Privacy Notice | Caremacy

This privacy notice explains how Caremacy collects, uses, and protects your personal information when you use our online pharmacy service.

We know privacy notices can be long and complicated. We've tried to make this one as clear as possible. If you have any questions, please contact us.

1. Who we are

Caremacy is an online pharmacy registered in the United Kingdom. We provide prescription treatments for non-urgent health conditions through an online consultation service.

For the purposes of UK data protection law, Caremacy Ltd is the "data controller" of personal information processed through this website.

Caremacy Ltd is registered with the Information Commissioner's Office (ICO) as a data controller. ICO registration number: ZC108875. You can check it on the ICO register of fee payers.

2. What we do

We provide online consultations for certain health conditions, including weight management, hair loss and erectile dysfunction. If appropriate, a UK-registered prescriber reviews your information and may issue a prescription. We then dispense and deliver your medication.

Because we provide healthcare, we handle sensitive health information. This is known as "special category data" under UK GDPR, and it is treated with extra care.

3. The data we collect about you

We collect and process the following types of personal information:

Identity and contact information

Name, date of birth, address, email, phone number

Health information (special category data)

Medical history and current conditions
Current medications and allergies
Your answers to our consultation questions
Prescriptions issued to you
Clinical notes made by our prescribers

Identity verification data

Photograph of your ID document
Selfie for liveness check
Verification status and outcome

Payment information

We do not store your full card details
We receive payment tokens and transaction references from our payment providers

Technical and usage data

How you use our website
Device and browser information
IP address
If you separately consent to advertising attribution: campaign source, medium and campaign parameters, referring website host and advertising click identifiers

4. How we use your data

For clinical care

We use your health information to:

Assess your suitability for treatment
Support an individual review of your treatment request
Create and manage your prescriptions
Send letters to your GP when appropriate

We do not use consultation answers, conditions, medicines, prescriptions or other clinical details to target advertising, and we do not send them to advertising platforms. Optional attribution creates a limited internal link between a campaign and use of our healthcare service. That link may itself reveal health information, so we use it only with your explicit consent as described below.

For payments and order fulfilment

We use your contact and payment information to:

Process payments for your orders
Arrange delivery of your medication
Show updates about your order status in your account

For identity verification and fraud prevention

We verify your identity to:

Show the verification outcome and required next steps
Help protect the account from misuse
Meet our regulatory obligations

For service communications

We send you important messages about:

Your consultations and order journey
Safety information and care next steps
Changes to our service that affect you

These are not marketing messages. Where the relevant service is available, they are necessary for us to provide it safely.

For marketing (only with your consent)

If a marketing sign-up is available and you have opted in, we may send you:

Information about new treatments we offer
Health tips and educational content
Special offers

You can opt out of marketing at any time. Opting out will not affect your clinical care.

For advertising attribution (only with your separate consent)

We use optional first-party attribution to understand which campaigns lead to submitted consultations and care activity. The browser receives a random opaque identifier; any captured advertising click identifiers are encrypted at rest. We keep first-touch and last-touch campaign facts internally so we can evaluate acquisition fairly.

Linking a campaign to a consultation or care activity can reveal that a person used a healthcare service even when no condition or medicine is recorded. We treat this limited internal linkage as special-category health data and rely on consent under UK GDPR Article 6(1)(a) and explicit consent under Article 9(2)(a).

This consent is independent from analytics and direct-marketing consent. We exclude consultation, patient, staff and authentication routes from browser capture. We never add consultation answers, conditions, medicines, prescriptions or Caremacy patient/order identifiers to advertising-platform payloads.

Google and Meta offline/lifecycle conversion exports are currently disabled pending documented policy and legal approval. Withdrawing attribution consent stops new optional attribution processing and triggers the applicable deletion or de-linking process, subject to any record that must be kept to demonstrate the consent choice; it does not affect your care.

5. Our lawful basis for using your data

Under UK GDPR, we need a lawful basis to process your personal data. The table states the bases we rely on for processing that is currently available and the bases we would rely on for prospective patient-service features if they are opened:

Purpose	Lawful basis
Providing clinical care	Performance of a contract with you, and provision of healthcare
Payment processing	Performance of a contract with you
Identity verification	Performance of a contract, and legitimate interest in preventing fraud
Sending GP letters	The basis documented for the specific communication, which may include provision of healthcare, consent or a legal obligation where one applies
Service communications	Performance of a contract, and legitimate interest in keeping you informed
Marketing	Your consent (which you can withdraw at any time)
Advertising attribution	Your separate consent (Article 6(1)(a)) and explicit consent for the resulting health-service inference (Article 9(2)(a)), which you can withdraw at any time

6. Who we share your data with

We use only the providers needed to operate the relevant feature. Before personal data is shared, the provider must pass the required assessment and the necessary data-protection terms must be in place.

Categories of recipients:

Your GP – To receive a GP letter when clinically appropriate
Hosting and infrastructure providers – To run our website and store data securely
Authentication provider – To manage your account login securely
Identity verification provider – To verify identity if that feature is enabled
Payment providers – To process payments securely if patient ordering is enabled
Email service provider – To send emails when provider-backed email is enabled
Analytics provider – PostHog (EU), only for consented, allowlisted public-page analytics where enabled
Delivery partners – To deliver medication when a treatment order is authorised

We do not currently send patient lifecycle or offline-conversion events to Google or Meta. Optional first-party campaign attribution remains inside Caremacy unless and until a separately assessed and approved export is enabled.

We do not sell your personal data to anyone.

7. How long we keep your data

We use the criteria below instead of promising unevidenced fixed periods. Records are kept only for the purpose that justified collection, any applicable legal or professional requirement, and the time needed to establish or defend legal claims. Detailed retention and deletion rules apply to each patient-service feature.

Data type	Retention period	Reason
Clinical records	Period required for the record type under applicable law and professional guidance	Continuity, patient safety, accountability and legal claims
Financial records	Period required by applicable tax, accounting and legal-claims rules	Financial accountability and legal compliance
Identity verification data	Only for as long as needed for verification, fraud prevention and legal claims	Detailed evidence and status records may have different periods
Account data	While the account is active, then for the justified closure and claims period	Account administration, security and legal claims
Consented public-page attribution records	Only while needed for the consented measurement purpose, or until withdrawal	General campaign measurement and consent accountability
Patient-linked campaign and lifecycle attribution	For the defined consent, measurement and deletion period	Explicit consent and health-data safeguards
Advertising-attribution consent evidence	For as long as required to demonstrate consent and withdrawal	Accountability and legal compliance

8. Where your data is stored

The processing location depends on the feature, provider and configured hosting region and may include the United Kingdom, the European Economic Area (EEA) and other countries. Before a restricted transfer is made, Caremacy must assess it and put an appropriate UK transfer mechanism and any required supplementary safeguards in place. You can ask for the location and safeguard used for a particular provider.

9. Your rights under UK GDPR

You have the following rights regarding your personal data:

Right of access – You can ask for a copy of the personal data we hold about you
Right to rectification – You can ask us to correct inaccurate or incomplete data
Right to erasure – You can ask us to delete your data in certain circumstances (note: we may need to keep some data for legal or clinical reasons)
Right to restriction – You can ask us to limit how we use your data
Right to data portability – You can ask for your data in a machine-readable format
Right to object – You can object to certain types of processing, including direct marketing
Right to withdraw consent – Where we rely on your consent, you can withdraw it at any time

You can change analytics and advertising-attribution choices at any time through Cookie settings in the footer. To exercise any other right, please contact us. We will respond within one month.

10. How to contact us and how to complain

If you have questions about this notice, want to exercise a data-protection right, or need the current privacy contact route, write to Caremacy Ltd at its registered office: 73 Waterloo Road, Manchester, England, M8 8BY.

Our Data Protection Officer is Younes Mekhalfia. You can contact them about how we use your personal information by email at hello@caremacy.co.uk (please mark your message "Data protection") or by post at the registered office above.

If you are not satisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO):

Website: ico.org.uk
Phone: 0303 123 1113

11. Changes to this notice

We may update this privacy notice from time to time. If we make significant changes, we will let you know by email or by posting a notice on our website.

Summary

We collect your health data to provide you with safe clinical care
Your health data is special category data and we treat it with extra care
We do not use clinical details to target advertising or send them to advertising platforms
Patient-lifecycle attribution creates a limited internal health-service link only with explicit consent; it is separate from marketing messages and never changes your care
Google and Meta patient-lifecycle conversion exports are currently disabled
We use only necessary providers with appropriate safeguards
Patient-service data is handled under feature-specific retention rules
You have rights over your data, including the right to access, correct, and delete it
If you have concerns, contact us or the ICO