Privacy Policy

1. Introduction

RxSure (“we,” “our,” or “us”) is committed to protecting your privacy. This policy explains how we collect, use, disclose, and safeguard your information when you use our pharmacy compliance and private services platform.

RxSure is registered in the United Kingdom and complies with UK GDPR and the Data Protection Act 2018. This policy is accessible on all devices. Printed copies or alternative formats available on request by contacting contact@rxsure.co.uk.

2. Data Controller

3. Our Role: Data Controller & Data Processor

RxSure operates in two capacities depending on the nature of the data being processed:

• Data Controller: For information collected directly from pharmacies, practitioners, and website visitors including account details, billing, and technical data.
• Data Processor: For patient data entered by pharmacies and practitioners during consultations, bookings, and clinical records. The pharmacy or practitioner remains the Data Controller for patient data.

All pharmacies and practitioners must have a Data Processing Agreement (DPA) in place.

3.1 NHS Services: Controller/Processor Roles

• Data Controllers: Individual pharmacy organisations using RxSure for NHS services
• Data Processor: QASTCO LIMITED (trading as RxSure) acts as the data processor
• NHS England: Acts as data controller for NHS services (PDS, MESH, CIS2, ODS)

QASTCO LIMITED also acts as data controller for operational data.

4. Information We Collect

4.1 Personal Information

• Name, email address, and phone number
• Business information
• GPhC registration number
• Professional credentials
• Payment and billing information
• Login credentials

4.2 Patient Data (Processed on Behalf of Pharmacies)

• Patient names and contact details
• Medical history
• Health information
• Clinical service details
• Consultation records
• Consent forms

4.3 Technical Data

• IP address
• Browser type and version
• Device information
• Usage patterns

5. NHS Services Integration

RxSure integrates with the following NHS services to deliver pharmacy clinical services:

• Personal Demographics Service (PDS): Patient demographics (name, date of birth, address, NHS number, registered GP). Used to verify patient identity and auto-populate consultation forms. Accessed in Healthcare Worker mode via CIS2.
• Care Identity Service 2 (CIS2): The national identity service for health and care. Verifies registered healthcare professional status.
• MESH: Secure messaging service for consultation outcomes, clinical documents, and referrals to GPs.
• Organisation Data Service (ODS): Healthcare organisation lookups.
• NHS Spine: The national messaging backbone.
• GP Connect: Structured consultation record sharing.
• FHIR APIs: HL7 FHIR standards for structured data exchange.

5.1 NHS Number Processing

NHS numbers are retrieved from PDS for patient identification and NHS service integration only. They are stored securely alongside consultation records.

5.2 Data Sources

• NHS PDS: Patient demographics
• NHS ODS: Organisation details

Data is used solely for delivering pharmacy clinical services.

6. How We Use Your Information

• Provide and maintain our services
• Process transactions
• Facilitate GPhC compliance
• Generate audit trails
• Send administrative information
• Respond to inquiries
• Improve our services
• Comply with legal obligations

7. Legal Basis for Processing

• Contract Performance: Processing necessary for the performance of a contract to which the data subject is party.
• Legal Obligation: Processing necessary for compliance with a legal obligation.
• Legitimate Interests: Processing necessary for the purposes of the legitimate interests pursued by the controller.
• Consent: The data subject has given consent to the processing of their personal data.

7.1 Special Category Data (Health Data)

• Article 9(2)(h): Processing is necessary for the purposes of preventive or occupational medicine, medical diagnosis, the provision of health or social care or treatment, or the management of health or social care systems and services.
• Schedule 1, Part 1, Paragraph 2 of the Data Protection Act 2018: Health or social care purposes.

7.2 NHS Pharmacy Services: Legal Basis

• GDPR Article 6(1)(e): Processing necessary for the performance of a task carried out in the public interest (NHS pharmacy services).
• GDPR Article 9(2)(h): Processing of health data necessary for the provision of health care under the responsibility of a professional subject to professional secrecy.
• Data Protection Act 2018, Schedule 1, Part 1, Condition 2: Health or social care purposes.

8. Data Sharing

We may share your information with:

• Service Providers: Third-party companies that perform services on our behalf.
• Regulatory Bodies: Such as the GPhC and CQC, where required by law.
• Professional Advisers: Including lawyers, auditors, and insurers.
• Business Partners: With your consent.

We do not sell your personal data.

8.1 Data Sharing with NHS Systems

• PDS: Patient demographics
• MESH: Consultation outcomes sent to GPs
• GP Practices: Structured consultation records

All data sharing with NHS systems occurs over encrypted connections.

9. Data Storage & International Transfers

Your data is stored in the United Kingdom. If an international transfer is required, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs)
• UK International Data Transfer Agreement (UK IDTA)
• Adequacy decisions

10. Data Retention

At the end of the applicable retention period, data is securely deleted or anonymised. Anonymised aggregate data may be retained indefinitely.

11. Your Rights

Under UK GDPR, you have the following rights:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure: Request deletion of your personal data where there is no compelling reason for its continued processing.
• Right to Restriction: Request that we restrict the processing of your personal data.
• Right to Data Portability: Request a copy of your data in a structured, commonly used, machine-readable format.
• Right to Object: Object to the processing of your personal data.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, contact contact@rxsure.co.uk.

12. Data Security

Certifications:

• Cyber Essentials certified
• NHS DSPT compliant
• DCB0129 compliant

Security measures include:

• Encryption in transit (TLS/SSL) and at rest
• Regular security assessments
• Access controls and role-based permissions
• Employee training on data protection
• Incident response procedures

13. Data Breach Notification

In the event of a personal data breach, we will:

• Notify the ICO within 72 hours where feasible (Article 33)
• Notify the data controller without undue delay where we act as data processor
• Notify affected individuals where the breach is likely to result in a high risk to their rights and freedoms (Article 34)

14. Sub-Processors

We use the following sub-processors to deliver our services:

Important: Marketing trackers (Meta, TikTok, Google Analytics) operate only on the public website and are consent-gated via our cookie consent mechanism. They are not present on clinical portals.

15. Caldicott Principles

We adhere to the eight Caldicott Principles:

1. Justify the purpose(s): Every proposed use or transfer of personal confidential data must be clearly defined, scrutinised, and documented.
2. Don’t use personal confidential data unless it is absolutely necessary: Personal confidential data should not be included unless it is essential for the specified purpose.
3. Use the minimum necessary personal confidential data: Where use of personal confidential data is considered essential, the inclusion of each individual item should be considered and justified.
4. Access to personal confidential data should be on a strict need-to-know basis: Only those individuals who need access to personal confidential data should have access, and they should only have access to the data items they need.
5. Everyone with access to personal confidential data should be aware of their responsibilities: Action should be taken to ensure that those handling personal confidential data are made fully aware of their responsibilities and obligations.
6. Comply with the law: Every use of personal confidential data must be lawful.
7. The duty to share information is as important as the duty to protect patient confidentiality: Health and social care professionals should have the confidence to share information in the best interests of their patients.
8. Inform patients and service users about how their confidential information is used: A range of steps should be taken to ensure no surprises for patients and service users.

16. Data Protection Impact Assessment

A Data Protection Impact Assessment (DPIA) has been conducted in accordance with Article 35 of UK GDPR. The DPIA is reviewed whenever significant changes are made to data processing activities. A summary of the DPIA is available upon request.

17. Automated Decision-Making & AI

The RxSure AI Consultation Assistant is a clinical decision support tool only. It does not make legally binding automated decisions without human involvement.

17.1 Legal Basis for AI Processing

• Article 6(1)(b): Processing necessary for the performance of a contract.
• Article 9(2)(h): Processing of health data for the provision of health care, with Schedule 1, Part 1, Paragraph 2 of the Data Protection Act 2018.

17.2 Right to Human Review

In compliance with Article 22, all AI-generated outputs are subject to review by a qualified healthcare professional before any clinical decision is made. You have the right to request human review of any AI-assisted decision. Contact dpo@qastco.com to exercise this right.

17.3 Anonymised Data for AI Improvement

No personally identifiable data is used for AI model training. Only fully anonymised, aggregated data may be used to improve the AI consultation assistant. You may opt out of anonymised data usage by contacting us.

18. Clinical Safety & Intended Use

RxSure is a practice management and clinical workflow support tool. It is not a medical device. All clinical decisions remain the responsibility of the qualified healthcare professional using the platform.

Clinical Safety Officer: Navid-Ul-Khurram Kaleem (GPhC: 2064676)

19. Cookies

For information about how we use cookies, please see section 15 above or contact contact@rxsure.co.uk.

20. Children’s Privacy

Our platform is designed for healthcare professionals and is not intended for use by individuals under the age of 18.

21. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified by posting the updated policy on our website and updating the “Last Updated” date at the top of this page.

22. Complaints

If you have concerns about how we handle your personal data, please contact us first. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO):

• Website: ico.org.uk
• Phone: 0303 123 1113

23. Contact Us