Privacy policy

Who we are

Pharmacy Services is an online booking and patient management platform for UK community pharmacies, made by Karad Infotech Ltd (Registered in England and Wales, No: 11541799. VAT: 499671908.). Registered office: 124–128 City Road, London EC1V 2NX. We are registered with the Information Commissioner's Office, registration number ZB016453.

Questions about this policy or your data: email connect@karadinfotech.com or call 020 4516 9416.

Our two roles

We are the data controller for the personal data of people who visit this website, ask us for a demo or a health check, and the pharmacy owners and staff who use Pharmacy Services.

When a patient books with a pharmacy, fills in a questionnaire, or has a consultation recorded, the pharmacy is the data controller and we are its data processor: we hold and process that data only on the pharmacy's instructions, under our agreement with them, to run the service. If you are a patient, the pharmacy's own privacy notice explains how it uses your data, and the pharmacy is the first place to go with requests about it. We will help the pharmacy answer them.

What we collect and why

Website visitors. This website uses no analytics or advertising trackers. Our servers keep short technical logs (such as the address a request came from) to keep the service secure and working.

Demo requests and enquiries. Your name, pharmacy, email, phone and message, to reply to you and arrange a demo. Our lawful basis is legitimate interests (answering an enquiry you made).

Free digital health check. Explained in its own health check privacy notice.

Pharmacy owners and staff. Name, work email, phone, role, sign-in details (passwords are stored only as secure hashes), professional registration numbers where you add them (such as a GPhC number), and records of what was done in the account (an audit log). We use them to provide the service under our contract with the pharmacy, to keep it secure, and to send service emails. Billing details for the pharmacy's subscription are handled by Stripe; we never see full card numbers.

Patients (on the pharmacy's behalf). The details a pharmacy needs to book and provide its services: name, contact details, date of birth, address, appointment history, questionnaire answers, consultation records, the patient's GP practice where needed, and the patient's contact preferences and consents. Some of this is health data. We process it only to run the pharmacy's service, never for our own purposes, never for advertising, and we never sell it.

Who helps us

We use these service providers (processors), each bound by contract to protect the data and use it only for us:

We also look up public information in the NHS organisation and service directories (for example to find a GP practice, or to compare a pharmacy's NHS website listing with its details) and postcodes.io (to check a postcode or place a pharmacy on a map), sending them only the search text or postcode, never names or other patient details.

Some providers may process data outside the UK. Where they do, the transfer is protected by UK adequacy regulations or the UK's approved contract clauses.

How long we keep it

Pharmacy and patient records are kept for as long as the pharmacy uses Pharmacy Services, and are deleted or returned at the end of our agreement, except where the pharmacy needs us to keep clinical records for the periods the law and professional guidance require.

Some data is cleared automatically: expired sign-in sessions after 30 days, email and text message content after 30 days (a record that a message was sent is kept for 12 months), routine activity logs after 90 days, and health check details as its notice explains.

Enquiries and demo requests are kept while we are in touch and deleted when we no longer need them, or sooner if you ask.

Keeping it safe

Data is encrypted in transit and at rest, each pharmacy's data is kept separate from every other pharmacy's, staff access is by role, and important actions are logged. More on our security page.

Cookies

We use only cookies that are strictly necessary: to keep you signed in, to protect forms, and to remember a choice you made (such as a booking in progress). We do not use analytics or advertising cookies, so there is no cookie banner.

Your rights

You have the right to ask for a copy of your data, to have it corrected or deleted, to restrict or object to how it is used, and to have it moved to another service. Patients with an account can download their data from their account's Privacy page. To use any of these rights, email connect@karadinfotech.com; if the data is held for a pharmacy, we will pass your request to the pharmacy and help it answer.

If you are unhappy with how your data is handled, please tell us first. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Changes

We will update this policy when how we handle data changes, and show the date at the top. Important changes will be told to pharmacy customers by email.