Privacy Policy

1. Who is responsible for your data

Twilight UK Limited (company number 05807556), trading as Twilight Pharmacy, 309 Bolton Road, Memorial Health Centre, Birmingham, B10 0AU, is the data controller. Our Superintendent Pharmacist, Usman Ali Khan, is responsible for the confidentiality of clinical records. For any privacy question or request, email admin@twilightpharmacy.co.uk.

2. What we collect

• Identity and contact details: name, date of birth, email, phone number, delivery and billing addresses.
• Health information: your consultation answers, height, weight, medical history, current medicines, GP details, photographs and photo ID you upload, our prescriber's notes and decisions, prescriptions issued, and information obtained from your GP record to verify what you have told us.
• Order and payment details: what you ordered, when, and payment status. Card details are handled by our payment processor and never reach our systems.
• Technical data: device, browser, IP address, and how you use the site, collected through cookies described in section 8.

3. Why we use it and our lawful basis

• To provide clinical care: assessing whether treatment is suitable, prescribing, dispensing and delivering your medicine, and monitoring your treatment. Lawful basis: performance of our contract with you (UK GDPR Article 6(1)(b)), and for health data, the provision of health care by or under the responsibility of a regulated health professional (Article 9(2)(h)) together with our professional duty of confidentiality.
• To verify your identity, height and weight against your GP record, in branch, or by video, as required by pharmacy regulation. Lawful basis as above, with your explicit consent for accessing your GP record.
• To inform your GP of medicines we prescribe, with your consent, so your records are complete.
• To meet legal and regulatory obligations: keeping prescription and dispensing records, reporting adverse reactions, and responding to our regulators (Article 6(1)(c)).
• To run and protect the service: security, fraud prevention, and improving the site (legitimate interests, Article 6(1)(f)).
• To send you service messages about your consultation and orders. We only send marketing with your consent, and you can withdraw it at any time.

4. Who we share it with

We never sell your data and never share health information for marketing. We share only what is needed with:

• Dispensing partners: where your medicine is supplied through LillyDirect, your prescription and delivery details are shared with Lilly's partner pharmacy so they can dispense and deliver it. They are a regulated pharmacy bound by the same duties of confidentiality.
• Your GP: to verify your information and to notify them of treatment, with your consent.
• Delivery carriers: your name, address and contact details for tracked delivery.
• Service providers who process data on our instructions under contract: secure hosting and databases, authentication, file storage, email delivery and payment processing (Viva.com). Health information is stored in the UK and EU. Where a provider processes data outside the UK, we rely on UK adequacy regulations or the International Data Transfer Agreement.
• Regulators and authorities such as the GPhC and MHRA where we are required to.

5. How long we keep it

Clinical records, including consultations, prescriptions and verification records, are kept for 8 years after your last treatment, in line with professional record-keeping guidance. Order and payment records are kept for 6 years for tax purposes. Photographs and photo ID are deleted once no longer needed for clinical verification, and in any case within 12 months. Account details are kept while your account is open and for 12 months after it closes.

6. How we protect it

Data is encrypted in transit and at rest. Access to clinical records is restricted to our pharmacists and prescribers and to staff who need it to fulfil your order, and every access to a clinical record is logged. Photographs and documents are stored in private storage accessible only through short-lived, authenticated links.

7. Your rights

You have the right to:

• access a copy of the personal data we hold about you;
• have inaccurate data corrected;
• ask us to delete your data, although we must keep clinical and financial records for the periods in section 5;
• object to, or ask us to restrict, certain processing;
• receive your data in a portable format;
• withdraw consent at any time where we rely on it.

To exercise any of these, email admin@twilightpharmacy.co.uk. We respond within one month. You can also complain to the Information Commissioner's Office at ico.org.uk, though we would welcome the chance to resolve any concern first.

8. Cookies

We use strictly necessary cookies to keep you signed in, remember your cart and protect the site. We use analytics cookies only with your consent, and we never place health information in analytics. You can change your cookie choices at any time through the cookie settings link in the footer or your browser settings.

9. Changes to this policy

We will post any changes here and update the date below. If a change materially affects how we use your health information, we will tell you directly. See also our terms and conditions and complaints policy.