Privacy Policy

1. Introduction

This privacy policy explains how MediHealth Direct collects, uses and protects your personal information when you use our website and services. We are committed to handling your data responsibly and in line with UK GDPR and the Data Protection Act 2018.

The data controller is MEDIHEALTH DIRECT LTD, a company registered in England & Wales (Company No. 15745634), registered office: Unit 21, Armitage Business Park, Private Road No. 3, Colwick, Nottingham NG4 2TB, a GPhC-registered pharmacy (Reg No. 9012663). For any privacy question or to exercise your rights, contact hello@medihealthdirect.com.

2. Information we collect

• Contact details such as your name, email address, phone number and delivery address.
• Health information you provide during consultations, including medical history and the treatments you request.
• Account and order information, including your consultation outcomes, prescriptions and order history.
• Technical data such as your device and usage information when you browse the site.

3. How we use your information

• To provide your care, including reviewing consultations and dispensing treatments.
• To process orders, payments and deliveries.
• To contact you about your orders, account and clinical care.
• To meet our legal and regulatory obligations as a registered pharmacy.

4. Legal basis for processing

UK GDPR requires a lawful basis for each purpose we use your data for:

• Clinical care (reviewing consultations, prescribing, dispensing and aftercare): performance of our contract with you (Article 6(1)(b)) and compliance with our legal obligations as a registered pharmacy (Article 6(1)(c)). Because this involves health data, we additionally rely on Article 9(2)(h) (provision of health care by professionals bound by confidentiality), read with Schedule 1, Part 1, paragraph 2 of the Data Protection Act 2018.
• Orders, payments and deliveries: performance of our contract with you (Article 6(1)(b)).
• Record keeping, medicines-safety reporting and regulatory duties: compliance with our legal obligations (Article 6(1)(c)), with Article 9(2)(h) for any health data involved.
• Running, securing and improving our website and preventing fraud: our legitimate interests (Article 6(1)(f)).
• Marketing messages and non-essential cookies: your consent (Article 6(1)(a)), which you can withdraw at any time.
• We do not rely on your consent to hold your clinical records: pharmacy law requires us to keep them, so they are processed under the healthcare and legal-obligation bases above. Consent is reserved for marketing and optional cookies only.

5. Sharing your information

We only share your data where necessary to provide our service, or where required by law. We never sell your personal data. The trusted service providers we work with are:

• Stripe: to process card payments securely. We never see or store your full card details.
• Royal Mail and DPD (with TrackingMore for tracking updates): to deliver your orders and let you follow your parcel.
• Resend: to send service emails such as order confirmations and sign-in links.
• Omnisend: to send marketing emails, only if you have opted in. We share your contact details and marketing preferences, never your health information.
• Twilio: to send text message reminders and updates to your phone.
• Whereby: to host secure video consultations with our clinical team.
• Yoti: to verify your identity where treatment requires it.
• Trustpilot: to invite you to review your experience after an order. You can opt out at any time.
• Google (Tag Manager and Analytics) and Meta: to understand how the site is used and measure our advertising. These tools only run if you consent to analytics or marketing cookies, and they never receive your health information.
• Replit: the secure cloud platform that hosts our website and systems, and AI service providers that power our support assistant. Our support assistant never has access to your patient record or health information.

6. International transfers

Some of our providers process personal data outside the UK. Stripe, Twilio, Resend, Google, Meta and our hosting provider Replit are headquartered in the United States; Omnisend processes data in the European Economic Area, which UK adequacy regulations cover.

Whenever data leaves the UK we rely on safeguards recognised by UK law: the UK Extension to the EU-US Data Privacy Framework for certified US providers, or the UK International Data Transfer Agreement / Addendum (standard contractual clauses) built into our contracts with them. You can contact us for more detail on the safeguard used for any specific provider.

7. Cookies and tracking

We use cookies and similar browser storage in three groups: strictly necessary (always on, for example the cookie that keeps you signed in), analytics (only with your consent, to understand how the site is used), and marketing (only with your consent, to measure our campaigns). Nothing non-essential runs before you choose, and you can change your choice at any time via the Cookie Preferences link in the footer.

A full list of every cookie and storage item, including who sets it, what it does and how long it lasts, is published on our Cookie Policy page at www.medihealthdirect.com/cookies.

8. How long we keep your data

We keep different records for different periods, in line with our legal and professional obligations as a pharmacy:

• Clinical and dispensing records (consultations, prescriptions, medicine orders): 8 years from your last treatment, in line with NHS and Royal Pharmaceutical Society records-management guidance. Prescription registers are kept for at least the 2 years the Human Medicines Regulations 2012 require.
• Financial and payment records: 6 years plus the current year, as required by HMRC.
• Marketing preferences and contact details used for marketing: until you opt out or your account is deleted.
• Support enquiries: up to 2 years after resolution; complaint records: 6 years.
• After the applicable period, your data is securely deleted or anonymised.

9. Your rights

• Access a copy of the personal data we hold about you.
• Receive your data in a structured, machine-readable format (data portability): signed-in patients can download this from their account at any time.
• Request correction of inaccurate or incomplete data.
• Request erasure of your data where there is no legal reason for us to keep it.
• Object to or restrict certain processing, and withdraw consent at any time.

10. Managing your data

Signed-in patients can export their data and submit access or erasure requests from the Profile & privacy section of their account. You can also email us to exercise any of your rights.

11. Contact us

If you have any questions about this policy or how we handle your data, contact us at hello@medihealthdirect.com. You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, or telephone 0303 123 1113.