Privacy Policy

Medishare Group (MEDISHARE HS LTD)

Last updated: 21 July 2026

1. About this policy

MEDISHARE HS LTD, trading as Medishare Group, owns and operates a group of community pharmacies in England. This policy explains how we collect, use, share and protect your personal information across our pharmacies, this website, and our online booking and enquiry forms.

We take your privacy seriously. As a healthcare provider, much of the information we hold about you is sensitive, and we handle it in line with UK data protection law and NHS confidentiality standards.

2. Who we are

MEDISHARE HS LTD is the data controller for the personal information described in this policy, including information collected at any of our pharmacies.

Registered company name: MEDISHARE HS LTD
Company registration number: 12440754

How to contact us about your data:
Email: headoffice@medisharegroup.com
Post: 12 Old Bexley Lane, Bexley, DA5 2BN

Data Protection Officer / Information Governance Lead: Matthew Clent
Email: matthew@medisharegroup.com

Medishare Group operates community pharmacies in England, including Hayshine Pharmacy in Welling. This policy applies across all of our pharmacies.

Each of our pharmacies is registered with the General Pharmaceutical Council (GPhC). Our Superintendent Pharmacist is Matthew Clent.

3. Information we collect

Information you give us

When you contact us, book an appointment, or use our services, we may collect:

Your name, date of birth and gender
Contact details including address, telephone number, mobile number and email address
Your NHS number
Your GP practice details
Details of the service or appointment you are requesting
Which of our pharmacies you would prefer to visit
Payment details for private services
Any other information you choose to provide

Health information

To provide pharmacy services safely we may collect and record:

Your medical history and current health conditions
Medicines you are taking, including prescriptions dispensed to you
Allergies and adverse reactions
Details of consultations, treatments and vaccinations provided
Results of tests or screening we carry out
Notes made by our pharmacists and healthcare staff

This is known as special category data under UK data protection law and is subject to additional protections.

Information we receive from others

We may receive information about you from:

Your GP practice or other NHS organisations
NHS Spine services, including looking up your NHS number where you have not provided it
Your Summary Care Record, where you have not opted out and where access is clinically necessary
NHS prescription services and the NHS Business Services Authority
Other healthcare professionals involved in your care

Information collected automatically

When you visit our website we may collect technical information including your IP address, browser type, device type, pages viewed and how you arrived at the site. See section 11 for information about cookies.

4. Why we use your information and our lawful basis

Under UK GDPR we must have a lawful basis for using your personal data, and an additional condition for using health data.

What we use it for / Lawful basis (Article 6) / Condition for health data (Article 9)

Providing pharmacy services, dispensing and clinical care / Legitimate interests / public task / Provision of health care and treatment
Managing appointments and booking requests / Legitimate interests / Provision of health care and treatment
Meeting our legal and regulatory obligations / Legal obligation / Reasons of public interest in public health / legal claims
Managing payments for private services / Contract / Not applicable
Responding to enquiries and complaints / Legitimate interests / Provision of health care / legal claims
Improving our services and training staff / Legitimate interests / Provision of health care and management of health services
Sending marketing communications / Consent / Not applicable

Where we rely on consent, you can withdraw it at any time. Withdrawing consent for marketing will not affect the care you receive.

5. Confidentiality

In addition to data protection law, our healthcare staff owe you a duty of confidence under the common law duty of confidentiality and their professional codes of conduct. We will not share your health information outside your care team without a lawful reason to do so.

6. Sharing between our pharmacies

Because our pharmacies are part of the same organisation, your records may be accessible to staff at more than one of our sites. This means you can be served at any of our pharmacies without having to repeat your information.

Access is limited to staff who need it to provide your care, and is controlled and logged. If you would prefer your records were not accessible across sites, contact us and we will discuss what is possible.

7. Who else we share your information with

We may share your information with:

Your GP practice and other NHS bodies, where necessary for your care
NHS England, NHS Business Services Authority and integrated care boards, for the administration and payment of NHS services
Other healthcare professionals directly involved in your treatment
Regulators including the General Pharmaceutical Council, where required
Our IT and service suppliers, who process data on our behalf under written contracts
Law enforcement, courts or public authorities, where we are legally required to disclose

We do not sell your personal information to anyone.

Our suppliers

We use third party providers to run our website and services. These currently include:

Black Tiger Creative Ltd, website hosting and development
Google Workspace, email, document storage and spreadsheets
Elementor, website forms
Make (Celonis SE), automation of form submissions

Each supplier acts as a data processor and may only use your data on our instructions.

8. Where your data is held

We aim to hold your data within the UK or European Economic Area wherever possible. Where a supplier processes data outside the UK, we ensure appropriate safeguards are in place, such as UK International Data Transfer Agreements, the UK Addendum to the EU Standard Contractual Clauses, or an adequacy decision.

You can ask us for more detail about any specific transfer.

9. How long we keep your information

We only keep your information for as long as we need it.

Health and pharmacy records are retained in line with the NHS Records Management Code of Practice and relevant pharmacy guidance, which set the standard retention periods for records of this kind.

Website enquiries and booking requests are kept for 12 months. Marketing contact details are kept until you ask us to stop. Financial and accounting records are kept for 6 years, as required by HMRC.

When a retention period ends, we securely delete or destroy the information.

10. Marketing

We will only send you marketing communications where you have given us clear consent to do so.

You can withdraw your consent at any time by emailing headoffice@medisharegroup.com, or by using the unsubscribe link in any marketing email we send you.

We will never make your consent to marketing a condition of receiving healthcare from us.

11. Cookies

Our website uses cookies and similar technologies. Some are strictly necessary for the site to work. Others help us understand how the site is used, or support advertising.

We only set non-essential cookies where you have given consent through our cookie banner.

12. Your rights

Under UK data protection law you have the right to:

Be informed about how we use your data, which is the purpose of this policy
Access a copy of the personal data we hold about you, known as a subject access request
Rectification of inaccurate or incomplete data
Erasure of your data in certain circumstances, though this is limited where we have a legal duty to retain health records
Restrict processing in certain circumstances
Object to processing based on legitimate interests, and to direct marketing at any time
Data portability for data you provided to us electronically
Withdraw consent where we rely on it

To exercise any of these rights, contact us at matthew@medisharegroup.com or write to us at the address in section 2. We will respond within one month. There is normally no charge.

We may ask you to verify your identity before we release information, to protect your privacy.

National data opt-out

You can choose whether your confidential patient information is used for research and planning purposes. This is called the national data opt-out. It does not affect your direct care. You can find out more and set your choice at nhs.uk/your-nhs-data-matters.

13. How we protect your information

We use appropriate technical and organisational measures to keep your data secure, including access controls, encryption, staff training and confidentiality agreements. We complete the NHS Data Security and Protection Toolkit annually.

If a data breach occurs that is likely to result in a risk to your rights and freedoms, we will report it to the Information Commissioner’s Office within 72 hours and, where the risk is high, notify you directly.

14. Children’s information

Where we provide services to anyone under 18, we handle their information with the same care and in line with the same principles. Where a young person is assessed as competent to make their own decisions, we will respect their confidentiality.

15. Complaints

If you are unhappy with how we have handled your personal information, please contact us first at matthew@medisharegroup.com so we can try to put things right.

You also have the right to complain to the Information Commissioner’s Office:

Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Telephone: 0303 123 1113
Website: ico.org.uk

16. Changes to this policy

We may update this policy from time to time. Any changes will be posted on this page with a revised date at the top. Where changes are significant, we will make this clear on our website.