This notice explains how Superpharm (“we”, “us”, “our”) collects and uses personal data when you visit superpharm.io, ask us for access or a quote, or use Superpharm through your pharmacy. It follows UK data protection law: the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Who we are
Superpharm is a compliance and operations workspace for UK community pharmacies.
To ask about this notice or use your rights, use our contact page.
Our role and your pharmacy’s
Pharmacy groups use Superpharm to keep their registers, logs, documents and staff records. For those records, including the staff accounts in a pharmacy’s workspace, the pharmacy group is the controller: it decides what is recorded and why. We process that data on the pharmacy’s behalf, on its instructions and under our agreement with it.
If you work at a pharmacy that uses Superpharm and have a question about the records it keeps, ask your pharmacy first. We will help it answer.
We are the controller for the personal data we use to run our own business: this website, enquiries and access requests, and our dealings with our customers.
What we collect
When you visit this website
This website sets no cookies and uses no analytics or advertising tools. Like any website, our hosting provider processes technical information when a page is requested, such as your IP address, your browser and the page you asked for, to deliver the site and keep it secure. Our cookie notice has the details.
When you ask for access or a quote
The request form at app.superpharm.io asks for your pharmacy or group’s name, your name and email address, and the number of pharmacies, and optionally for your phone number, your role, a postcode and a message. We use it to reply to you, to send you a quote and, if you go ahead, to set up your account. Our servers also process technical information, such as your IP address, to protect the form from abuse.
Please do not include patient details in your message.
When you use Superpharm through your pharmacy
To provide the service, we process for your pharmacy:
- account details: your name, your work email address (if you have one), your roles, the branches you work at and, for pharmacists, your GPhC registration number;
- sign-in details: your password and PIN, stored only as one-way hashes; when you sign in and on which device; and, on a kiosk with a geofence, the device’s location at sign-in, to check it is on the premises;
- the records you and your colleagues keep, with who created or changed each one and when (an audit trail);
- information about patients that your pharmacy records, for example in the controlled drugs register or an incident report.
Why we use it and our lawful bases
- Replying to enquiries and access requests, and sending quotes. Our lawful basis: our legitimate interest in answering people who contact us, and taking steps at your request before a contract.
- Setting up and providing Superpharm to our customers. Our lawful basis: performing our contract with the pharmacy group. For the records we hold for a pharmacy, we act on its instructions as its processor.
- Keeping the website and the service secure, and preventing misuse. Our lawful basis: our legitimate interest in protecting our customers, their records and our systems.
- Keeping business and accounting records. Our lawful basis: complying with our legal obligations.
Health information in a pharmacy’s records is special category data. The pharmacy, as controller, decides the conditions it relies on (for example, the provision of health care), and we process it only on its instructions.
Who we share it with
We use service providers to run Superpharm. They process personal data only on our instructions and under contracts that protect it:
- website hosting: Vercel;
- application hosting, database and file storage: Railway;
- email delivery: the provider that sends our emails, such as sign-in links and notifications.
We may also share personal data with our professional advisers, or with a regulator, court or the police when the law requires it. We do not sell personal data or use it for advertising.
Transfers outside the UK
Some of our providers are based, or keep data, outside the UK, for example in the United States or the European Economic Area. When personal data leaves the UK, we rely on UK adequacy regulations (including the UK extension to the EU–US Data Privacy Framework, where the provider is certified) or on the International Data Transfer Addendum to the European Commission’s standard contractual clauses.
How long we keep it
- Enquiries and access requests that do not lead to an account: up to two years after we last heard from you, then deleted.
- A pharmacy’s records: for as long as the pharmacy uses Superpharm and as our agreement with it and the law require. Some pharmacy records must be kept for a minimum period; for example, the Responsible Pharmacist register for five years, and the controlled drugs register for two years from its last entry.
- Technical and security logs: for a short period, then deleted.
How we protect it
Each pharmacy group’s records are kept separate by the database itself, registers cannot be edited in place or deleted, every change is recorded, and everything is encrypted in transit. Our security page explains more.
Your rights
You have the right to:
- ask for a copy of your personal data;
- ask us to correct it if it is wrong or incomplete;
- ask us to delete it, or to restrict how we use it, in some circumstances;
- object to how we use it when we rely on our legitimate interests;
- ask for data you gave us in a format you can take elsewhere, in some circumstances.
To use any of these rights, use our contact page.
We reply within one month. For records a pharmacy keeps in Superpharm, your request is best made to the pharmacy, as the controller; if you contact us, we will pass it on and help the pharmacy respond. Some records cannot be deleted while the law requires the pharmacy to keep them.
Complaints
If you are unhappy with how we use your data, please tell us first so we can try to put it right. You can also complain to the Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113.
Changes to this notice
We will update this page when our practices change, and change the date at the top.