Privacy Policy

Drugs4Delivery is a trading name of Tatari Realty Company Ltd, a company registered in England and Wales with company number 06527299, and a pharmacy registered with the General Pharmaceutical Council under number 9010768. We are the controller of the personal information described in this policy.

For anything about your personal information, email info@drugs4delivery.com, call 01472 241990, or write to Data Protection, Drugs4Delivery, Unit 4, Acorn Business Park, Moss Road, Grimsby, England, DN32 0LT.

• Identity and contact details: your name, date of birth, email address, phone number, delivery and billing addresses, and your NHS number if you choose to give it.
• Health information: your answers to our assessments (such as your medical history, the medicines you take, your weight and your alcohol use), photos you upload for a weight management assessment, test results you upload (such as liver function tests), notes from your calls and messages with our clinical team, and your prescriptions and the medicines we supply.
• Payment and order details: what you have ordered and paid for, payment references and the last four digits of your card. Your full card details go straight to our payment provider to process the payment. We do not store them.
• Messages: what you send us through your account, by email or by phone, and the times of any calls you book.
• Account and technical information: your login details, your IP address, and information about your browser and device, which we use to keep the service secure.
• Refer-a-friend: your referral code, who referred you or whom you referred, any credit you have earned, and whether you are happy for us to tell your referrer that you signed up.
• Your marketing preferences.

If you start an assessment and create an account part-way through, we save your answers so you can finish later. If you give us an email address only so we can remind you to finish an assessment, we delete it after 30 days.

• To assess you, prescribe, dispense and deliver your medicines, and look after you during treatment. We do this to perform our contract with you. Because this involves health information, we also rely on it being necessary for the provision of health care, carried out by or under the responsibility of health professionals who owe you a duty of confidentiality (UK GDPR Article 9(2)(h) and paragraph 2 of Schedule 1 to the Data Protection Act 2018).
• To keep the clinical and pharmacy records that the law and our regulator require. We do this to comply with our legal obligations.
• To take payments, including repeat payments, and to make refunds. We do this to perform our contract with you.
• To send you messages about your assessment, calls, payments, orders and deliveries. We do this to perform our contract with you. Reminders to finish an assessment are sent only to an email address you gave us for that purpose, and you can stop them from any reminder.
• To prevent automated abuse. When you create an account, ask us to resend a confirmation email or request a password reset, we check that the request comes from a person and not an automated script. This uses Vercel BotID and, where a further check is needed, Cloudflare Turnstile. Both process your IP address and technical information about your browser and device solely to make that decision. Neither sets cookies for this purpose or uses the information to track you across other websites. We do this on the basis of our legitimate interest in protecting our service and other people's email addresses from misuse.
• To send you news, offers and health advice by email, only if you have opted in. We rely on your consent, and you can unsubscribe at any time.
• To understand how our public pages are used and which of our adverts brought you to us, only if you choose "Accept all" in our cookie banner. We rely on your consent. See Cookies below.
• To run our refer-a-friend scheme. We do this to perform the scheme's terms. We only tell the person who referred you that you signed up if you say yes.
• To contact your GP, with your consent, or without it only where that is necessary to protect your life or someone else's.
• To handle complaints and legal claims and to answer our regulators. We do this to comply with our legal obligations and in our legitimate interests, and for health information because it is necessary for legal claims.

Every prescribing decision is made by a person, a UK-registered prescriber. We do not make decisions about you by automated means alone.

Your health information is seen by our own clinical and pharmacy team, and only as far as each person's role needs. We never sell your information, and we never share it with anyone for their own marketing.

We use a small number of service providers to run our service. They handle information only on our instructions and under contracts that require them to protect it:

• Supabase: our secure database, file storage and sign-in. Your information is stored in the European Union (Ireland).
• Vercel: hosts our website, and provides the BotID check described above.
• Resend: sends our emails.
• Pixxles: processes card payments, including repeat payments.
• Google: Google Calendar holds the times of booked calls with your name, email address and phone number, but not your condition. Google Analytics and Google Ads measurement are used only if you accept them, as described under Cookies.
• Cloudflare: provides the Turnstile check described above, where it is needed.

We also share information where we need to or must:

• Royal Mail, to deliver your parcel. For deliveries outside the United Kingdom this includes a customs declaration.
• Your GP, as described above.
• Regulators such as the General Pharmaceutical Council, the police, or a court, where the law requires it.
• A buyer of our business, if it is ever sold, who would have to protect your information in the same way.

Your records are stored in the European Union, which UK law recognises as protecting personal information to the same standard. Some of our service providers are based in, or may process information in, the United States. Where information leaves the UK, we make sure it is protected by UK adequacy regulations, including the UK Extension to the EU-US Data Privacy Framework, or by the ICO's International Data Transfer Agreement or Addendum.

• Consultation, prescription and pharmacy records: 8 years after your last contact with us. Pharmacy and prescribing law and our regulator require us to keep these records, so we cannot delete them earlier on request.
• Payment and financial records: 6 years, as tax law requires.
• An email address given only for assessment reminders: 30 days.
• Marketing preferences: until you change them. If you unsubscribe, we keep a note of that so we do not email you again.
• Cookies: for the periods set out below.

Your information is encrypted in transit and at rest. Access is limited by role, and our clinicians and pharmacists are bound by professional duties of confidentiality.

Under UK data protection law, you have the right to:

• Access: ask for a copy of your personal information.
• Rectification: ask us to correct information you think is inaccurate or incomplete.
• Erasure: ask us to delete your information. We will, except where the law requires us to keep it, as it does for clinical and pharmacy records.
• Restriction: ask us to limit how we use your information in certain circumstances.
• Objection: object to our use of your information where we rely on our legitimate interests.
• Portability: ask us to pass information you gave us to you or to another organisation in a machine-readable format, where we hold it to perform our contract or with your consent.
• Withdraw consent: where we rely on your consent, withdraw it at any time. This does not affect anything we did before you withdrew it.

To use any of these rights, contact us using the details above. We will respond within one month. If you are unhappy with how we have handled your information, please tell us. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Strictly necessary cookies, which are always on:

• Sign-in cookies (names starting "sb-"): keep you securely signed in to your account. They last up to 400 days, or until you sign out.
• d4d_consent_v2: remembers your cookie choice, for 1 year.

Functional cookies, set only if you follow a referral link:

• d4d_friend_ref: remembers a friend's referral code so the discount can be applied, for 90 days.
• d4d_referral: remembers a partner's referral, for 30 days or until your account is created.

Optional cookies, set only if you choose "Accept all":

• Google Analytics (_ga and _ga_ followed by an ID): tell us how our public pages are used. They are never used in your account, in assessments or at checkout, and Google Analytics never receives your name, contact details or health information. They last up to 2 years.
• d4d_attr: if you arrive from one of our adverts, records which advert it was, so we can tell Google Ads whether it led to an assessment or a purchase. It holds no name, contact details or health information and lasts 90 days.

We also store your assessment answers in your browser for up to 7 days, so you can pick up where you left off, and remember your basket. You can change your cookie choice at any time using the "Cookie settings" link at the bottom of every page. Choosing "Reject non-essential" removes the optional cookies.

Our services are for people aged 18 and over. We do not knowingly collect information about children.

We will update this policy when the way we use personal information changes, and show the date of the latest version at the top. If a change is significant, we will tell you before it takes effect.