited, features you have been using, searches, clicks and pages which have been shown to you).
We also use Charac internally to deliver private clinical services under Patient Group Directions (PGDs) and to process NHS prescriptions. Charac is a UK-based pharmacy platform and processes data within the UK in accordance with UK GDPR and NHS data security standards. For further information, please refer to Charac's privacy policy at charac.co.uk/privacy-policy.
Where prescription medicines (POM Products) are to be posted to you following a consultation or service, your name and delivery address will be shared with Royal Mail, our tracked delivery provider. Delivery of POM medicines is charged at £3.99 using Royal Mail 24-hour tracked service.
8. Payment information
We may process your personal information to process any payments made for the provision of services. The information may include information for identification and verification, such as your name, credit, debit or other card number, card expiration date, and CVV code.
Any payment transactions carried out by us, or our chosen third-party provider of payment processing services, Stripe, will be kept secure and encrypted at all times.
9. Why do we process your personal information and what is our legal basis?
We will only use your personal information if we have a proper reason to process it and the law allows us to do so. Most commonly, we will use your personal information in the following circumstances:
· Where you have consented before the processing.
· Where we need to perform a contract we are about to enter or have entered with you.
· Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
· Where it is necessary to protect your vital interests where you are physically or legally incapable of giving consent.
· For reasons of substantial public interest or the management of health or social care systems and services.
· Where we need to comply with a legal or regulatory obligation.
Whenever you have given us your consent to use your personal information, you have the right to change your mind at any time and withdraw that consent.
The table below sets out the ways in which we plan to use your personal information and the legal bases on which we rely:
The personal information we collect
Why we use this personal information
The lawful basis relied upon
Account and contact details; health information; billing details; name; email; address; phone number
Making our website and Platform available; creating and managing your account; tailoring our services; customer support; communicating with you; delivery services
Article 6(1)(b) and (f) UK GDPR. For health information: Article 9(2)(h) or (i) UK GDPR. For NHS services: Article 6(1)(e) and 9(2)(g) UK GDPR.
Account and contact details; customer service information
Notifying you of changes to our terms and conditions or privacy notice; asking you to leave a review or take part in a survey
Article 6(1)(b) and (f) UK GDPR. For health information: Article 9(2)(h) or (i) UK GDPR.
10. Automated Decision Making
You will be notified if we make a solely automated decision which produces a legal effect or significantly affects you. Unless otherwise agreed with you, we will not use any of your personal information for automated decision making or profiling.
11. Who do we share your information with and why?
We sometimes share your personal information with trusted third parties. The reasons we may share your information with third parties are:
· to provide you with our services;
· if we are under a legal or regulatory duty to do so;
· if it is necessary to do so to enforce our terms of use or other contractual rights;
· to lawfully assist the police or security services with the prevention and detection of crime or terrorist activity;
· where such disclosure is necessary to protect the safety or security of any persons; and/or
· otherwise as permitted under applicable law.
We may share your personal information to help us provide our services, including via our Squarespace website, the Acuity Scheduling booking platform, and Stripe for secure payment processing. We also use Charac internally for clinical services and Royal Mail for the delivery of prescription medicines. We have contracts with companies which provide us with services such as IT support, data storage, payment processing, delivery services and email automation services.
We only provide third parties with the information they need to know to perform their specific services. We work closely with all third parties to ensure that your personal data is secure and protected at all times. We do not allow our third-party service providers to use your personal data for their own purposes.
In corporate transactions:
We may transfer your personal information if we are involved, whether in whole or in part, in a merger, sale, acquisition, divestiture, restructuring, reorganization, dissolution, bankruptcy or other change of ownership or control.
When required by law:
We may disclose your personal information if reasonably necessary: (i) to comply with a legal process, such as a court order, government or law enforcement investigation or other legal requirements; (ii) to assist in the prevention or detection of crime; or (iii) to protect the safety of any person.
To enforce legal rights:
We may also share information: (i) if disclosure would mitigate our liability in an actual or threatened lawsuit; (ii) as necessary to protect our legal rights and legal rights of our users, business partners or other interested parties; (iii) to enforce our agreements with you; and (iv) to investigate, prevent, or take other action regarding illegal activity, suspected fraud or other wrongdoing.
12. Marketing
We strive to provide you with choices regarding certain personal information uses, particularly around marketing and advertising. If you have given your consent to receive marketing emails, you can withdraw this at any time.
If you have received a direct marketing email from us and no longer wish to receive these, the easiest way to let us know is to click on the unsubscribe link at the bottom of our marketing emails.
13. Where is your personal information processed?
Sometimes, we will need to share your personal information with third parties and suppliers outside the UK, such as Europe and the USA. Our website platform, Squarespace Inc., our booking platform, Acuity Scheduling (Squarespace Inc.), and our payment processor, Stripe Inc., are based in the United States. Charac and Royal Mail process data within the UK.
In the event we need to transfer your personal information outside the UK, we will ensure we have in place adequate safeguards to do so. Our safeguards ensure that your personal information receives the same protection as if it were being processed inside the UK.
Any transfer of your personal information will follow applicable laws and we will follow the guiding principles of this Privacy Notice.
14. What are my privacy rights?
You are also able to exercise your rights over the personal information which we process which include:
The right to be informed.
We aim to be transparent within our Privacy Notice and provide you with information about how we use your personal information.
Right of access.
You have the right to request a copy of any information that we hold about you. You can find out if we hold any personal information by making a subject access request.
The right to rectification.
You have the right to request the correction of your personal data when it is incorrect, out of date or incomplete.
The right to erasure.
You can request the erasure of your personal data when it is no longer necessary, you withdraw consent, or you object to its processing. Some information held by us is required by law to be held for a period of time.
The right to restrict data.
You can request that we restrict the processing of your personal data in circumstances where we need to verify the accuracy of personal data or where you object to the processing.
The right to data portability.
Under some circumstances, you can request a copy of the personal data you provided to us in a machine-readable format or ask that this data be transferred to another third party.
The right to object.
In some circumstances, you can stop the processing of your personal data for reasons connected to your individual situation. Where your details are used for marketing, you can opt out at any time.
The right not to be subject to automated decision making and profiling.
You have the right to not be subject to solely automatic decisions in relation to your treatments, care or other processes that have a legal or similarly significant effect on you.
You will not have to pay a fee to exercise any of the rights listed above. However, we may charge a reasonable fee if your request is clearly unfounded or excessive. We try to respond to all legitimate requests within one month.
15. How do we protect your personal information?
We have implemented, and will maintain current, reasonable physical, technical, and organisational security measures to protect your personal information from loss, misuse, and unauthorised access, disclosure, alteration, or destruction.
We use encryption to add an extra layer of protection to your data while it is stored on our Platform and for personal information which is transmitted via our Platform.
Where we have given you (or where you have chosen) a password which enables you to access certain parts of our service, you are responsible for keeping this password confidential. We ask you not to share a password with anyone.
Unfortunately, the transmission of information via the internet is not completely secure. Although we have security measures in place, we cannot guarantee the security of your data transmitted to our sites; any transmission is at your own risk.
16. Cookies
We use and may allow others to use cookies and similar technologies (e.g. web beacons, pixels) to recognise you and/or your device(s).
Some of these cookies are essential to our service, for example they ensure that our Squarespace website loads properly, they remember your cookie preferences, enable you to use payment functionalities via Stripe, and enable our administrative users to log in. Others are of an analytical nature allowing us to better understand how you use our website and Platform.
You can find more information about the individual cookies we use and the purposes for which we use them in our Cookie Notice [LINK].
17. How long do we retain your personal information?
We retain patient and clinical records for a minimum of 8 years from last contact in accordance with NHS guidance (or until a child's 26th birthday). Financial and transaction records are kept for 6 years in accordance with HMRC requirements. Booking and appointment records are kept for 3 years. Website analytics data is retained for up to 2 years. Marketing data is held until you withdraw your consent or object to processing.
18. Can this Privacy Notice change?
This Privacy Notice may be amended from time to time. We will post any changes we may make on this page and, where appropriate, notify you via email.
19. How can we help you further?
If you have any questions or comments, please contact us by telephone on 01728 602051 during opening hours or by email at info.saxmundhampharmacy@gmail.com.
For further information on data protection, please visit the Information Commissioner's Office (ICO) website at www.ico.org.uk.
Please note: before contacting the ICO, we would kindly ask that you contact us first so that we have the opportunity to address your concerns directly. We are committed to resolving any issues promptly and will do our best to assist you. You can reach us by telephone on 01728 602051 during opening hours. We hope to be able to resolve your concern without the need to escalate to the ICO.
The ICO regulates data protection. If you feel that your information has not been handled correctly, or you are unhappy with our response to any requests you have made to us regarding the use of your personal information, you have the right to lodge a complaint with the ICO.
You can contact them by calling 0303 123 1113 or visit the website at www.ico.org.uk.