Privacy Policy

For the purposes of this Privacy Policy; “Website” means the website at www.crescentchemist.co.uk, “We/Our/Us” means Crescent Pharmacy, “You/Your” means any user of the Website. This policy explains how Crescent Pharmacy uses your personal data, whether you’re shopping on our website, using our online Prescription Services or any other application on this website. The purpose is to tell you how we process your “Personal Data” (ie data about any identified or identifiable living person). In particular: a) what Personal Data we collect; b) how we use it; c) how we protect it; d) to whom we disclose it; e) how you can access and rectify it. 1.2 If you have any queries concerning this policy, please contact us by using the details on our website. We may change this policy at any time. Please check it carefully whenever you visit this site.

Crescent Pharmacy is the trading name of Shivam Pharmacy Ltd, a UK company registered in the General Pharmaceutical Council (GPhC), with GPhC Number: 1101111 and with registered address at 2 Fleming Crescent, Sele Farm, Hertford, SG14 2DJ. European Data Protection Law changed on 25 May 2018. Like all organisations that use your personal information, Crescent Pharmacy has to provide more information about the purposes for which we use your personal data, the rights you have over it and what that means in practice. So we’ve taken this opportunity to update our Privacy Policy. Don’t worry – the way we use your data hasn’t changed, and we still give it the same level of care and protection. We hope we’ve explained it clearly and simply, but if you want to find out in more details about the new data protection regulation, please visit the Information Commissioners Office (ICO) website (UK’s independent body set up to uphold information rights).

Crescent Pharmacy is committed to protecting your privacy. We believe in using your personal information to make things simpler and better for you. We’ll always keep your personal information safe and will never sell it to third parties. We’ll be clear and open with you about why we collect your personal information and how we use it. Where you have choices or rights, we’ll explain them to you and respect your wishes. We’ve written this Privacy Policy in plain English and without legalese to tell you how and why we use your personal information. We hope you’ll find it clear and simple but if you have any concerns or questions please feel welcome to contact us.

You are. We never lose sight of the fact that it is your personal information and we will only send you marketing material if you have agreed that we can do so.

Information we get from you Crescent Pharmacy collects personal information about you whenever you shop with us online or in-store, and when you use our services. Please see below for examples of the data we collect from you: From the website at www.crescentchemist.co.uk: Name, address, contact details, browsing history (including any adverts you may click on) purchases, and Information about any devices you may use to access our services. From our Pharmacy Services: Your contact details and prescription information. Information we collect online: Cookies A ‘cookie’ is a file in your web browser that enables us to recognise your computer when you visit www.crescentchemist.co.uk and makes using our site quicker and easier (e.g. login fields may be pre-filled with your email address). Cookies are also essential to the functioning of certain parts of the site and we use them to collect information about how the site is used, such as how many people visit and return and what products are being viewed. The information collected in this way is anonymous and doesn’t contain any information that identifies you personally.

The www.crescentchemist.co.uk website uses Cookies in the following ways: Making our website work: These Cookies are essential so that you can move around the site and log in to the secure areas. Without them, you’d be unable to shop on the website or access your account. Monitoring and improving the performance of the website: These Cookies collect information about how visitors use the www.crescentchemist.co.uk website, e.g. which pages they visit most often and whether they see error messages. The information is aggregated so it doesn’t identify individuals; we use this information only to help us improve the way the website works. Enabling the features of the website: These Cookies allow our website to remember choices you have made, such as your user name or the region you’re in, and help us provide you with a better and more personal experience. For example, they may allow you to watch a video clip, comment on a blog or add a product review. Personalising your experience: These cookies enable us to give you a more personalised experience when you visit our site, by recognising you and remembering any preferences or choices you’ve made on previous visits to the site. We may link these cookies to other information we hold about you and use this to provide you with more relevant content and offers. The cookies also enable us to provide you with more personalised content and offers through our other communication channels. These include our Pharmacy Shop, post, email, website, social, and online media. Marketing and advertising: These Cookies are used to deliver adverts that are more relevant to you as well as to limit the number of times you see a particular advertisement and to measure the effectiveness of advertising campaigns. The Cookies remember that you have visited a website and this information may then be shared with other organisations for advertising purposes. They’re also used to enable price-comparison sites to work and to improve website performance. In order to link your online activity with your in-store purchases, we may match customer information tied to our in-store transaction data, with data collected online: for example, by matching an email address. Examples of the companies with whom we undertake this type of analysis include Google and Facebook. The information collected is used to improve the effectiveness of our advertising activity and to personalise the content and messages that we send to you. What are ‘Flash Cookies’ (or ‘local shared objects’)? www.crescentchemist.co.uk may use Adobe Flash Player to deliver video content and interactive product images. Flash Cookies are stored on your device in a similar way to other types of Cookies but they’re managed differently by your browser. If you wish to disable or delete Flash Cookies, you can do this through Adobe Flash Player security settings. Please note that you may then be unable to view certain types of information and content on the www.crescentchemist.co.uk website.

As you will have seen in ‘How We Use Cookies’ above, some parts of our site need Cookies in order to function correctly. By default, Cookies should be enabled on your computer or device, and although you can ‘disable’ them in your browser, this will affect your experience on www.crescentchemist.co.uk. You’ll be limited to browsing, viewing and searching for products but won’t be able to make a purchase and you may experience technical problems with some other features on the site. You’ll need to re-enter your basic details every time you visit the site and we won’t be able to make the site more personal to you. You will see generic content that may not be as interesting or relevant to you. If you’d still prefer to restrict, block or delete Cookies from www.crescentchemist.co.uk or any other website, it’s easy to do in your internet browser. Each browser is different, so you’ll need to go to the ‘help’ menu on your browser and look for how to change your ‘Cookie Preferences’. Your privacy and shared computers If you log in to www.crescentchemist.co.uk from a shared computer, such as in an internet cafe or from a colleague’s computer at work, Cookies may cause your e-mail address to display in the login field to anyone who uses the site on that computer after you. You can avoid this by clearing the Cookies stored by the web browser. The option to do this is normally in the ‘Tools’ dropdown menu at the top of the browser window. Information we get from external companies From time to time we may supplement the information we hold about you with data from other commercially-available sources like the electoral roll and companies such as Experian that collate and update data. This helps us keep our records up to date and learn more about our customers so we can continue to improve our products and services to them. We only work with organisations that obtain their data legally from publicly available or consent-based sources. Occasionally, for marketing purposes, we may obtain lists of potential customers from external companies. We’ll only deal with reputable companies that take privacy and data protection as seriously as we do and have obtained consent to share this data with us. We’ll always let you choose not to receive further marketing material from us.

If you’re a customer of a pharmacy business that has been taken over by Shivam Pharmacy Ltd, we’ll receive your personal information from them as part of the handover process. Where this happens, we place a notice in-store or we may contact you in writing to tell you that your personal information is changing hands. If you don’t wish for your data to be transferred to Shivam Pharmacy Ltd, you should contact us.

Crescent Pharmacy provides a range of clinical and healthcare services in partnership with, or on behalf of, NHS trusts, local health authorities and Clinical Commissioning Groups. Where these require your GP or other healthcare providers to register you for our services, they’ll give us information so we can do so. We use this information only to provide you with safe and appropriate care, deliver the service as agreed with the NHS body and meet our legal and regulatory obligations. GP online services If you have registered your Linkage Key or Passphrase to use GP online services through Crescent Pharmacy, we will source patient repeat medication details including your name and date of birth from your GP surgery for the purpose of enabling you to request NHS repeat prescription items directly from your GP for fulfilment by Crescent Pharmacy. If you are requesting a repeat prescription on behalf of someone else, their patient details will also be included in the information we retrieve from your GP surgery. We use your medical information only to provide you with safe and appropriate care, deliver the NHS repeat prescription service and meet our legal and regulatory obligations. Electronic Prescription: by using Crescent Pharmacy NHS repeat prescription service, you are allowing your GP surgery to send your prescriptions electronically to Crescent Pharmacy. You or the surgery will provide us with your details so we can register you on the Electronic Prescribing system and resolve any problems or queries that may arise in connection with it. We don’t use this information for any other purpose. Can I opt out of this? Yes, you can contact us or your GP and ask to opt you out of the electronic prescription service. Information we get from the NHS: your Summary Care Record In England, the NHS is using an electronic record called the Summary Care Record (SCR) to support patient care. A similar service is also provided in Wales. The SCR is a copy of key information from your GP record and it provides authorised health care professionals with faster and secure access to information about you when you need care. The NHS has made the SCR available to pharmacies across England and is available at Crescent Pharmacy. The Summary Care Record includes your contact details, NHS number, date of birth, information about medications you’re taking, allergies you suffer from and any bad reactions to medicines you have experienced. Our pharmacists may need to refer to your SCR if you need urgent treatment or medication out of hours or in other emergency situations where your pharmacist would normally need to speak with your GP but cannot do so. The pharmacist will ask for your consent every time they need to look at your SCR, except if you’re unconscious or otherwise unable to communicate and they believe it’s in your best interests to look at your record. Only the pharmacist directly involved in your care is allowed to access the SCR. The pharmacist needs an NHS ‘Smartcard’ and passcode in order to do so and can only see the information they need to do their job. Their details are logged every time they look at your record and the access log is audited to ensure all access is appropriate. Your SCR is not combined with any data that Crescent Pharmacy holds about you. It’s held on an NHS system and is accessed only in the circumstances set out above. Information about your health When you use our services, some of the information we collect may be about your health and include data from NHS bodies such as your GP or hospital. We understand the sensitivity of this information and will only use it to provide you with these services and fulfil our legal obligations to the NHS or similar bodies. If you have told us that it’s fine to send you marketing, we may send you offers on healthcare products you sometimes buy. We will never use information about your prescriptions for marketing, although we may use it to let you know about services we provide that might be useful and relevant to you. For example, when you collect a prescription from Crescent Pharmacy, the Pharmacist might ask if you would like to take advantage of our New Medicines Service, a Medicines Use Review, Diabetic Support Services or other similar services that may be relevant and useful to you. These services are voluntary but if you choose to use them we will need to ask you some health-related questions in order to fulfil our contractual obligations with the NHS. The information you give us will only be shared with the relevant NHS bodies and we won’t use it for any other purpose.

We may obtain information posted publicly on social media sites and use it to help us understand how our different customers interact with us and what people think and feel about our brand. We do this in a way that doesn’t always identify individual customers. For example, we may look at which groups of customers are more likely to talk to us via social media or use social media to talk about Crescent Pharmacy and our products. If we intend to use your information from a social media site such as Instagram, we’ll always contact you for your permission first. If you raise a query or a complaint through Crescent Pharmacy social media pages, we’ll, of course, have a record of your user name. This is used only to enable us to correspond with you and resolve the matter you’ve raised. Crescent Pharmacy shares pseudonymised data with social media platforms, such as Facebook, to enable us to deliver content and messages which may be of interest to you. Online pharmacy services If you purchase Pharmacy medicines from our online clinics, we will ask you some questions about your health to help us check that the medicine you are buying is suitable for you. This information is held securely on our systems and used only for processing your order. We won’t use it for any other purpose. Similarly, if you use our Prescription Dispensing and Delivery Service, we will ask you to give us some health-related information online. This information is held securely on our Pharmacy system to allow Pharmacy staff in-store to check your prescription history and medical conditions, ensuring you receive the best possible service from us. We may contact you by email or phone number about your online clinic order or prescription; so, please ensure that you’re happy with the security and privacy of the email account you use in connection with this. Please note that if you send an email directly to our Pharmacy Service from your own email account, we can not guarantee that its content will be encrypted at your end and therefore, we cannot guarantee its content to be secure. All electronic communications from us to you are fully encrypted. Can I opt out of this? Yes, to not be contacted by email or phone number about your orders or prescriptions, please unsubscribe to this service by deactivating or closing your account.

Booking appointments for other people If someone books an appointment on your behalf we’ll ask them for basic details about you which may include health details such as whether you have a family history of diabetes or glaucoma. This is to ensure we book you in for the right type and length of appointment with the correct healthcare professional. Of course, we’ll check with you when you come to your appointment to make sure that the information we’ve been given is accurate. If you’re booking an appointment for someone else, please make sure they’re happy for you to provide their personal information on their behalf and that they understand why we need to ask for the information. We don’t use it for any other purpose.

If you or a relative are a resident of a care home to which Crescent Pharmacy provides dispensing services, we will receive personal information from the care home to enable us to dispense prescriptions safely and comply with our legal and regulatory obligations.

We use your personal information for a number of different purposes. Some are essential for us to provide the services you use or to fulfil our legal obligations, some help us run our business efficiently and effectively and some enable us to provide you with more relevant and personalised offers and information. In all cases, we must have a reason and a legal ground for processing your personal information. Some of the most common legal grounds we rely on are briefly explained below. Consent You’ll be asked to confirm that you’re happy to provide your personal data and that you give your permission to Crescent Pharmacy to process your personal data. All of the details such as why Crescent Pharmacy want your data, how it will be used and if your data will be shared will be provided at the time of asking you for your consent. Where Crescent Pharmacy is relying on consent, you will usually see a tick box. Crescent Pharmacy may use consent where we’re asking you to confirm your marketing preferences to ensure we only contact you via the way that you have chosen, i.e. text or email. You may also be asked to give your consent when you’re entering any sort of competition. If some of your details have changed since the time you provided your consent you can update and amend your details at any time. You have the right to withdraw your consent, at any time, if you no longer want to be part of Crescent Pharmacy processing activity. If you no longer want Crescent Pharmacy to hold your data you can request for your data to be erased. Contractual Processing data for the purposes of a contract to which you are a party to. There’s a range of legal and regulatory requirements we need to comply with, and some of these may affect the way we process personal data or the length of time for which we are required to keep it. As a healthcare provider, we’re regulated by the General Pharmaceutical Council (GPhC), Care Quality Commission (CQC) and Pharmaceutical Society. All of which may set out standards and codes of practice with which we need to comply. Where we provide NHS services in our pharmacy practice, we also have to comply with NHS Information Governance and Data Security Protection requirements. You have the right to request that Crescent Pharmacy amend your data and you can ask for your data to be removed. If we don’t have any legal requirements to keep this, then we will remove it. Legal obligation Crescent Pharmacy will, on occasions, be under a legal obligation to obtain and disclose your personal data. Where possible, Crescent Pharmacy will notify you when processing your data due to a legal obligation; however, this may not always be possible. In order to prevent criminal activity or help to detect criminal activity, we may share information with forces such as the Police. This is done in a safe and secure manner. You may not be notified of this. Crescent Pharmacy provides a range of clinical and healthcare services in partnership with, or on behalf of, NHS trusts, local health authorities and Clinical Commissioning Groups. As part of this, Crescent Pharmacy is required to share certain amounts of personal data in order for the NHS and Crescent Pharmacy to meet regulatory and legal obligations. Crescent Pharmacy will tell you when we share your data for this reason. It’s essential that Crescent Pharmacy complies with its legal, regulatory and contractual requirements. If you object to this processing, Crescent Pharmacy won’t be able to offer you the service. Legitimate interest Crescent Pharmacy may also hold personal data for our own legitimate business interest. This relates to us managing our business to enable us to give you the best services and products through the most secure experience. When we rely on this, we’ll carry out a legitimate interest assessment to ensure we consider and balance any potential impact on you (both positive and negative) and your rights under data protection laws. It can also apply to processing what’s in your interest as well. Our legitimate business interests don’t automatically override your interests – we won’t use your Personal Data for activities where our interests are overridden by the impact on you unless we have your consent or are otherwise required or permitted to by law. We may process your information to protect you against fraud when transacting on our website and to ensure our websites and systems are secure. We have an interest in making sure our marketing is relevant for you; so, we may process your information to send you marketing that’s tailored to your interests. If you have any concerns about the processing, you have the right to object to processing that is based on our legitimate interests. For more information on your rights, please see ‘Staying in control of your information: Your rights’ below.

Providing our products and services We use your personal information to provide our products and services; for example, to set up and run your account, process orders and transactions, respond to queries and comments and provide you with the best possible level of customer service. We may use it to contact you about orders you’ve placed or appointments you’ve booked or to send you reminders (e.g. about repeat prescriptions). We may also contact you in emergency situations, such as an urgent product recall or where we have a duty of care to notify you of information that relates to your health. Can I opt out of having my data used for this? No, because this covers the many processes and legal obligations that we need to carry out in order to provide you with the service(s) you’ve requested and also to protect you in emergency situations.

Legal, regulatory and contractual requirements As a healthcare provider, we’re regulated by the General Pharmaceutical Council (GPhC) and the Care Quality Commission (CQC), all of which may set out standards and codes of practice with which we need to comply. Where we provide NHS services in our pharmacy practice, we also have to comply with NHS Information Governance requirements and Data Security Protection. Keeping our records up to date We have a legal obligation to keep the personal data we hold accurate and up to date. We periodically update our records against commercially or publicly available sources (using companies such as Experian) to update addresses where customers have moved or who are deceased. This is to fill gaps in the contact details we hold and to correct addresses that are incorrectly formatted. This excludes the information we hold about you on our prescription dispensing system. The information held there originates from your prescriber (usually your GP or a hospital) and is used only in connection with dispensing prescriptions. Any updates you make to information held elsewhere in Crescent Pharmacy, such as your www.crescentchemist.co.uk account, are not applied to the information held on this system. Can I opt out of this? Yes, however, there may be legal and regulatory requirements that require Crescent Pharmacy to keep your information up to date if you’re using Crescent Pharmacy services.

We’ll consolidate the information we hold about you through different channels you use to interact with us (eg website, store, correspondence etc.). We do this to keep our records accurate and up to date, provide you with a seamless and consistent service and build a clearer picture of our customers both as a group and as individuals. By understanding you better, we can offer you the best and most personalised service we can; but don’t worry, we will only send you marketing material if you have agreed that we can.

Like all retailers, Crescent Pharmacy undertakes certain activities that enable us to provide our customers and colleagues with a safe, secure and legal environment online and in stores. When you place an order on our website we carry out identity verification, fraud prevention and anti-money laundering checks, validating the personal information you give against appropriate third party databases. This involves sharing your personal data with organisations which verify those details and transactions and pick up on anything that may indicate illegal activity. This may, in some cases, involve the disclosure of information to a Credit Reference Agency which will keep a record of that information and may pass it to the police. In-store, we use video and audio recording to prevent and detect crime and anti-social behaviour. We display clear signage, comply with the Information Commissioner’s Surveillance Camera Code of Conduct and have internal processes in place to minimise the impact on your privacy. Can I opt out of this? No, as there will be legal and regulatory reasons that these activities need to be carried out that are mentioned above; therefore, we’ll not be able to prevent processing your data for this reason as it’s essential to protect our customers, our colleagues and our business from criminal activity.

The following are things we do as a business to help us operate effectively and efficiently and in turn, provide you with better and simpler services. It’s in our legitimate interests to do these things and we do them in a way that respects and minimises any impact on your privacy. Learning more about our customers and our business We carry out analytics on the information we hold about our customers to help us understand who our customers are, how they use our services and how people interact with us. This enables us to plan our business; for example, stock and staffing levels, make sure we offer the same experience online as in our stores, maximise the effectiveness of our advertising and understand how our business is performing. We don’t do this in a way that enables individual customers to be identified. It’s not related to the direct marketing or special offers that we send to you based on your use of our services. Can I object to this? Yes, you have the right to object to the way we use your data if you believe our legitimate interest in doing it is outweighed by your right to privacy. As this type of analysis is important in enabling us (like other retailers) to operate efficiently, we carry it out in a way that doesn’t identify individuals; we believe, it has no impact on your privacy. Recognising you when you use our services Whichever services you use, wherever and however you interact with us, we want to give you the same level of service and make things simple and straightforward. We use your details across our services so we can recognise you as a customer and provide consistent care with whichever service you’re using. This also means that you don’t need to give the same details each time you come in. Can I object to this? Yes, we do this because it makes things more efficient both for you and for Crescent Pharmacy. You can object but doing so will limit the services you’re able to use in the future. If you don’t wish us to recognise you across our services, the following services will be affected and may not work to its full potential: • The website services at www.crescentchemist.co.uk; ie account • Use of any of our private (non-NHS) healthcare services • Booking an appointment using our appointment booking service online, by phone or in-store The following services will remain unaffected if you object: • Having your prescriptions dispensed at Crescent Pharmacy as normal • Having an NHS clinical service at Crescent Pharmacy • Use of our online clinics • Placing an order at www.crescentchemist.co.uk as a guest customer. You won’t be able to sign up for an account How do I opt out? If you’re a new customer at www.crescentchemist.co.uk, you should use the guest checkout rather than setting up a www.crescentchemist.co.uk account as this will limit how Crescent Pharmacy can use your data. If you’re visiting our Pharmacy Shop for an NHS clinical service, you should indicate your preference when asked. If you’re an existing customer, you’ll need to contact us with your request. Note that if you close your account, we may continue to hold your personal information for a period of time after you cease to be a customer (see the section headed ‘how long do we hold your data’ below). Personalising your digital experience We use your personal data such as your browsing history, username and purchases to personalise our websites so the content is more relevant to you, giving you a better online experience. We do this through our use of Cookies and, where appropriate, through the information we have gathered about you from other interactions (eg products you buy or browse, or links that you have clicked on) or other sources. For example, we may greet you by name, show search results that reflect things most likely to be of interest to you and show you content that’s more relevant to you and the things you have previously shown an interest in. Can I object to this? Yes, but we believe it’ll result in your online experience being less personal and relevant to you. The content and search results you see will be generic rather than related to your interests. Personalising your online experience doesn’t affect the marketing options you have selected, it’s to offer you a service personalised to your needs. How do I object? If you’re a registered customer you can contact us with your request. If you’re not a registered customer, information held in our Cookies may be used to select the content that we feel is more relevant for you. To prevent this, you can clear your cookies. Building up a picture of you We may analyse your personal information, including the products you view and buy, your browsing habits and other ways you interact with Crescent Pharmacy to evaluate the effectiveness of our advertising and help us provide more relevant offers, advice and information across a variety of marketing channels including online advertising and social media sites such as Facebook. This will include information about the way you interact with us and information about your memberships, such as Parenting Club and Over 60’s. We may also use information from external (consent-based) companies such as Experian. Rest assured that we’ll only send you marketing material if you’ve agreed that we can. We’ll never use sensitive information about your health. Can I opt out of this? Yes, but if you have asked to receive marketing you’ll receive only generic offers based on your gender, age, location rather than specific marketing based on preferences and how you use Crescent Pharmacy services. If you wish to opt out, please contact us using the contact information provided on this website.

We carry out analytics on data about the prescriptions we dispense, which enables us to understand how our business is operating, so that we can develop our products and services. It also enables us to provide valuable insights about dispensing activity. Before we undertake any such analytics with pharmacy data, we anonymise it in line with the ICO Anonymisation Standards so it’s not linked to you and you cannot be identified from it. Can I object to this? As the data we use in this activity is anonymised in line with the ICO anonymisation standards, it’s no longer personal data; so, you cannot exercise a legal right to object to it.

We may invite you to give feedback on Crescent Pharmacy services you’ve used or to take part in market research activities such as customer surveys, questionnaires or focus groups. Although the invitation may be sent to you by third party agencies on our behalf, rest assured that we only send your contact details. We’ll only contact you by email if you’ve have indicated that you’re happy to receive marketing from us. Please be aware that you won’t be contacted more than once every six months for research purposes and we never sell your personal data. Crescent Pharmacy will only ever share your data with reputable agencies in a safe and secure manner. All personal data is deleted as soon as it’s been used. Keeping your data safe is our top priority. Can I opt out? Yes, you’ll always be able to decline to take part in research activities and you can opt out of these types of emails from us as well as other marketing emails. You can do this by managing your preferences online or following the unsubscribe link at the bottom of any of our emails.

Appointment booking – searching our systems If you’ve previously had a prescription dispensed at Crescent Pharmacy, we may have your contact details in our pharmacy system. These may be retrieved when we look up your details; but, rest assured that we’re unable to access any pharmacy details beyond your contact details. How we send you marketing material We use your information to send you offers and information and you’ll always be asked if you want to receive offers and information and via what channels you would like to receive them. Can I opt out of this? Yes, you can change your mind about receiving marketing material from us at any time by contacting us or logging into your account at www.crescentchemist.co.uk. You can also click on the link at the bottom of any email we’ve sent you to opt out from email marketing. Please be aware that as our marketing campaigns are prepared well in advance, you may still receive material by post for up to two months and by e-mail or text for up to 28 days after updating your preferences.

When you visit our website as a registered customer that is opted-in to marketing emails, we will use your email address to contact you with a reminder containing a list of unpurchased items that are still in your basket. Can I opt out? Yes, you will always be able to opt out of emails from Crescent Pharmacy as well as other marketing emails. You can do this by managing your preferences online or following the unsubscribe link at the bottom of any of our emails.

When you use our services, some of the information we collect may be about your health and include data from NHS bodies such as your GP or hospital. We understand the sensitivity of this information and will only use it to provide you with these services and fulfil our legal obligations to the NHS or similar bodies. As a healthcare provider, we’re regulated by bodies including the GPhC and the CQC; all of whom may set out requirements which we need to comply with when processing personal data, including timescales for keeping data, reporting requirements and professional codes of practice. Where we provide NHS services, we’re required to comply with the NHS Information Governance requirements. One of the requirements is to complete a Data Security Protection Toolkit which is used to report compliance to a set of information, protection and governance standard to the NHS. Where we’re contracted to provide a service to, or on behalf of, the NHS or an individual NHS Trust or body, we’ll use your personal data to help us meet our contractual requirements to that body. Dispensing prescriptions The information we hold on your personal medical record is used only to enable us to dispense your prescription legally, safely and to fulfil our requirements to you and the NHS. As mentioned above, we may use your address and contact details with your consent to search across our other systems. You’ll always be asked for your consent to this and your consent can be withdrawn at any time. Can I opt out of this? No, if you request Crescent Pharmacy to carry out this service, we need to use this information to dispense your prescription safely and legally. Summary Care Record This is only used with your consent and in emergencies. Prescription detail We’ll never use information about your prescriptions for marketing, although we may use it to let you know about services we provide that might be useful and relevant to you when you come into our pharmacy. For example, when you collect a prescription, our pharmacist might ask if you’d like to take advantage of our New Medicines Service, a Medicines Use Review, Diabetic Support Services or other similar services that may be relevant and useful to you. These services are voluntary but if you choose to use them, we’ll need to ask you some health-related questions in order to fulfil our contractual obligations with the NHS. The information you give us will only be shared with the relevant NHS bodies and we won’t use it for any other purpose.

Legal obligations We may share your personal information with third parties where required or permitted by law if we believe we need to do so to protect our rights or to comply with legal proceedings. In such cases, we’ll always do so legally and with due regard to your privacy. Sharing with the NHS We share information with NHS bodies to fulfil our legal obligations as a provider of pharmacy services, or where we have a duty of care to do so; for example, to obtain payment for the services we provide and to measure the effectiveness of services. In some circumstances, we might need to let your GP know we’ve prescribed an item or given you a particular service. If you’ve asked us to register you for an NHS scheme or service, we’ll pass your personal information to the NHS using a secure method of data transfer so that the NHS can register you for the relevant scheme or service. If you choose to have one of the NHS services provided in our pharmacy, such as a Medicines Use Review, we’ll ask you for health-related information which is needed to fulfil our contractual obligations to the NHS. We share this information only with NHS bodies and won’t use it in any other way. Although we may use your contact details to send you reminders about any follow-up appointments. Other brands From time to time we may contact you with special offers on behalf of brands we stock, but we’ll never sell or share your data with those brands for them to use in their own marketing. If you give your contact details and any other personal information to another company, other than to Crescent Pharmacy. Each company has its own Privacy Policy which may not be the same as ours; so, we advise that you check who is collecting your personal information and how they’ll use it before signing up to receive offers or information. Similarly, if you click through to another company’s website via a link on www.crescentchemist.co.uk, check you’re happy with that company’s Privacy Policy before giving your personal information. Changes to our business If the ownership of all or part of our business changes, or we undergo a reorganisation, we’ll transfer your personal information to the new owner or successor company so we can continue to provide our services.

We share your personal information with companies that provide services on our behalf, such as printers, couriers, mailing houses, data hosting services, social media organisations, digital marketing agencies, call centre providers, market research, manufacturers and suppliers. We always ensure that these companies give your information the same level of care and security we do. If your information is to be sent outside Europe, we make sure it’ll be subject to standards of protection and security that are as high as those that Crescent Pharmacy uses here in the UK. For more information on the location of your data please see below. Examples of the functions that may be carried out by external companies: • Customer service centre • Mailing houses and printers • Online and social media advertising • Delivery services such as couriers • Market research • Manufacturers or suppliers • NHS bodies, such as GP and hospitals • Payment providers • Companies that provide web hosting, content providers, competitions, waiting lists etc. • Companies that do fraud and money laundering checks • Companies that provide IIT services & support, inclusive of web hosting, data storage, data cleansing, content providers, competitions, waiting lists etc.

We take your data very seriously; therefore, we’ll always conduct a full review of all of our suppliers’ processes and procedures including storage solutions for our data. In order to ensure adequacy when sending your data outside of the EEA, we put in place contracts based on the Standard EU Model Contract Clauses which are designed by the European Commission to guarantee adequacy for any data transfer and processing of this nature. Can I opt out of having my data shared? As your data is stored safely and securely both inside and outside of the EEA, we cannot offer an alternative storage solution. If you wish to opt out of having your data stored outside of the EEA, you’ll need to close your account with us. How long do we keep your personal information? We hold your personal information for as long as we have a legal or business reason to do so, which generally means as long as you remain an Crescent Pharmacy customer or as required to meet our legal obligations, resolve disputes or enforce our agreements. To fulfil our obligations to the NHS, regulatory or similar bodies, health-related personal information may need to be retained for a period of time after you cease to be an Crescent Pharmacy customer. We’ll always store your data securely and won’t use it for any other purpose. Securing your payment details online www.crescentchemist.co.uk has been issued with a Secure Server Digital Certificate by the online Certification Authority, Digicert; this confirms that www.crescentchemist.co.uk is a legitimate website that provides an encrypted communication channel to protect the information you pass to Crescent Pharmacy when making a purchase. In addition to this, all credit/debit card payments are securely handled by an industry-leading payment processor and are never stored on our website.

We respect the fact that your personal information is your information, and we’ll make it easy for you to update or change your personal details or marketing permissions. Please help us to help you by letting us know if your contact details change or if you spot any errors in the information we hold about you. Your right of access If you would like a copy of the information we hold about you or have any queries about the way we handle your personal information, please contact us. What information am I entitled to? You have to right to obtain a copy of all the information that Crescent Pharmacy holds about you, such as personal details, correspondence, marketing preferences, consent information, complaints and queries, within a 30-day time limit and free of charge. Your right to move your data (portability) Under certain circumstances, you can request that we move your data to another service provider. This is not an automatic right, depending on the type of data that Crescent Pharmacy holds about you and the reason we process the data will depend on what we are able to do. Please contact us to submit a request. Your right to processing You have the right to request that Crescent Pharmacy stops certain data processing activities that involve processing your personal data, this can be processes such as collecting your name and address on your www.crescentchemist.co.uk account to deliver goods to you, among other examples given above. This isn’t an automatic right, what Crescent Pharmacy is able to do will depend on the type of data that we hold about you and why. Please contact us to exercise your right to object to Crescent Pharmacy processing your data. You have a right request deletion While you remain a customer, we’ll process and retain your data as described in this Policy. Once you cease to be a customer, we’ll hold your data for as long as required by law. You do have a right to request that Crescent Pharmacy deletes your personal data it holds. This isn’t an automatic right, what Crescent Pharmacy is able to delete will depend on the type of data that we hold about you. Please contact us to request your data to be deleted. CCTV Technologies associated with our CCTV systems will be used for the purpose of collecting non-identifiable analytical data; for example, to understand how long our customers wait in queues when making a purchase or using services within our store. You cannot be identified by the use of these technologies. If you require access to CCTV footage (for example, if you’re the victim of a crime that takes place on our premises), you should write to us at 2 Fleming Crescent, Sele Farm, Hertford, SG14 2DJ. We’ll ask the date and approximate time of the incident you wish to view, and as much detail as you can, to help us locate the correct footage; we may make a small charge. We’ll do our best to help, but there are situations in which we may be unable to make CCTV footage available to you, such as where the incident occurred some time ago or if we believe that allowing you to view it would breach someone else’s privacy. CCTV is held for a 30 day period. For all request mentioned above, there is a 30-day limit to which Crescent Pharmacy must respond by and you’re required to provide proof of your identity. Processing data about children Crescent Pharmacy processes children’s data for appointments and when processing prescriptions. Children under the age of 16 using these services must be accompanied by an adult at all times. Who to contact For all questions relating to this policy, please contact us through this website or in person. Your right to complain to the ICO Although we hope it never comes to this, you do have the right to complain to the ICO about any of Crescent Pharmacy processing activities at casework@ico.org.uk

This Privacy Policy was updated in July 2020. We may update it from time to time so we recommend that you check back here occasionally. If we make changes we think may affect you significantly, particularly if they could have an impact on the choices you have made about marketing, we’ll provide you with a prominent notice by the most appropriate medium so you know about the changes before they happen.