Privacy policy

The Chemist Online, 210 Bury New Road, Whitefield, Manchester M45 6GG is the data controller for the personal data described here. ICO registration: [ICO registration number]. Contact us about your data at info@thechemistonline.co.uk.

• Account details — your email address, used for passwordless sign-in codes and order updates.
• Order details — name, delivery address, phone number and the items you buy.
• Health questionnaire answers — when you buy a pharmacy medicine, the answers you give at checkout. This is special-category health data; we process it so a pharmacist can check the medicine is safe and appropriate for you.
• Payment — card payments are processed by Stripe; your full card number never touches our servers.
• Site usage — basic analytics and, where enabled, advertising identifiers (see Cookies below).

• To process and deliver your orders, including the pharmacist review of pharmacy medicines.
• To send you order confirmations, sign-in codes and delivery updates.
• To meet our legal and professional obligations as a pharmacy, including record keeping.
• To measure and improve how the shop performs, including how customers arrive from advertising.

We do not sell your personal data, and we never share your health answers for marketing.

• Our delivery carriers, to get your order to you.
• Stripe, to take payment securely.
• Our fulfilment and dispensing systems, to prepare and record your order.
• Our hosting and infrastructure providers, who store data on our behalf.
• Meta (Facebook/Instagram), in limited, privacy-protective form (hashed identifiers) to measure advertising — never your health answers. See [confirm wording with your adviser].

We use strictly-necessary cookies for sign-in and your basket. Where advertising measurement is enabled, the Meta Pixel sets cookies to attribute visits from Facebook and Instagram. You can clear or block cookies in your browser settings.

Order and dispensing records are kept for as long as pharmacy regulations require. Account data is kept while your account is active. You can ask us to delete your account at any time — some records must be retained by law even after deletion.

Under UK GDPR you can ask for a copy of your data, ask us to correct or delete it, object to or restrict processing, and ask for it in a portable format. Email us and we'll respond within one month. If you're unhappy with how we handle your data you can complain to the Information Commissioner's Office (ico.org.uk).

Questions? See our contact page.