Privacy policy

What information we record

To deliver a professional and efficient service, we record information including:

• Basic personal details (name, address, date of birth, next of kin)
• Medicines prescribed by your doctor or another prescriber and supplied by us
• Over-the-counter medicines purchased from our pharmacy
• Notes about your health and medical treatment
• Information shared by other health professionals or carers involved in your care
• Records of any additional services we provide (e.g. flu vaccination)

How we use your information

We process your personal data for three purposes:

Your care — providing pharmacy services to you, and sharing relevant information with your GP and others in the NHS as needed.

Our payments — sharing appropriate information with the NHS Business Services Authority and others in the NHS for payment accuracy purposes.

Service management — sharing information with NHS England and relevant bodies to ensure we maintain professional standards and that all declarations are accurate.

We hold your information for as long as advised by the NHS, and process it in the public interest for the provision of healthcare.

Electronic prescriptions

We may ask whether you’d like to nominate our pharmacy to receive your electronic prescriptions. You can change or cancel your nomination at any time by speaking to a member of our team.

Our pharmacy professionals may also, with your consent, consult NHS Summary Care Records or local shared care records to support your care.

Your rights

You have the right to confidentiality under the UK GDPR, the Data Protection Act 2018, and the common law duty of confidence. We also comply with the NHS Code of Practice on Confidential Information. All staff contracts include a requirement to keep patient information confidential.

Your guiding principle from us: we hold your records in strict confidence.

Opting out of NHS data use

You can choose to opt out of the NHS using your data for planning and research purposes:

• Visit nhs.uk/yournhsdatamatters
• Use the NHS App
• Call NHS Digital: 0300 303 5678 (Monday–Friday, 9am–5pm)

Accessing your records

You have the right to request a copy of your pharmacy records (in paper or electronic format). There is generally no charge for this. We will respond to your request within one calendar month. To process your request, we’ll need:

• Your full name, address, and date of birth
• Valid photo ID (passport or full photocard driving licence)

If you believe any information we hold is inaccurate, please let us know and we will correct it.

Complaints & data protection

You may object to us holding your information, or make a complaint to:

Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

Data Protection Officer (DPO):
Ahmed Nizar Al-Liabi
Email: info@at-health.co.uk

AI website assistant

AT Health Ltd, company number 14519140, is the data controller for the AI assistant operated on the Wilmslow Pharmacy website. Ahmed Nizar Al-Liabi is the privacy contact and can be reached at info@at-health.co.uk.

The optional assistant provides general information about opening hours, locations, services, prices, booking routes and travel health. It is not a healthcare professional, cannot access pharmacy records or bookings, and must not be used for diagnosis, personalised medical advice, medicine-suitability decisions or emergencies.

Please do not enter your name, contact details, date of birth, NHS number, medical history, symptoms or medicines. Common direct identifiers are automatically removed before a question is sent through Supabase to Anthropic’s Claude API. Clinical or emergency wording is redirected to an appropriate human or NHS route. Automated safeguards cannot identify every possible disclosure.

For the normal assistant service, AT Health Ltd does not store the question or reply. It stores limited operational information for up to 30 days, including the website used, a random browser-session identifier, source page path without its query string, broad topic, controlled search-intent label, response outcome, prompt source, evidence version, feedback and selected booking or contact clicks. A separate secret-keyed network representation used only to prevent abuse is deleted after two days. Test traffic is excluded from content insights.

AT Health Ltd relies on its legitimate interests to provide, secure and improve the normal assistant and website using this minimised operational information. Detailed search-intent and destination labels are disclosed in improvement reports only after at least five distinct anonymous sessions share the same label. No chatbot information is used for advertising or joined to patient, booking or NHS records.

Visitors may separately choose to let AT Health Ltd retain an already-redacted question and reply for answer-quality review. The choice is optional: visitors are asked once when the assistant opens, nothing is retained unless they answer yes, and the answer can be changed at any time from the assistant window. Where the conversation reveals health information, this processing relies on the visitor’s explicit consent. Declining does not affect the normal assistant. Consented content is encrypted, restricted to authorised reviewers and automatically deleted after 30 days. Emergency and clinical-handoff conversations are never retained for QA.

An opted-in visitor receives an immediate deletion control and a private reference. The reference can be quoted when contacting info@at-health.co.uk so AT Health Ltd can locate and delete the stored conversation before its expiry. Withdrawal does not affect processing that occurred before withdrawal. Anonymous aggregate statistics that can no longer be linked to the conversation are not affected.

Supabase provides database and Edge Function infrastructure. Anthropic processes the redacted text to generate the answer. Under Anthropic’s standard commercial API terms, API inputs and outputs may be retained for up to 30 days for safety and service operation and are not used to train its models unless the customer explicitly opts in. AT Health Ltd does not authorise supplier training using these conversations.

Visitors may avoid AI processing by closing the assistant and contacting Wilmslow Pharmacy directly. Data-protection rights and the right to complain to the Information Commissioner’s Office are described elsewhere in this policy.