Privacy notice

SW Rx (“we”, “us”) is the controller for personal data collected through this website and patient accounts. The legal entity is To be published before go-live, company number To be published before go-live, registered office To be published before go-live.

Medicines are supplied by a GPhC-registered pharmacy premises. That pharmacy is a separate or joint controller for dispensing records. See Our pharmacy and Registrations.

ICO registration: To be published before go-live. Privacy requests: the contact details on our Contact page. Data Protection Officer contact: the same contact route until a DPO is appointed.

We collect:

• Identity and contact: name, date of birth, email, phone, delivery address, and postcode.
• Account: password hash, login times, and saved prescriptions.
• Health data (special category): prescription images or PDFs, electronic prescription codes (for example Signature Rx or Clynex), medicine names, strengths, quantities, and pharmacist notes.
• Order and payment: quotes, order status, and payment status. Card details are handled by Stripe — we do not store full card numbers.
• Messages: emails and SMS we send about your quote or order.
• Technical: IP address, browser type, and strictly necessary cookies. See the Cookie policy.
• Waitlist: email and postcode if you are outside SW1–SW20.

Under UK GDPR we rely on:

• Contract (Article 6(1)(b)) — to quote, take payment, dispense, and deliver.
• Legal obligation (Article 6(1)(c)) — pharmacy record-keeping, controlled drug rules, complaints, and tax.
• Legitimate interests (Article 6(1)(f)) — site security, fraud prevention, service improvement, and contacting you about an incomplete request.
• Consent (Article 6(1)(a)) — optional marketing, waitlist updates, and any optional analytics cookies.

Health data is special category data. We process it under Article 9(2)(h) (health or social care, including pharmacy) and the Data Protection Act 2018 Schedule 1 health condition, together with your explicit consent (Article 9(2)(a)) when you submit a prescription. You can withdraw consent, but we may still keep records we are legally required to hold.

We only share what is needed:

• The dispensing pharmacy and GPhC-registered pharmacists reviewing your request.
• The courier, for name, address, and phone so they can deliver.
• Stripe, to take payment and prevent fraud.
• Resend, to send transactional email.
• Twilio, to send transactional SMS.
• Our hosting and storage providers, under written contracts.
• Regulators, police, or courts where the law requires it.

We do not sell your data. We do not use prescription images for advertising. Access to prescription files is limited to pharmacists and authorised platform administrators.

Some processors (including Stripe, Resend, and Twilio) may process data outside the UK. Where that happens we use UK-approved safeguards such as the UK Addendum to the EU Standard Contractual Clauses, or a UK adequacy decision.

• Prescription and dispensing records: at least 2 years, longer if the law or a complaint requires it. Controlled drug records follow the Misuse of Drugs Regulations.
• Account and order history: up to 7 years after your last activity, then deleted or anonymised where we can.
• Waitlist emails: until we write to you or you ask us to delete them.
• Failed or abandoned uploads that never become an order: up to 90 days.

You can ask us to:

• Access a copy of your data (subject access request).
• Correct inaccurate data.
• Erase data where we have no legal reason to keep it.
• Restrict or object to certain processing.
• Receive data you provided in a portable format.
• Withdraw consent where we rely on consent.

Contact the contact details on our Contact page. We aim to reply within one month. You can also complain to the Information Commissioner’s Office at ico.org.uk.

We use HTTPS, access-controlled storage for prescription files, hashed passwords, and staff accounts limited by role. No internet service is perfectly secure. If a breach is likely to put your rights at risk we will notify you and the ICO as required.

A Data Protection Impact Assessment should be completed before go-live because this service processes health data at scale.

This service is for people aged 18 or over. We do not knowingly create accounts for children. If you believe a child has submitted data, contact us and we will delete it unless the law requires us to keep it.

We may use automated text recognition to read a prescription image and suggest a match. A pharmacist always reviews the original document before medicines are dispensed. Price quotes for unusual or controlled items are set by a person.