This notice covers the public Scan2Care website, business enquiries and pharmacy account registration. If you submit consultation information through a pharmacy-specific patient journey, also read the privacy information provided by that pharmacy.
1. Who we are
Scan2Care is operated by InnovateRx Limited (company number 14671626). For the personal information described in this notice, InnovateRx Limited is the controller and decides why and how that information is used.
You can contact us at Anup@InnovateRx.co.uk, by telephone on +44 7957 403308, or by writing to InnovateRx Limited, 1110 Elliott Court, Coventry Business Park, Coventry, CV5 6UB, United Kingdom.
2. Information we collect
Depending on how you use the website, we may collect:
- your name, work email address, telephone number and communications with us;
- your pharmacy’s ODS code, name, address and selected Scan2Care plan;
- account and activation information, including account status and security records. Passwords and activation tokens are stored in hashed form rather than as readable text;
- technical information generated when you use the website or service, such as IP address, browser or device information, request time, pages requested and security or error logs; and
- pharmacy details obtained from NHS organisational directory data when we verify an ODS code.
The pharmacy registration form does not ask for patient health information. Please do not send patient records, health details or passwords through our general email address.
3. How and why we use information
To provide and administer Scan2Care
We use registration, pharmacy and account information to verify your pharmacy, create and activate an account, provide the trial or service, manage access, and respond to service enquiries. We do this because it is necessary to take steps at your request before entering into a contract and to perform our contract with you.
To communicate with you
We use your contact details to answer enquiries and send operational messages about registration, activation, security or the service. We rely on contract where the communication relates to your account or requested service, and otherwise on our legitimate interests in responding to enquiries and operating our business.
To operate and protect the website and service
We use technical, security and account information to maintain availability, troubleshoot faults, prevent misuse, protect accounts and establish or defend legal claims. We rely on our legitimate interests in running a reliable and secure service, and on legal obligation where the law requires processing.
To meet legal obligations
We may use and retain information where necessary to comply with applicable law, regulatory requirements, court orders or lawful requests from public authorities.
4. Information you need to provide
The fields marked as required on the pharmacy registration form are needed to verify the pharmacy, create the account and provide the selected service. If you do not provide them, we will not be able to complete registration. Providing information in a general enquiry is optional, although we may need enough information to respond.
5. Who we share information with
We may share personal information only where needed with:
- hosting, database, security, communications, email-delivery and IT support suppliers that process information for us under contract;
- NHS organisational directory services when checking pharmacy details;
- professional advisers, insurers, auditors or prospective purchasers where appropriate and subject to confidentiality; and
- courts, regulators, law enforcement or other authorities where disclosure is required or permitted by law.
We do not sell personal information.
6. International transfers
Some suppliers may process personal information outside the United Kingdom. Where this is a restricted transfer, we use a transfer mechanism permitted by UK data protection law, such as UK adequacy regulations or approved contractual safeguards, and carry out any required risk assessment. You can contact us for more information about safeguards relevant to your information.
7. How long we keep information
We keep personal information only for as long as needed for the purposes described above. The period depends on whether an account is active, the status of a registration or enquiry, our contractual and legal obligations, security needs, and the time allowed for legal claims. When information is no longer needed, we delete or anonymise it securely.
8. How we protect information
We use technical and organisational measures designed to protect personal information. These include encrypted connections, access controls, and hashing for passwords and activation tokens. No internet service is completely secure, so please use a unique password and contact us if you believe your account or information may have been compromised.
9. Cookies and similar technologies
At the date of this notice, the public marketing pages do not use analytics or advertising cookies. If we introduce non-essential cookies or similar technologies, we will update this notice and provide any consent controls required by law before using them.
10. Automated decision-making
We do not use the personal information covered by this notice to make solely automated decisions that have legal or similarly significant effects on you. ODS lookup is used to match the code you enter with pharmacy directory information.
11. Your data protection rights
Depending on the circumstances, you may have the right to ask us for access to your personal information, correction, erasure, restriction of its use, or transfer of information you provided. You may also have the right to withdraw consent where processing relies on consent.
Your right to object: where we rely on legitimate interests, you may object to our use of your personal information. You have an absolute right to object to direct marketing.
To exercise a right, email Anup@InnovateRx.co.uk. We may need to verify your identity. There is usually no fee, and we normally respond within one month, subject to the exceptions allowed by law.
12. Complaints
Please contact us first so we can try to resolve your concern. You also have the right to complain to the UK Information Commissioner’s Office. Visit ico.org.uk for current contact details and guidance.
13. Changes to this policy
We may update this policy when our services, suppliers or legal obligations change. The latest version will appear on this page with a revised “last updated” date. We will highlight material changes where appropriate.