Privacy Policy

RXLiveClinic ("we", "us") is committed to protecting your privacy and respecting your data protection rights. This Privacy Policy explains how we collect, use, disclose and safeguard your personal data when you visit our website, use our mobile app, or use our online consultation and prescription services (together, our "services").

We are a General Pharmaceutical Council (GPhC) registered pharmacy (No. 9010611) providing telemedicine and remote prescribing. Because we provide healthcare services, we process special category health data and we hold ourselves to the high standards set out in UK data protection law.

This policy applies to all users of our services, whether or not you register an account or place an order. Please read it carefully. By using our services, you acknowledge that your personal data will be processed as described in this policy.

The data controller responsible for your personal data is RXLive Ltd (trading as RXLiveClinic), the operator of RXLive Pharmacy (GPhC Registered Pharmacy No. 9010611). We decide how and why your personal data is processed.

Our registered office address and company registration number are available on request from support@rxlive.co.uk and will be confirmed at the point of any contract. We are registered with the Information Commissioner's Office (ICO).

If you interact with us through the wider RXLive group of companies, we may share relevant personal data within the group as described in this policy, but RXLiveClinic remains the controller for the personal data you provide through our services.

Information you provide to us:

• Identity and contact data — name, address, email, date of birth and telephone number when you register or contact us.
• Health data (special category) — information you provide during a consultation, including your medical history, current conditions, medications, allergies, BMI, weight, and any photographs you upload (such as body composition or identity photos) for clinical assessment.
• Identity verification data — a photograph of an identity document to verify you are who you say you are before we prescribe.
• Order and billing data — delivery address, treatment selected, dose, order number and payment information (card details are handled by our payment provider; we do not store full card numbers).
• Communications data — messages you send us, including messages to our clinical team within your patient portal.
• Marketing preferences — your choices about receiving marketing from us.

Information collected automatically: When you visit our site or app we collect technical data using cookies and similar technologies, including your IP address, browser type, device, pages viewed and how you navigated the site. See our Cookie Policy.

Information from other sources: If you sign in using a third party (for example your Google account), we receive the information you authorise that provider to share. We may also receive information from payment providers and delivery partners to fulfil your order.

We use your personal data for the following purposes:

• To register and secure your patient account, and to verify your identity.
• To assess your suitability for treatment through our online consultation, and to enable our pharmacist independent prescribers to make a safe prescribing decision.
• To create and maintain your patient record, and, where clinically appropriate and lawfully permitted, to contact your GP or access relevant information about your care.
• To dispense and deliver any prescribed medication or product you order.
• To communicate with you about your order, including clinical queries, delivery updates and payment confirmations.
• To carry out clinical follow-up and safety monitoring (for example weight-loss follow-up questionnaires) and, where appropriate, to generate MHRA Yellow Card reports of suspected side effects.
• To respond to your questions, requests, feedback and complaints.
• To send you service messages (transactional emails) such as order confirmations and status updates.
• Where you have consented, to send you marketing about products and services that may interest you.
• To improve our services, conduct market research and analyse how people use our site, and to train and improve our systems, anonymising data wherever possible.
• To keep our services safe and secure, to prevent fraud, and to comply with our legal and regulatory obligations (including GPhC, MHRA and HMRC).

We rely on the following lawful bases under the UK GDPR:

• Contract — to provide the services you have requested, including your consultation and any order.
• Legal obligation — where we are required to keep records or report information (for example pharmacy records and suspected adverse drug reactions).
• Vital interests — to protect your vital health interests where necessary, for example in a safeguarding situation.
• Public interest in the area of health — for the provision of healthcare and treatment by or under the responsibility of a health professional, which is our lawful basis for processing your special category health data.
• Consent — for marketing communications and for non-essential cookies. You can withdraw consent at any time.
• Legitimate interests — for improving our services, security and fraud prevention, where these are not overridden by your rights.

For special category health data, we process it under the UK GDPR condition for the provision of health or social care or treatment, and we comply with our confidentiality duties as a GPhC-registered pharmacy.

We may share your personal data with:

• Our clinical team and pharmacy staff — to assess, prescribe and dispense your treatment.
• Payment providers — to process your payment securely (we do not receive or store your full card details).
• Delivery and fulfilment partners — to deliver your order, sharing only the information necessary (name and delivery address).
• Identity verification and analytics providers — to verify you and to operate our services.
• Your GP or NHS services — where clinically appropriate and permitted by law, to support safe prescribing and continuity of care.
• Regulators and law enforcement — where we are legally required to do so, including the GPhC, MHRA, ICO, HMRC and police.
• The wider RXLive group — on a need-to-know basis to operate shared services, where permitted.

We do not sell your personal data. We require all third parties to protect your data and to process it only for the purposes we specify.

Your clinical patient records are held on RXWEB, our secure group clinical records platform, which is operated and processed within the UK and the EU. Patient records are not stored or processed outside the region.

Our website and app run on our technology platform provider's infrastructure, which is ISO 27001-certified and SOC 2 Type II-audited. Where this or any other service provider processes personal data outside the UK (for example cloud hosting or analytics), we will only transfer your personal data where appropriate safeguards are in place, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or where the transfer benefits from a recognised adequacy decision.

We keep your personal data only for as long as necessary to provide our services and to meet our legal and regulatory obligations. As a registered pharmacy we are required to retain patient medication records for a minimum period set out in medicines and pharmacy legislation (generally a minimum of five years from the last entry, and longer for certain records). We retain health records and clinical information in line with NHS record-keeping standards where applicable.

For marketing data, we keep your preferences until you ask us to stop. We keep non-essential cookie data only for as long as described in our Cookie Policy.

We use appropriate technical and organisational measures to protect your personal data, including encryption in transit, access controls limited to authorised staff, and secure storage. Our clinical systems are restricted to the health professionals and staff who need access to provide your care.

We use RXWEB, our secure group clinical records platform, to hold the patient information we collect. RXWEB is operated within the RXLive group as our processor: it holds and processes your clinical data only on our documented instructions, within the UK and the EU. Our website and app themselves run on ISO 27001-certified, SOC 2 Type II-audited platform infrastructure.

No system can be guaranteed completely secure. In the unlikely event of a personal data breach affecting your rights and freedoms, we will notify you and the ICO where we are legally required to do so.

Under the UK GDPR and the Data Protection Act 2018 you have the right to:

• Be informed about how we use your data (this policy).
• Access your personal data and obtain a copy.
• Rectify inaccurate or incomplete data.
• Erase your personal data in certain circumstances ("right to be forgotten"), subject to our legal obligations to retain pharmacy records.
• Restrict or object to processing, including objecting to direct marketing.
• Data portability — to receive certain data in a structured, machine-readable format.
• Withdraw consent at any time where we rely on it (for example for marketing).
• Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects.

Health data is exempt from some of these rights where processing is necessary for preventive or occupational medicine, medical diagnosis, the provision of health or social care or treatment, or the management of health or social care systems. To exercise any right, email support@rxlive.co.uk.

We use cookies and similar technologies to operate and improve our services. Details of the cookies we use and how to control them are set out in our Cookie Policy.

We will only send you marketing where you have consented or where we rely on the soft opt-in for existing customers in line with the Privacy and Electronic Communications Regulations (PECR). You can opt out at any time by following the unsubscribe link in any email or by contacting us, and we will stop sending marketing promptly.

Our services are not intended for children. We do not knowingly collect personal data from anyone under 18. Our prescribing services are available only to adults; certain treatments have additional age restrictions assessed during consultation. If you believe we have collected data from a child, please contact us and we will delete it.

We may update this Privacy Policy from time to time to reflect changes in our services, technology, legal requirements or regulatory guidance. We will indicate the "last updated" date at the top. We encourage you to review this policy periodically.

If you have any questions about this policy or how we handle your personal data, or to exercise your rights, contact our team at support@rxlive.co.uk or call 0800 123 4567.

If you are not satisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.