Kiveton Pharmacy
Privacy notice
Kiveton Pharmacy – how we use your personal information Last updated: October 2026
1. Who we are
Kiveton Pharmacy is the trading name of OTC Direct Services Ltd. We are the "controller" of your personal information under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This means we decide how and why your information is used.
- Company number: 12239643 (registered in England and Wales)
- Registered office and pharmacy address: 7–8 The Square, Kiveton Park, Sheffield S26 5QN
- VAT number: GB373807574
- GPhC registered pharmacy number: 1102063
- NHS ODS code: FJG89
- ICO registration number: ZB343929
- Telephone: 01909 268 001
- Email: pharmacy.fjg89@nhs.net
Data Protection Officer (data protection lead) and Information Governance (IG) lead: Jawad Khan, Superintendent Pharmacist – pharmacy.fjg89@nhs.net, 01909 268 001, or in writing to the pharmacy address. Caldicott Guardian: Jawad Khan, Superintendent Pharmacist
This notice explains what information we collect, why, who we share it with, how long we keep it and what your rights are. It covers our NHS services, our private services and our website.
2. The information we collect
| Type | Examples |
|---|---|
| Identity and contact details | Name, date of birth, gender, address, phone number, email address, NHS number |
| Health information (special category data) | Medicines, prescriptions, allergies, medical history, consultation notes, vaccinations, test results, information from your GP or other clinicians, your Summary Care Record |
| Payment and booking details | Appointments, services booked, payments and refunds. Card details are handled by Square, and we do not see your full card number. |
| Representatives | Details of a carer, parent or representative who acts for you |
| Website and technical data | IP address, browser and device type, pages visited, cookies (see section 9) |
| Communications | Emails, phone notes, complaints and feedback |
We collect this information from you, from people acting for you, from your GP and other NHS organisations (for example through NHS Spine and electronic prescriptions), and from our website and booking systems.
3. Why we use your information and our legal basis
Under UK GDPR we must have a lawful basis (Article 6) for using personal information. For health information we also need a condition under Article 9.
| Purpose | Article 6 lawful basis | Article 9 condition (health data) |
|---|---|---|
| NHS services: dispensing NHS prescriptions (including electronic prescriptions), repeat prescriptions and delivery; Pharmacy First; NHS contraception; NHS vaccinations (such as flu and COVID-19); New Medicine Service (NMS); Discharge Medicines Service (DMS); other NHS-commissioned services | 6(1)(e) public task: providing NHS services we are commissioned to deliver | 9(2)(h) health or social care, with DPA 2018 Sch 1 Part 1 para 2 |
| Viewing your Summary Care Record / NHS Spine record when providing care | 6(1)(e) public task | 9(2)(h) health care |
| Claiming payment from the NHS (NHS Business Services Authority) and NHS reporting to NHS England | 6(1)(c) legal obligation / 6(1)(e) public task | 9(2)(h) health care; 9(2)(i) public health where relevant |
| Private services: travel health and travel vaccines, ear care and wax removal, weight management, vitamin B12 injections, other private consultations | 6(1)(b) contract | 9(2)(h) health care |
| Bookings and payments through Square | 6(1)(b) contract | 9(2)(h) where the booking reveals health information |
| Safeguarding patients | 6(1)(c) legal obligation / 6(1)(e) public task | 9(2)(h); 9(2)(g) substantial public interest (DPA 2018 Sch 1 para 18) |
| Clinical governance, audit, incident reporting and patient safety | 6(1)(e) public task / 6(1)(f) legitimate interests (private services) | 9(2)(h); 9(2)(i) public health |
| Meeting legal and regulatory duties (GPhC, MHRA, controlled drugs, HMRC, record keeping) | 6(1)(c) legal obligation | 9(2)(h); 9(2)(i); 9(2)(f) legal claims where relevant |
| Handling complaints and legal claims | 6(1)(c) legal obligation / 6(1)(f) legitimate interests | 9(2)(f) legal claims; 9(2)(h) |
| Running and securing our website | 6(1)(f) legitimate interests | Not applicable |
| Optional analytics cookies and marketing messages | 6(1)(a) consent. You can withdraw consent at any time. | We do not use health data for marketing |
We do not make decisions about you by automated means alone.
4. Confidentiality and the national data opt-out
Your health information is confidential. Only staff who need it to care for you, or to run the pharmacy, can access it, and all of them are bound by a duty of confidentiality. We follow the NHS Data Security and Protection Toolkit (DSPT) standards.
The national data opt-out lets you choose whether NHS bodies may use your confidential patient information for research and planning, rather than for your own care. We only use your confidential patient information for your individual care and for purposes required by law (such as NHS payment claims, safeguarding and regulatory duties). We do not use or share it for research or planning, so the national data opt-out does not apply to our current use of your information. If this changes, we will apply your opt-out choice as required. You can set or change your choice at www.nhs.uk/your-nhs-data-matters or by calling 0300 303 5678.
5. Who we share your information with
We share only what is needed, and only with:
- Your GP and other health professionals involved in your care, for example consultation outcomes from Pharmacy First, vaccinations, NMS, DMS or contraception, or hospitals that refer you to us.
- NHS England, NHS Business Services Authority and NHS systems, including the Electronic Prescription Service, NHS Spine and Summary Care Record, the National Immunisation Management Service and NHSmail. We share for payment, service records and reporting.
- NHS South Yorkshire Integrated Care Board (ICB) and the local authority, for services they commission and for contract monitoring.
- Our system suppliers, which process data on our behalf under contract: our pharmacy patient medication record (PMR) system Titan, provided by Invatech Health; NHS-approved clinical services platforms used to record NHS services; NHSmail and our IT providers; our website host Spire Hosting; and Google (website analytics and advertising measurement – see section 9).
- Square, for booking appointments and taking payments for private services.
- Delivery staff or couriers, when we deliver your medicines.
- Regulators and authorities when the law requires it, such as the GPhC, MHRA, CQC, police, courts or the ICO, and for safeguarding.
- Our professional advisers and insurers, for example where there is a claim or complaint.
We will never sell your information, and we do not share health information for marketing.
6. International transfers
Most of your information is kept in the UK. Some suppliers, such as Square and Google (Analytics, Ads and Fonts), may process data outside the UK. When this happens we make sure it is protected by one of the following:
- a UK "adequacy regulation", including the UK–US Data Bridge for certified US organisations, or
- the ICO's International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses.
Contact us for more details.
7. How long we keep your information
We keep records in line with the NHS Records Management Code of Practice 2023 and other legal requirements. Typical periods are:
| Record | Kept for |
|---|---|
| NHS prescriptions and dispensing records (including electronic prescription tokens) | 2 years from the date of dispensing |
| Controlled drugs registers | 2 years from the last entry (longer where the Code advises) |
| Private prescriptions and patient-specific records of supply | 2 years from supply (5 years for some controlled drugs) |
| Clinical service records (Pharmacy First, NMS, DMS, contraception, private consultations) and patient medication records | 8 years after last contact for adults; for children, until their 25th birthday (or 26th if they were 17 at the end of treatment), or 8 years after death |
| Vaccination records | 8 years after the vaccination for adults (children as above) |
| Payment and accounting records | 6 years plus the current year (HMRC) |
| Complaints | 10 years from closure |
| Website analytics data (Google Analytics) | 14 months |
| Patient Group Directions and SOPs, incident reports | Per the NHS Records Management Code of Practice 2023 |
After that, records are securely destroyed.
8. Your rights
Under UK GDPR you have the right to:
- access a copy of your information (a "subject access request"), usually free of charge, and answered within one month
- correct information that is wrong or incomplete
- erasure, although we usually cannot delete health records we are legally required to keep
- restrict how we use your information in some circumstances
- object to processing based on public task or legitimate interests, and to direct marketing at any time
- data portability, for information you gave us under contract or consent
- withdraw consent at any time where we rely on consent
To use any of these rights, contact us at pharmacy.fjg89@nhs.net, call 01909 268 001 or write to us at the pharmacy address. We may need to check your identity first.
9. Our website and cookies
Our website (kivetonpharmacy.com) is hosted by Spire Hosting in the UK and uses:
| Cookie or service | Provider | Purpose | Type | Lasts |
|---|---|---|---|---|
| WordPress, LiteSpeed cache, security and shop session cookies | Kiveton Pharmacy | Make the site work, keep it fast and secure | Essential (no consent needed) | Session or short-term |
| sbjs_* (WooCommerce order attribution) | Kiveton Pharmacy (WooCommerce) | Record how you arrived at the site | Analytics (consent) | Session |
| _ga, _ga_8NPK1W78G9 | Google Analytics 4 | Understand how visitors use the site | Analytics (consent) | Up to 13 months |
| _gcl_au, and Google Ads / DoubleClick cookies (e.g. test_cookie) | Google Ads (conversion linker and conversion tracking) | Measure whether our adverts lead to bookings | Advertising (consent) | Up to 90 days |
| Google Fonts | Display fonts (your IP address is sent to Google) | Functional | None set |
Analytics and advertising cookies are loaded through Google Tag Manager and are only set if you click "Accept". You can change your choice at any time with the "Cookie settings" link at the bottom of every page. When you book through Square, Square's own privacy notice also applies. Links to other websites are covered by those websites' own privacy policies. See also our Cookie Policy.
10. Keeping your information secure
We use NHSmail for clinical email, secure NHS systems, password and role-based access, staff training and confidentiality agreements, and we complete the NHS Data Security and Protection Toolkit every year. If there is a serious data breach, we will tell you and the ICO where the law requires it.
11. Complaints
If you are unhappy with how we have used your information, please contact our IG lead first using the details in section 1.
You also have the right to complain to the Information Commissioner's Office (ICO):
- Website: ico.org.uk/make-a-complaint
- Phone: 0303 123 1113
- Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
12. Changes to this notice
We review this notice regularly. The latest version is always on this page.