Privacy Policy – herPILL

Last updated: October 2026

Introduction

This Privacy Policy explains how Pharmaid Health Ltd (“we”, “us”, or “our”) collects, uses, and protects your personal and health information when you use the herPILL mobile application (“the App”) or our website at herpill.co.uk (“the Website”). We handle your information in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. By using the App or the Website, you agree to the practices described in this Privacy Policy.

1. About Us

Data Controller: Pharmaid Health Ltd (Company No: 08652554)

Registered Office: 7–8 The Square, Kiveton Park, Sheffield, S26 5QN, UK

Telephone: 01909 268 001

Email: pharmacy.fjg89@nhs.net

Dispensing Partner (Data Processor / Joint Controller for NHS dispensing):

Kiveton Pharmacy, operated by OTC Direct Services Ltd

Address: 7–8 The Square, Kiveton Park, Sheffield, S26 5QN

Superintendent Pharmacist: Jawad Khan (GPhC 2082861)

ICO Registration Number (OTC Direct Services Ltd): ZB343929

Pharmaid Health Ltd manages the herPILL App, user registration, and reminder functions. Kiveton Pharmacy performs clinical assessment and dispensing for medication requests submitted through the App.

2. Information We Collect

To provide safe, regulated pharmacy services, the App collects:

Identity and contact details: name, date of birth, address, postcode, email, phone number
Medical information: pill type, relevant medical history, side effects, allergies
Reminder settings: time of day and pill name for dose reminders
Technical information: minimal device and usage data to maintain app functionality
Website cookies: if you accept them, analytics and advertising cookies (Google Tag Manager, Google Analytics, Google Ads) – see section 4A

We do not collect payment details or GPS tracking data. The App does not use analytics for advertising. On the Website, analytics and advertising cookies are only used if you accept them (see section 4A).

3. How We Use Your Data

Your information is processed solely to deliver the herPILL service and ensure clinical safety.

Purpose:

Process and review oral contraceptive requests

Legal basis: Article 6(1)(b) contract & Article 9(2)(h) healthcare provision

Provide reminders and user support

Legal basis: Article 6(1)(b) contract

Dispense medication and maintain NHS records

Legal basis: Article 6(1)(c) legal obligation & Article 9(2)(h) healthcare provision

Communicate order or delivery updates

Legal basis: Article 6(1)(b) contract

Comply with NHS, GPhC, or MHRA requirements

Legal basis: Article 6(1)(c) legal obligation

Other than the service and newsletter emails described in section 3A, and website cookies you have accepted (section 4A), we do not use your data for marketing, advertising, or profiling.

herPILL (operated by Pharmaid Health Ltd) and Kiveton Pharmacy (operated by OTC Direct Services Ltd) may send you emails about their pharmacy and healthcare services, including newsletters.

These emails are sent with your consent or, if you are an existing customer, under the “soft opt-in” rules in the Privacy and Electronic Communications Regulations (PECR). You can opt out at any time, and every marketing email includes an unsubscribe link.
You can unsubscribe from emails from herPILL, Kiveton Pharmacy, or both, at any time by using the unsubscribe link in any email, via your account settings where available, or by contacting pharmacy.fjg89@nhs.net.
Unsubscribing will not affect your medication requests or the service emails we need to send you, such as order, prescription or delivery updates.

4. Data Storage and Security

Patient and account data is stored with MongoDB Atlas on Amazon Web Services in Ireland (EU). Our servers are hosted by OVHcloud within the EU.
Data is encrypted at rest and in transit (SSL/HTTPS).
Access to identifiable data is limited to authorised Kiveton Pharmacy pharmacists and accuracy-checking technicians.
Developers/support staff cannot access patient-identifiable data.
We maintain physical, electronic, and organisational safeguards, and access is logged under NHS information governance standards.

4A. Cookies and Website Analytics

The herPILL App does not use advertising cookies. The Website (herpill.co.uk) uses the following:

Strictly necessary storage: remembers your cookie choice. This is always on and does not identify you.
Analytics and advertising cookies (optional): Google Tag Manager, Google Analytics and Google Ads cookies help us understand how visitors use the Website and measure our advertising. These are set by Google LLC.

Optional cookies are only loaded if you click “Accept” on our cookie banner. If you click “Reject”, they are not loaded. You can change your choice at any time using “Cookie settings” in the Website footer. We use Google Consent Mode, so Google tags are told your choice and default to “denied”.

Website analytics data is processed by Google and may be transferred outside the UK, including to the United States, under UK adequacy regulations or appropriate safeguards. See Google’s privacy policy at policies.google.com/privacy for more information.

We share your data only when necessary:

Kiveton Pharmacy – for pharmacist review, clinical decision-making, and dispensing.
Royal Mail – for manual shipping label creation and delivery notifications (SMS/email).
Healthcare professionals / NHS systems – where necessary for continuity of care or audit.
Regulators (e.g., GPhC, NHS England, MHRA) – when we are legally required.
MongoDB Atlas (on Amazon Web Services, Ireland) – our database provider, and OVHcloud – our server hosting provider (EU), which store and process data on our behalf.
Google – website usage data, only if you accept analytics and advertising cookies on the Website.

We never sell data or share it for commercial marketing. Third parties are bound by data processing agreements and must comply with UK GDPR.

6. Data Retention

Clinical and dispensing records: retained for 11 years from the last entry (NHS standard).
App account and reminder data: deleted when you close your account or after 12 months of inactivity.
Royal Mail dispatch records: retained up to 12 months for audit purposes.

After these periods, data is securely deleted or anonymised.

7. Your Rights

Under UK GDPR, you have rights to:

Access your data
Rectify inaccurate or incomplete data
Request erasure (subject to NHS retention laws)
Restrict or object to processing
Data portability
Withdraw consent where consent is relied upon

To exercise your rights, contact: pharmacy.fjg89@nhs.net or 01909 268 001. We respond within one month.

8. Data Breaches

If a personal data breach occurs that may risk your rights or freedoms, we will notify the Information Commissioner’s Office (ICO) within 72 hours where required and inform affected users without undue delay.

9. International Transfers

Patient and account data is stored with MongoDB Atlas on Amazon Web Services in Ireland (EU), and our servers are hosted by OVHcloud within the EU. Transfers from the UK to the EEA are permitted under UK data protection law (UK adequacy regulations). Any other transfer of personal data outside the UK (for example, website analytics data processed by Google where you have accepted cookies) is protected by UK adequacy regulations or appropriate safeguards, such as the UK International Data Transfer Agreement or Addendum.

10. Children’s Data

The herPILL service is for users aged 16 and over and/or users of childbearing age who can demonstrate understanding and consent in line with Fraser Guidelines and Gillick competence. We do not knowingly process data for users under 16 without appropriate competence being established in line with those guidelines.

11. Automated Decision-Making

No automated decision-making or AI is used to approve or deny medication requests. All clinical assessments are made by qualified pharmacists.

12. Updates to This Policy

We may update this Privacy Policy to reflect changes in law or practice. The latest version will be available in the App and on our website. Continued use of the App or the Website after changes indicates acceptance of the updated Policy.

13. Complaints and ICO Registration

If you have concerns, contact our Data Protection Lead using the details below. You may also complain to the Information Commissioner’s Office (ICO).

ICO: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF — www.ico.org.uk

14. Contact Details

Data Protection Lead

Pharmaid Health Ltd / Kiveton Pharmacy

7–8 The Square, Kiveton Park, Sheffield, S26 5QN