Who we are
Miles Pharmacy & Travel Clinic is a registered pharmacy at 94 Chessington Rd, Ewell, Epsom, Surrey, KT19 9UR. We are the data controller for the personal information described in this notice: we decide what is collected and why.
The pharmacy is registered with the General Pharmaceutical Council, premises number 9011598.
We have not appointed a Data Protection Officer, because the law does not require one for a pharmacy of our size. Questions about this notice go to the pharmacy directly, by the ways given at the end.
The booking system we use
Appointments on this website are taken through Booked, an appointment system provided by trybooked.co. We use it rather than build our own, and it is worth knowing by name.
When you book, Booked holds your name, your contact details, the service and time you chose, your answers to any screening questions and any document you upload, on our behalf. It sends your confirmation and your reminders by email and by text message, and the sign-in link for My bookings, so the messages you receive will carry its name rather than ours.
Booked acts as our data processor: it handles this information on our instructions, for the purpose of your appointment, and we remain responsible for it. Card payments made when you book go to Stripe, and Booked never sees your card details.
If you are unsure whether a message about an appointment is genuine, it will come from Booked or from us, and you can always check by calling 020 8393 1000.
What we collect, and when
We collect only what each thing needs. Most of it you give us yourself, and most of it is held for us by Booked, the booking system described above.
- Booking an appointment
- Your first and last name, email address and phone number, the service and the time you chose, and who the appointment is for if you book for somebody else or for a family. Some services ask screening questions before the appointment, and the answers are health information. A few ask you to upload a document, such as photo identification, where the service requires it.
- At the appointment
- What the pharmacist records about your care: your history where it matters to the service, what was given or supplied, the batch and date of a vaccine, and any advice. For NHS services, the record the NHS requires.
- Paying online
- Whether a payment was made and for how much. Card details are entered into a form provided by Stripe, our payment processor, and never reach our website or our systems.
- Signing in to My bookings
- Your email address, to send you a sign-in link. The link comes from Booked, the appointment system, and no password is stored because none is used.
- Contacting us
- What you tell us by phone, email or at the counter, and how to reach you back.
- Using the website
- What the cookie banner records of your choice, described in the cookie policy. The website itself sets no analytics or advertising cookies.
Why we use it, and the lawful basis
UK data protection law requires a reason for each use. Ours are these.
- To provide your appointment
- Your details, your choice of service and your answers to screening questions, so that we can give you the care you booked. Basis: performing our contract with you, and, for health information, the provision of health care by a registered professional (Article 9(2)(h) UK GDPR).
- To keep pharmacy records
- Pharmacists must keep records of what they supply and administer. Basis: a legal obligation, under medicines law and the standards of the General Pharmaceutical Council.
- To provide NHS services
- Pharmacy First consultations, NHS vaccinations and other NHS services are recorded and reported as the NHS requires, and your GP is informed. Basis: a public task carried out under our NHS contract, and the provision of health care.
- To take payment
- Basis: performing our contract with you.
- To remind and confirm
- Appointment confirmations, reminders and changes, by email and by text message. These are part of the booking, not marketing. Basis: performing our contract with you.
- To answer a complaint or a request
- Basis: a legal obligation, and our legitimate interest in running the pharmacy properly.
- To keep the website working
- Strictly necessary cookies, described in the cookie policy. Basis: our legitimate interest in a working site, which the law allows without consent for cookies that are strictly necessary.
We do not send marketing. If that ever changes, we will ask for your consent first, and you will be able to withdraw it as easily as you gave it.
We do not make decisions about you by automated means. The questions the booking form asks are used only to route you to the right service or to ask you to call us; a pharmacist makes every decision about your care.
How long we keep it
- Pharmacy and NHS records
- For as long as the law and professional guidance require pharmacy records to be kept, which for a record of care is measured in years rather than months. The periods are set by the NHS Records Management Code of Practice and by medicines law, not by us.
- Bookings and your account
- Your appointment history stays in the booking system so that it can be shown to you under My bookings and so that a question about a past visit can be answered. Screening answers and uploaded documents are kept with the appointment they belong to.
- Payment records
- Six years after the end of the financial year, as tax law requires.
- Cookie consent
- The record of your cookie choice is kept for 24 months, and your choice itself is asked again after 6 months.
- Correspondence
- For as long as needed to deal with the matter, and to show how it was dealt with.
Your rights
You have the right to:
- ask for a copy of the personal information we hold about you
- ask us to correct anything that is wrong or incomplete
- ask us to delete information, where we have no lawful reason to keep it - a pharmacy record cannot be deleted while the law requires it to be kept
- ask us to limit how we use information while a question about it is settled
- object to a use that rests on our legitimate interests
- receive the information you gave us in a form you can take elsewhere, where our use rests on your consent or a contract
- withdraw a consent you have given, at any time
To use any of these, contact the pharmacy by the ways given at the end of this notice. We will answer within one month, and we may ask you to prove who you are first, because we must not hand a health record to the wrong person.
If you are unhappy with how we have handled your information, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would ask that you raise it with us first, so that we can put it right.
Children
Appointments for anyone under 18 are booked by a parent or guardian, who gives the details and attends. The information is held in the same way as an adult's, and the child's own rights over it grow with them.
How we protect it
The website and the booking system are served over an encrypted connection. Sign-in to My bookings is by a one-time link sent to your email address, so there is no password to steal. Records at the pharmacy are held under the General Pharmaceutical Council's standards for confidentiality, and only staff who need them to care for you see them.
Changes to this notice
We will update this notice when what we do changes - a new service, a new supplier, or a new way of using the website. The date at the top is the date of the current version.