Last updated: 15 October, 2026
Privacy Notice – The London PharmaClinic at Clinichem Pharmacy
Your health information is personal, and you trust us with it. This notice explains what we collect, why we need it, who we share it with, how long we keep it and what your rights are. If anything is unclear, please ask us. We would rather explain in person than have you wonder.
Who we are
The London PharmaClinic is the private clinic of Clinichem Pharmacy. Both are run by Clinichem Ltd, which is the data controller for your information.
- Registered office: 111a George Lane, London E18 1AN (company no. 06517189)
- Trading address: 29 Upper Tachbrook Street, Victoria, London SW1V 1SN
- GPhC registered pharmacy: 1097986
- Information Commissioner’s Office (ICO) registration: Z2267789
- Data protection lead: Sukhvir (Sukhi) Basra, Pharmacist Independent Prescriber
- Caldicott Guardian: Sukhjinder Basra, Superintendent Pharmacist
- Contact: hello@thelondonpharmaclinic.co.uk · 020 7828 1222 · or write to us at our trading address
What information we hold
- Contact details: your name, address, date of birth, phone number and email address.
- Identity checks: the photo ID you show us. We record that your identity was confirmed and how. For your safety, we do not keep a copy of your ID.
- Health information: your medical history, current medicines (including supplements), allergies, height, weight and BMI, blood pressure, blood test results, pregnancy and contraception status, and your answers to wellbeing screening questions.
- Your GP’s details, and information from your GP record when you agree to us checking it.
- Consultation and prescribing records: what was discussed, what was prescribed or not prescribed and why, and how each supply was reviewed.
- Payment and booking records: appointments, fees paid and refunds. We do not see or store your full card number.
- Website information: basic technical data such as your IP address and browser type, collected through essential cookies (see our Cookie Policy).
CCTV images if you visit the pharmacy.
Why we use it, and our legal basis
UK data protection law requires us to have a lawful reason for each use of your information. Health information is “special category” data, so it needs a second, stricter condition as well.
| What we do | Lawful basis (UK GDPR Article 6) | Condition for health data (Article 9) |
|---|---|---|
| Assess you, prescribe, dispense and supply your medicines, and monitor your treatment | Contract with you (6(1)(b)) | Provision of health care by a registered health professional bound by confidentiality (9(2)(h)) |
| Keep the clinical and prescription records the law requires | Legal obligation (6(1)(c)) | Provision of health care (9(2)(h)) |
| Tell your GP about your treatment, with your consent | Contract with you (6(1)(b)) | Provision of health care (9(2)(h)) |
| Handle complaints, incidents and audit the safety of our service | Legitimate interests in safe, good-quality care (6(1)(f)) | Provision of health care (9(2)(h)) |
| Respond to legal claims or regulators | Legal obligation (6(1)(c)) | Legal claims (9(2)(f)) |
| Run CCTV for the safety of patients, staff and medicines | Legitimate interests (6(1)(f)) | Not applicable |
| Send you news about our services | Your consent, which you can withdraw at any time (6(1)(a)) | Not used for health data |
We never sell your information, and we never use it for advertising by anyone else. We do not make decisions about you by automated means alone: every prescribing decision is made by a registered prescriber.
Who we share it with
We share only what is needed, only with people who need it for your care or to run the service safely.
- Your GP, with your consent. For weight-management medicines, if you do not agree to us telling your GP, we may not be able to prescribe. We will explain why.
- Other health professionals involved in your care, if you are referred or need urgent help.
- Our service providers, who process information only on our instructions and under a written contract:
Semble – clinic records, online booking, video consultations and card payments (we never see your full card number)
Titan – pharmacy dispensing records
NHSmail – secure email with GPs and the NHS
Post Office – tracked delivery of your medicines (name and delivery address only)
Redmoor Health – website design and hosting - Regulators and authorities where the law requires it, for example the General Pharmaceutical Council, the MHRA or the police with a lawful request. Any such disclosure is decided by our Caldicott Guardian.
- Safeguarding services, if we believe you or someone else is at risk of serious harm.
- All of your information is stored in the UK.
How long we keep it
We keep records for the periods set by the NHS Records Management Code of Practice and by law, then destroy them securely.
| Record | How long we keep it |
|---|---|
| Clinic and prescribing records | 8 years after your last contact with us |
| Private prescription and POM register entries | At least 2 years from the date of supply, as the law requires |
| Booking and payment records | 6 years, for tax and accounting |
| Enquiries that do not lead to treatment | 2 years |
| CCTV images | 30 days, unless needed for an investigation |
Keeping it safe
Our team uses individual logins and never shares them. Clinical details travel only through secure systems (Semble, Titan or NHSmail), never personal email, WhatsApp or text. Video consultations are held in a private room and are never recorded. Every member of staff completes data security training every year, and we complete the NHS Data Security and Protection Toolkit annually.
If something does go wrong, we will act quickly. We report serious incidents to the ICO within 72 hours, and we will tell you directly if your information has been put at high risk.
Your rights
You have the right to:
- ask for a copy of the information we hold about you;
- ask us to correct anything that is wrong (in clinical records we add a dated note rather than delete what was written);
- ask us to delete or restrict your information, or object to how we use it (some records we must keep by law);
- withdraw your consent at any time, where we rely on consent;
ask us to transfer information you gave us to another provider.
To use any of these rights, contact us using the details above. We will check your identity, respond within one month, and will not charge a fee in most cases.
Complaints
If you are unhappy with how we have handled your information, please tell us first so that we can put it right. You also have the right to complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint, 0303 123 1113.
Children
Our private clinic services are for adults aged 18 and over.
Changes to this notice
We review this notice every year, and whenever our services or the law change. The date at the top shows when it was last updated.
