Privacy policy

MediCare Pharmacy Group Privacy Policy

Version: 3.0
Effective Date: July 2026
Review Date: July 2027
Document Owner: Data Protection Officer

1. Introduction

A&FA Dundee Ltd trading as MediCare Pharmacy Group ("MediCare", "we", "our" or "us") is committed to protecting your privacy and ensuring that your personal information is handled securely, fairly and transparently.

Our pharmacists and pharmacy teams are an integral part of your local healthcare network and provide HSC and private healthcare services across Northern Ireland.

To provide safe, effective and high-quality care, we need to collect, use and securely manage information about you. We understand the importance of protecting your personal information and maintaining your trust.

This Privacy Policy explains:

  • what information we collect;
  • why we collect it;
  • how we use it;
  • who we share it with;
  • how we protect it; and
  • the rights you have regarding your personal information.

This Privacy Policy applies to all services provided by MediCare Pharmacy Group, including:

  • Community pharmacy services
  • HSC commissioned services
  • Private healthcare services
  • Vaccination services
  • Travel health services
  • Independent prescribing services
  • Weight management services
  • Online services
  • Our website
  • Centralised dispensing services
  • Home delivery services
  • Online payments and subscriptions

2. Who We Are

The Data Controller responsible for your personal information is:

A&FA Dundee Ltd trading as MediCare Pharmacy Group

MediCare House

44 Montgomery Road

Belfast

BT6 9HL

Telephone:
02890 708800

Website:
www.medicare-group.com

3. Data Protection Officer

Our Data Protection Officer is:

Dr Gareth C. Gilvary

Telephone:
02890 708800

Postal Address:

MediCare House

44 Montgomery Road

Belfast

BT6 9HL

If you have any questions regarding this Privacy Policy or wish to exercise your data protection rights, please contact our Data Protection Officer.

4. The Laws We Follow

MediCare processes your personal information in accordance with:

  • UK General Data Protection Regulation (UK GDPR)
  • Data Protection Act 2018
  • Human Rights Act 1998
  • Common Law Duty of Confidentiality
  • Privacy and Electronic Communications Regulations (PECR)
  • Applicable Health and Social Care legislation
  • Professional Standards issued by the Pharmaceutical Society of Northern Ireland (PSNI)
  • Relevant guidance issued by the Information Commissioner's Office (ICO)

5. Information We Collect

Depending on the services you receive, we may collect:

Personal Information

  • Name
  • Address
  • Date of birth
  • Telephone number
  • Email address
  • Emergency contact details

Healthcare Information

Including:

  • Prescriptions
  • Medication history
  • Allergies
  • Medical conditions
  • Consultation records
  • Clinical notes
  • Vaccination history
  • Independent prescribing records
  • Travel clinic records
  • Weight management records
  • Monitored Dosage System (MDS) records
  • Referral information
  • GP information
  • H&C Number where applicable

This information is classified as Special Category Data under UK GDPR.

Financial Information

Where appropriate we may collect:

  • Payment card information
  • Direct Debit details
  • Bank account details
  • Online payment details
  • Refund information
  • Payment history

Payments are processed securely using approved payment providers. MediCare does not store full payment card details.

Website Information

When you visit our website, we may collect:

  • IP address
  • Browser information
  • Device information
  • Operating system
  • Website usage
  • Cookies
  • Pages viewed
  • Referring websites

CCTV

Our pharmacies may operate CCTV systems for:

  • Crime prevention
  • Public safety
  • Staff safety
  • Investigation of incidents
  • Protection of company assets

6. How We Collect Information

We collect information from:

  • You directly
  • Your GP
  • Hospitals
  • Other healthcare professionals
  • Health and Social Care organisations
  • HSC systems
  • Prescriptions
  • Consultations
  • Our website
  • Our pharmacy app
  • Telephone conversations
  • Email correspondence
  • Online forms
  • Payment providers
  • Cookies and website analytics

7. Why We Process Your Information

We process personal information to:

  • Dispense medicines safely
  • Supply healthcare products
  • Deliver HSC commissioned services
  • Deliver private healthcare services
  • Provide travel health services
  • Deliver vaccination programmes
  • Provide independent prescribing services
  • Prepare Monitored Dosage Systems
  • Manage repeat prescriptions
  • Process online orders
  • Deliver medicines
  • Manage payment plans and Direct Debits
  • Prevent fraud
  • Improve patient safety
  • Investigate complaints
  • Meet legal and professional obligations
  • Undertake clinical audit
  • Improve our services
  • Maintain business continuity
  • Protect public health

8. Lawful Basis for Processing

We process personal information under one or more of the following lawful bases:

  • Performance of a contract
  • Compliance with a legal obligation
  • Public task
  • Legitimate interests
  • Consent (where required)

Healthcare information is processed under Article 9(2)(h) UK GDPR for the provision of health or social care.

9. Centralised Dispensing

To improve patient safety, dispensing accuracy and operational efficiency, MediCare operates centralised dispensing services.

Prescription information may be securely transferred between MediCare pharmacies and our central dispensing facilities.

Medicines may be assembled, labelled or prepared within these facilities before being securely transported to your nominated MediCare pharmacy for final professional checks and supply.

Monitored Dosage Systems (MDS) may also be prepared using automated dispensing technology within our central dispensing service.

All processing is carried out by appropriately trained pharmacy professionals under the supervision of a Responsible Pharmacist and in accordance with all applicable legislation and professional standards.

10. Automated Technology and Artificial Intelligence

MediCare continually invests in technology to improve patient safety, service quality and operational efficiency.

This may include:

  • automated dispensing systems;
  • dispensing workflow software;
  • barcode verification;
  • robotic dispensing technology;
  • inventory automation;
  • electronic prescription processing;
  • clinical decision support tools;
  • artificial intelligence tools used to support administrative, operational or analytical activities.

Artificial intelligence and automated technologies are used to assist our pharmacy teams and improve the quality and efficiency of our services.

These technologies do not replace the professional judgement of a pharmacist or other healthcare professional.

MediCare does not make decisions about your healthcare based solely on automated decision-making where those decisions would have legal or similarly significant effects on you.

11. Communications

We may contact you regarding:

Your healthcare (no consent required)

Including:

  • prescription readiness;
  • medication reminders;
  • appointment reminders;
  • follow-up care;
  • healthcare advice;
  • service eligibility.

These communications form part of your ongoing healthcare.

Where required by law, we will seek your consent before sending promotional or marketing communications regarding products or services.

You may withdraw your marketing consent at any time.

12. Website Cookies and Analytics

Our website uses cookies and similar technologies to:

  • improve website performance;
  • understand website usage;
  • enhance user experience;
  • measure website traffic.

We also use website analytics services, such as Google Analytics, to understand how visitors use our website.

Further information is available within our Cookie Policy.

13. Sharing Your Information

We may share your information where necessary with:

  • your GP;
  • hospitals;
  • Health and Social Care organisations;
  • Business Services Organisation (BSO);
  • Pharmaceutical Society of Northern Ireland;
  • trusted IT providers;
  • payment service providers;
  • pharmacy system providers;
  • secure delivery providers;
  • professional advisers;
  • regulators;
  • law enforcement agencies where legally required.

Information is only shared where there is a lawful basis to do so and appropriate safeguards are in place.

We do not sell your personal information.

14. International Transfers

Some of our trusted service providers may process information outside the United Kingdom.

Where this occurs, appropriate safeguards, including Standard Contractual Clauses or adequacy decisions, are implemented to ensure your information remains protected.

15. Information Security

MediCare has implemented appropriate technical and organisational measures to protect your information.

These include:

  • encryption;
  • secure networks;
  • role-based access controls;
  • password protection;
  • multi-factor authentication where appropriate;
  • audit logging;
  • cyber security monitoring;
  • staff confidentiality agreements;
  • mandatory information governance training.

16. Data Retention

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected and to comply with legal, regulatory and professional requirements.

Healthcare records are retained in accordance with the NHS Records Management Code of Practice (or equivalent Health and Social Care guidance in Northern Ireland), together with any statutory or professional requirements applicable to pharmacy records.

Financial records are generally retained for a minimum of six years in accordance with legal and tax requirements.

17. Your Rights

You have the right to:

  • request access to your personal information;
  • request correction of inaccurate information;
  • request erasure where applicable;
  • request restriction of processing;
  • object to processing;
  • request data portability where applicable;
  • withdraw consent where processing is based upon consent.

Requests should be directed to our Data Protection Officer.

18. Complaints

If you are unhappy with how we have handled your personal information, please contact our Data Protection Officer in the first instance.

You also have the right to lodge a complaint with:

Information Commissioner's Office

3rd Floor

14 Cromac Place

Belfast

BT7 2JB

Website: https://ico.org.uk

19. Policy Review

This Privacy Policy is reviewed annually or sooner where there are changes in legislation, guidance, technology or MediCare services.