Privacy Policy

1. Introduction

Concept Illustrated Limited ("we", "our", or "us") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our pharmacy delivery platform and related services (the "Service").

We are registered in England and Wales under company number [Company Number] and our registered office is at [Registered Address]. For the purposes of UK data protection legislation, we are the data controller.

2. Information We Collect

2.1 Personal Information

We may collect the following personal information:

• Identity Data: First name, last name, date of birth
• Contact Data: Email address, telephone number, postal address
• Professional Data: Pharmacy registration details, GPhC numbers, driving licence information
• Technical Data: IP address, browser type, device information, location data
• Usage Data: Information about how you use our Service
• Marketing Data: Your preferences for receiving marketing communications

2.2 Special Categories of Data

We may process health-related information when necessary for the delivery of pharmaceutical products, but only with your explicit consent and in accordance with applicable laws.

2.3 Cookies and Tracking

We use cookies and similar tracking technologies to enhance your experience. You can control cookie settings through your browser preferences.

3. How We Use Your Information

We process your personal data for the following purposes:

• Service Provision: To provide and maintain our delivery platform
• Account Management: To create and manage your account
• Order Processing: To process and fulfil delivery requests
• Communication: To send service-related notifications and updates
• Safety and Security: To verify identity and prevent fraud
• Legal Compliance: To comply with regulatory requirements
• Improvement: To analyse and improve our services

3.1 Legal Basis for Processing

We process your data based on:

• Contract: Performance of our service agreement with you
• Legal Obligation: Compliance with regulatory requirements
• Legitimate Interest: Business operations and service improvement
• Consent: Where explicitly provided for marketing or special categories

4. Data Sharing and Disclosure

We may share your information with:

• Service Providers: Third-party companies that help us operate our service
• Pharmacies and Drivers: To facilitate deliveries (limited information only)
• Regulatory Bodies: When required by law (e.g., MHRA, GPhC)
• Legal Authorities: When required by court order or legal process
• Business Transfers: In case of merger, acquisition, or sale of assets

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

5. Data Security

We implement appropriate technical and organisational measures to protect your data:

• Encryption of data in transit and at rest
• Regular security assessments and updates
• Access controls and authentication measures
• Staff training on data protection
• Incident response procedures

6. Data Retention

We retain your personal data only for as long as necessary:

• Account Data: Until account deletion plus 7 years for regulatory compliance
• Transaction Records: 7 years as required by UK tax and pharmaceutical regulations
• Marketing Data: Until you withdraw consent or 3 years of inactivity
• Technical Data: 2 years for security and service improvement

7. Your Rights

Under UK data protection law, you have the right to:

• Access: Request copies of your personal data
• Rectification: Request correction of inaccurate data
• Erasure: Request deletion of your data (subject to legal obligations)
• Restriction: Request limitation of processing
• Portability: Request transfer of your data
• Object: Object to processing based on legitimate interests
• Withdraw Consent: Withdraw consent for consent-based processing

To exercise these rights, please contact us using the details below. We will respond within one month.

8. International Transfers

We primarily process data within the UK. If we transfer data internationally, we ensure appropriate safeguards are in place, including adequacy decisions, standard contractual clauses, or other approved mechanisms.

9. Children's Privacy

Our Service is not intended for children under 18. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on our website and updating the "Last updated" date. Continued use of our Service after changes constitutes acceptance of the updated policy.

11. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us:

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe we have not handled your data appropriately. Visit ico.org.uk for more information.