Privacy Policy
Last updated: 2026-07-20 · Version 2026.07.20
Doctortosity Ltd, trading as MyPharmHub, a company registered in England and Wales, (company number 17224634) ("we", "us") operates the MyPharmHub platform ("Platform") used by community pharmacies to manage appointments, clinical records, retail operations, and related workflows. This Privacy Policy explains how we process personal data.
1. Who we are
Doctortosity Ltd, trading as MyPharmHub, a company registered in England and Wales, (company number 17224634) ("we", "us") operates the MyPharmHub Platform used by GPhC-registered pharmacies and their authorised staff. Our registered company name is Doctortosity Ltd; we trade as MyPharmHub.
Our Data Protection Officer can be reached at dpo@mypharmhub.com.
2. Our role (controller vs processor)
For pharmacy staff account, billing, security, and product improvement data, we act as a controller.
For patient health and appointment data entered into the Platform for a pharmacy's services, the pharmacy is the controller and we act as a processor under our Data Processing Agreement.
If you are a patient, please contact the pharmacy that treated or booked you for most access, correction, or erasure requests about your clinical records.
3. What data we collect
We may process:
- Account data: name, email, phone, GPhC number (where provided), organisation details, and billing details collected at signup or in-app.
- Patient data (as processor): name, date of birth, NHS number, contact details, appointment history, clinical notes, medication records, triage answers, and clinical photos uploaded for consultations.
- Usage and technical data: page views, session events, device/browser metadata, and error reports sent to Sentry when error monitoring is allowed (see our cookies policy). Performance measurement via Vercel Speed Insights runs only with analytics consent.
- Payment metadata: Stripe customer and Connect identifiers, subscription status, and transaction references (card details are handled by Stripe).
4. Legal basis
We process personal data under UK GDPR on the basis of: contract performance (pharmacy subscription and Platform access); legitimate interests (security, fraud prevention, product improvement — balanced against your rights); legal obligation; and consent where required (for example certain cookies or marketing).
Special-category Patient Data is processed by us as processor under the pharmacy's instructions and lawful basis (typically provision of health care and associated conditions under UK GDPR Article 9 / DPA 2018 Schedule 1).
5. Data retention
Account data is retained for the duration of the subscription plus 12 months, unless a longer period is required for disputes, accounting, or legal compliance.
Patient data is retained for 8 years in line with NHS record retention guidance, unless the pharmacy (as controller) instructs earlier deletion or a longer period is required by law.
6. Your rights
You have the right to access, rectify, or erase personal data, to restrict or object to certain processing, and to data portability where applicable. Submit controller-scope requests to privacy@mypharmhub.com.
You may complain to the Information Commissioner's Office (ICO). We would appreciate the chance to resolve concerns first.
8. International transfers
Where personal data is transferred outside the UK, we use appropriate safeguards under UK GDPR.
10. Changes
We may update this Privacy Policy from time to time. The version and last-updated date appear at the top of this document. Material changes will be notified to account administrators where appropriate.
11. Contact
Privacy: privacy@mypharmhub.com. DPO: dpo@mypharmhub.com. Legal: legal@mypharmhub.com.
For questions, contact privacy@mypharmhub.com.