Last updated: 01 October 2026

Who is responsible for your information

BAA Pharma Ltd, company 13437580, operates eMeds Pharmacy and is the controller for the online service and Market Street Pharmacy. Its registered office is 63 Kingsway, Manchester, M19 2LL. ICO registration: ZB558553. Privacy enquiries: [email protected]. The DPO contact recorded on the ICO register is [email protected].

Information we collect

We collect identity and contact details, date of birth, delivery and GP details, account and security records, consultation answers, health and medicine information, evidence and verification records, communications, prescribing and dispensing records, payment and refund status, delivery information, complaints, consent choices, and technical records needed to operate and protect the service. Stripe handles card-payment information; eMeds should not store full card details unless its audited payment configuration expressly requires and permits this.

How we receive information

We receive information directly from you and may receive relevant information from your GP, NHS or other healthcare records, another healthcare professional, identity-verification evidence, payment and delivery providers, or previous eMeds records where this is necessary and lawful. The clinical team may contact you securely to clarify or verify information.

How and why we use information

We use personal data to create and manage your account, assess treatment requests, verify information, make prescribing decisions, dispense and deliver approved medicines, take and refund payments, provide aftercare, respond to complaints, prevent fraud, secure the service, meet professional and legal duties, and maintain required records. Depending on the purpose, the Article 6 basis will be performance of a contract, compliance with a legal obligation, legitimate interests, or consent for a separate optional activity such as marketing.

Health information and other special-category data are used only where an Article 9 condition applies. Ordinary clinical care is expected to rely on Article 9(2)(h) and the applicable Data Protection Act 2018 health-care condition and duty of confidentiality. A general consultation checkbox is not the sole legal basis for providing care. Separate explicit consent must be used only where the DPO has identified a genuinely consent-based purpose.

Who we share information with

We share the minimum necessary information with authorised eMeds staff and prescribers, Market Street Pharmacy, Stripe, Royal Mail, identity-verification, hosting, security, communications and support providers, and with GPs, other healthcare professionals, regulators, courts or law-enforcement bodies where necessary and lawful. The live notice must name or clearly describe the actual processors identified by the production data audit. Health data must not be disclosed to advertising platforms for targeting or unrelated profiling.

International transfers

Where a supplier processes information outside the UK, eMeds must use a lawful transfer mechanism and appropriate safeguards, such as adequacy regulations or an approved contractual mechanism. The live notice must describe the actual transfer position identified in the processor audit rather than making a generic claim that all data stays in the UK.

How long we keep information

We keep information only for as long as it is needed for clinical care, pharmacy and legal records, account administration, complaints, fraud prevention and other stated purposes. Some records have statutory minimum periods. The live notice must state the actual periods or criteria from the approved retention schedule. Identity evidence must not be retained indefinitely by default.

Your rights and complaints

You may have rights of access, correction, erasure, restriction, objection and data portability, depending on the processing and legal basis. You may also withdraw consent where processing relies on consent. Contact [email protected] or the DPO at [email protected]. You may complain to the Information Commissioner’s Office. These rights may be limited where records must be retained for legal, regulatory or patient-safety reasons.

Last updated: 14 September 2026. BAA Pharma Ltd is registered with the ICO under reference ZB558553. The registration was verified on the official ICO register on 14 September 2026 and expires on 18 June 2027.

[eMEDS INTERNAL LEGAL/DPO SIGN-OFF — NO DEVELOPER DECISION REQUIRED]

DPO implementation gate: approve a processing-purpose schedule before publication. Map service delivery to Article 6(1)(b) where contractual, record keeping and regulatory duties to Article 6(1)(c), proportionate security and service administration to Article 6(1)(f), and optional consent-based activities to Article 6(1)(a). Map ordinary healthcare processing to Article 9(2)(h) with the applicable Data Protection Act 2018 condition and professional confidentiality. The developer must implement separate consent states only for genuinely optional purposes, retain consent and objection logs, and keep health data out of advertising and unrelated profiling.

Retention framework