Privacy notice

Our Privacy Notice describes the categories of personal data we process and for what purposes.

At Well we know that your personal data is important to you. That’s why, whenever we process it, we only use what we need to, and we do everything we can to ensure it is appropriately protected. This notice explains the situations where we may process your personal data and the steps we take to protect it.

• Well uses your personal information to provide pharmacy, healthcare, retail and customer services to you. This may include dispensing prescriptions, managing appointments or bookings, providing clinical services, delivering medicines or products, responding to queries or complaints, and supporting your ongoing care.
• We may also use your information to keep you informed about important service updates, patient safety matters, issues affecting your local pharmacy, or services that may be relevant to you. Where permitted, we may also contact you about products, offers or healthcare services that may be of interest.
• We use personal information to help us run our business safely and effectively. This includes keeping accurate records, meeting legal and regulatory obligations, managing quality and safety, improving our services, protecting our systems, and understanding how patients and customers use our services.
• We will only use your personal information where we have a lawful reason to do so. We take our responsibilities for protecting personal information extremely seriously. Maintaining the privacy, confidentiality and security of the information entrusted to us is fundamental to the way we operate.

Please be aware that we will never call or message you for payment related to medication or services. You should remain vigilant if you are suspicious about someone who has contacted you. You can find out more about protecting yourself online here.

Well keeps its privacy policy under regular review and we may make changes to this notice at any time. Depending on the associated processing risks, we will either contact you with the modified terms, or we will post a copy of these on our website. Please ensure you regularly check our website for any updated use of your personal data, alongside contact information in the event you have any further queries.

Well and Well Pharmacy are the trading names for the companies Bestway National Chemists Ltd (company number 09225457, registered address: Merchants Warehouse, 21 Castle Street, Castlefield, Manchester, M3 4LZ) and Bestway Belfast Chemists Ltd (company number NI626625, registered address: 70 Ballygomartin Road, Belfast, BT13 3NE). When we say ‘we’ or ‘us’ we mean these companies.

These companies are part of the wider Bestway Healthcare Group of companies. When we say ‘Group’ in this notice, we mean other members of our group of companies, including trading and subsidiary companies of Bestway Panacea Holdings Ltd (an English and Welsh registered company with company number 09225479, registered address: Merchants Warehouse, 21 Castle Street, Castlefield, Manchester, M3 4LZ).

The personal information we collect and how we use it will depend on the way you interact with us and the services you use.

There are six lawful bases Well may use to process your personal data:

• Consent: where you have given explicit permission.
• Contract: where we use your personal data to fulfil a contract we have with you.
• Legal obligation: where we use your personal data to comply with a common law or statutory obligation.
• Vital interests: where we use your personal data to protect your life.
• Public task: where there is a public interest in using your personal data.
• Legitimate interests: where we balance our interest in using your personal data against any impact it will have on you. You can find out more about this in the section ‘legitimate interests’.

To put the above lawful bases into context, the following table identifies the core ways we legally use your information at Well, though this list is not exhaustive.

Well Pharmacy may utilise Artificial Intelligence (“AI”) assisted technologies to support certain administrative and operational activities. No personal data is entered into AI systems or used to train third-party AI models.

Any outputs generated through AI-assisted technologies are reviewed and assessed by appropriately authorised staff before any action is taken. AI tools are used solely to support decision-making and do not make decisions independently.

Legitimate interests is a legal basis by which Well may use your personal data in a way that you are likely to expect, and that will have a minimal privacy impact on you. In practice, this means assessing our ‘legitimate interests’ in using your personal data, against any impact this might have on your privacy.

We always think carefully about using your personal data and will complete a ‘legitimate interests’ assessment’ to ensure we have measured any impact on you, versus what we are trying to achieve as a business.

There are three elements to a legitimate interests’ test:

• Purpose test: what legitimate interest are we pursuing as a business?
• Necessity test: is the use of your personal data necessary for our purpose?
• Balancing test: do your interests override our legitimate interest – i.e. would you expect us to use your data this way?

Your privacy is always at the forefront of any decision made during our assessment and we will look at alternative ways we can pursue our legitimate interests without using your personal data – for example, by anonymising this data.

Please find some examples of where we might use legitimate interests when using your personal data:

• contacting you about a booking, appointment or service that you have requested;
• informing you about changes to opening hours, temporary closures or other issues affecting your local pharmacy;
• contacting you regarding patient safety matters, including medicine recalls, dispensing issues or other matters that may affect your care;
• requesting feedback about products or services you have received; and
• informing you about upcoming vaccination programmes, pharmacy services, health campaigns, or other important public health information that may be relevant to you.

In some circumstances, particularly where communications relate to the protection of public health, patient safety, or the delivery of NHS and other healthcare services, we may also rely on another lawful basis, including the public interest lawful basis, where applicable.

You can find more information about the six lawful bases organisations can rely on when using your personal data by visiting the Information Commissioner’s website here.

Special category data is personal data that might be more sensitive to you. This includes things like health information, ethnicity, religious beliefs, and sexual orientation. Well needs to use special category data to provide things like prescriptions and services in pharmacies, which we wouldn’t be able to do without using this data.

Examples of the special category data we may use include:

• Information contained within prescriptions and medication records.
• Details about medical conditions, symptoms, diagnoses, allergies and treatments.
• Information recorded during consultations, vaccinations, health checks and clinical services.
• Information obtained from NHS systems, such as your Summary Care Record, where you have provided appropriate consent and it is clinically necessary.
• Information relating to safeguarding concerns.
• Information that may reveal ethnic origin where this is relevant to the provision of healthcare services.
• Information relating to disabilities, accessibility requirements, or additional support needs.

Wherever this data is used, there are additional legal safeguards we must adhere to, which include:

• Establishing a legal basis to use this information, as well as an additional condition for our use.
• Depending on the condition selected to use this data, we may also be required to establish a further condition for use.
• Adhering to a specific ‘Appropriate Policy Document’, which governs our compliance.
• Completing a data protection impact assessment to measure any risks to you as a result of the use of your data.

Well will never knowingly process personal data related to children for any other purposes than the following:

• To provide a prescription or service, with the knowledge of a parent or guardian.
• In the course of servicing an information right exercised by the child directly, or with the appropriate consent for a parent or guardian to carry this out on their behalf.
• Where welfare or safeguarding concerns are raised about a child or children. This may involve Well liaising with local authorities to ensure the protection of those involved. Wherever this occurs, Well will always consider whether consent is appropriate and, if it is not, another legal basis will be established.
• Our website collects cookies, which may inadvertently relate to children who visit our website. However, the resulting cookie activity (e.g. to improve the functionality of our website) does not cause a sufficient level of harm to impact children.

Well also carries out ID verification on our website to protect against children purchasing goods that could be unsafe or are specifically for adults. We will continue to robustly review processes to ensure the safeguarding of children.

Well sometimes need to share personal information with trusted partners and service providers who support us in delivering products and services to you. The categories of organisations we may share information with are provided below.

• Payment service providers.
• NHS organisations and healthcare providers.
• Technology and IT service providers.
• Professional advisers (e.g. legal, audit, insurance).
• Research and innovation partners.
• Public authorities and government bodies.
• Emergency services and safeguarding agencies.
• Regulators.

Given Well’s core function is healthcare, there may be occasions where it becomes necessary to safeguard individuals, either from others or themselves. We always take any decision around sharing data of this nature with other authorities or bodies incredibly seriously, and we ensure that our internal policies also reflect this. Data protection laws are still applicable and, in serious cases, the sharing of personal data will likely be done using one or more of the following legal bases:

• Vital interests (to protect those of the data subject/s).
• Reasons of substantial public interest, which may include:
• Preventing or detecting unlawful acts.
• Protecting the public.
• Safeguarding of children and individuals at risk.
• Safeguarding of economic well-being of certain individuals.

We also have a responsibility to safeguard adults who lack mental capacity under the Mental Capacity Act (2005).

Well always weighs up the necessity of sharing any personal data for purposes above and beyond that which the data subject is already aware of and considers whether consent is an available option. Any personal data this is ultimately shared will be done so after internal consideration alongside Well’s Data Protection Officer and the Caldicott Guardian, and only the minimum amount of information is securely shared.

We may need to transfer your information outside the UK to service providers, agents, and subcontractors in countries where data protection laws may not provide the same level of protection as those in the European Economic Area. Where this happens, we agree specific safeguards and assurances in our contracts with those providers to ensure there are appropriate controls in place to protect your data. Where necessary, we also ensure we have conducted a full Transfer Risk Assessment alongside any necessary contractual obligations. This is an area of legislation that is subject to change, so we always ensure we are fully up to date with updates from the UK Government, the Information Commissioner’s Office, and the European Commission.

We only retain personal information for as long as necessary to fulfil the purposes for which it was collected and to meet our legal, regulatory, professional and operational obligations. Retention periods vary depending on the nature of the information and the reason it is processed.

You can find some examples of our typical retention periods below. Please note that in some circumstances, we may need to keep information for longer, for example where there is an ongoing complaint, legal claim, regulatory investigation, safeguarding concern, or another legal requirement. Once information is no longer required, it is securely deleted or destroyed.

If you have given your consent, or where we are permitted to do so under applicable law, we may use your personal data to send information about products, services, health campaigns, pharmacy services and wellbeing information that may be relevant to you.

To make our communications more relevant and reduce the number of messages you receive, we may analyse information we hold about you to better understand your interests and preferences. This is sometimes referred to as profiling. Profiling may include considering information such as:

• Products or services you have previously purchased or used.
• Whether you have received services from a pharmacy or online channel.
• General demographic information, such as age range or broad geographic location.
• Marketing preferences and previous interactions with our communications.
• Health and wellbeing interests that you have chosen to share with us.

This profiling helps us decide which communications, services, offers, health advice or pharmacy services may be most relevant to you. For example, we may inform eligible patients about seasonal vaccination programmes, health screening services, weight management services, smoking cessation support, or other pharmacy services that could be of interest based on previous interactions with us. We also use this information to inform our internal business resourcing and knowledge about the health sector in general.

Our use of profiling is never used to make decisions about individuals that produce legal or similarly significant effects. For example, it is not used to determine eligibility for healthcare services, medication, treatment, employment, or other decisions that could significantly affect an individual.

Where we undertake profiling for direct marketing purposes, you have the right to object at any time. If you object, we will stop using your personal data for profiling related to direct marketing. You may also withdraw your consent to marketing at any time or update your marketing preferences using the contact details provided in this notice.

We may also use pseudonymised or anonymised information to create audience groups, lookalike audiences and similar marketing segments on advertising platforms. Where this occurs, we take steps to minimise the amount of personal data used and to ensure that appropriate contractual, technical and organisational safeguards are in place.

Where possible, we use aggregated, anonymised or pseudonymised information for these purposes so that individuals cannot be directly identified. We always seek to minimise the amount of personal data used and ensure that any analysis is proportionate and appropriate.

Where permitted, we may also contact you about relevant products, services, offers or healthcare services provided by other companies within the Bestway Healthcare Group. This may include cross-selling products or services that we think may be of interest to you based on your previous purchases, services used, preferences or interactions with us.

We may work with carefully selected research, healthcare, academic and technology partners to support healthcare improvement, service evaluation, medical research and the development of new treatments, medicines and healthcare services.

Where appropriate and permitted by law, we may provide pseudonymised or de-identified information derived from patient records to trusted partners who assist us in standardising, analysing and securely managing healthcare data. This helps us to better understand patient outcomes, improve the effectiveness of healthcare services, support clinical research and contribute to the development of evidence-based healthcare innovations.

We do not share information that directly identifies you, such as your name, full address, contact details or specific health information. Any use of patient information for research purposes is subject to appropriate governance, security controls and legal requirements under UK data protection legislation. We will not permit this information to be used for unrelated commercial activities or in ways that are incompatible with the purposes described in this notice.

You have the right to object to certain uses of your personal information or to opt out of specific research-related data sharing arrangements. If you would like further information about these rights, or wish to exercise them, please contact us using the details provided in this Privacy Notice.

From time to time, we may support research studies and clinical trials that seek to advance medical knowledge and improve patient care. As part of this process, we use information from patient records to identify people who we believe are eligible for a particular study and contact them with information about the opportunity. Individuals are free to decide whether they wish to participate, and choosing not to take part will not affect the care or services we provide. We always apply appropriate safeguards to ensure that personal information is handled securely and responsibly.

Under data protection law, you have the following rights:

• Right of Access (typically called a “Subject Access Request” or “SAR"): you have the right to know how we process your personal data (as explained in this notice) and also a right to receive a free copy of your personal data.
• Right to Rectification: you can ask us to change or complete any inaccurate or incomplete personal data held about you.
• Right to Object: you have the right to object, in certain circumstances, to us processing your personal data. For example, you can object to us sending you marketing material, or using your personal data to create a profile about you that is related to direct marketing. Where Well uses patient information for planning or research purposes, you may have the right to choose not to have your confidential patient information used in this way. This is known as the ‘National Data Opt-Out’. The National Data Opt-Out allows you to decide whether your confidential patient information can be used for purposes beyond your individual care and treatment. You can find more information about this here and can opt-out online by visiting the NHS website.
• Right to Erasure: in certain circumstances, you can ask us to delete your personal data. For example, where it is no longer necessary for us to use it, you have withdrawn consent, or where we have no lawful basis to keep it.
• Right to Portability: you have the right to ask us to send a copy of certain elements of your personal data (predominantly information you have shared directly with us) to another company.
• Right to Restrict Processing: you can ask us to restrict the personal data we use about you where you have asked for it to be erased (and the erasure has not taken place, or we were unable to erase the data when we should have) or where you have objected to our use of it.

To make a subject access request, or to exercise any other data subject rights, you should use the information found under the section ‘How you can contact us’.

In most cases, it is free to exercise your privacy rights and we will respond to any request as quickly as we can. Under data protection law, we must respond within one month to any request, unless an exemption applies. We will contact you as soon as we can where we are applying an exemption, which may extend the time Well has to process your request.

If you are a patient or service user, the NHS provides further guidance about SARs here. You can also find helpful information from the ICO here about what to expect from organisations when making a SAR.

By email: hello@well.co.uk

By post to:

If you specifically want to contact our Data Protection Officer, you can do so by emailing DPO@bestwayhealthcare.co.uk. Alternatively, you can write to them at:

If you are unhappy with how we have used, handled, stored, shared, or responded to a request about your personal data, you have the right to raise a data protection complaint with us.

A data protection complaint could include concerns about how we have used your personal data, how we have responded to one of your privacy rights requests, how long we are keeping your information, whether the information we hold is accurate, or how your personal data has been protected.

You can make a complaint by contacting our Data Protection Officer at hello@well.co.uk or by writing to:

When we receive your complaint, we will acknowledge it within 30 days. We will then review the concerns raised, make appropriate enquiries, keep you updated where necessary, and provide you with the outcome of our review without undue delay.

If you are not satisfied with our response, you can complain to the Information Commissioner’s Office (“ICO”), which is the UK’s data protection supervisory authority. The ICO can be contacted using the details below:

You can also find more information about contacting the ICO here: ICO contact information.