Version 1.1
Updated 17 May 2024
Our Privacy Notice describes the categories of personal data we process and for what purposes.
Contents
Who we share your personal data with
Your privacy rights and how to exercise them
Children’s data and safeguarding
How long we retain your personal data
Introduction and summary
At Key Pharmaceuticals we know that your personal data is important to you. That’s why, whenever we use it, we only use what we need to, and we do everything we can to ensure it is appropriately protected.
This notice explains the situations where we may process your personal data and the steps we take to protect it.
Updating this notice
Key Pharmaceuticals keeps its privacy policy under regular review, and we may make changes to this notice at any time. Depending on the associated processing risks, we will either contact you with the modified terms, or we will post a copy of these on our website. Any changes will take effect 7 days after the date of our email, or the date on which we post the modified terms on our website, whichever is sooner. Please ensure you regularly check our website for any updated use of your personal data, alongside contact information in the event you have any further queries.
Who we are
Key Pharmaceuticals is the trading name for Key Pharmaceuticals Limited (company number 04082308, registered address 18 Oxleasow Road, Moons Moat East, Redditch, Worcestershire, England, B98 0RE. When we say ‘we’ or ‘us’ we mean this company.
This company is part of the wider Bestway Healthcare Group of companies, including Bestway Panacea Holdings Ltd (an English and Welsh registered company with company number 09225479, registered address: Merchants Warehouse Castle Street, Castlefield, Manchester, M3 4LZ). When we say ‘Group’ in this notice, we mean other members of our group of companies, including trading and subsidiary companies of Bestway Panacea Holdings Ltd (an English and Welsh registered company with company number 09225479, registered address: Merchants Warehouse Castle Street, Castlefield, Manchester, M3 4LZ) and its trading and subsidiary companies.
How you can contact us
By email:
By post:
Galen House, 83 High Street, Somersham, PE28 3JB, Cambridgeshire, UK
If you specifically want to contact our Data Protection Officer, you can do so by emailing DPO@well.co.uk. Alternatively, you can write to them at:
Data Protection Officer
Merchants Warehouse
Castle Street
Castlefield
Manchester
M3 4LZ
How we use your personal data
Key Pharmaceuticals’ use of personal data falls into two distinct categories: data related to our business operations, and data related to the end-users of our products. You can find out more about this using the below two headings.
Business data processing:
- Most of the personal data we collect is on a ‘business to business’ basis due to the wholesale nature of our operation. We only ask for the information that we absolutely need in order to progress our interactions with you or your wider business.
- We may collect a small amount of your personal data automatically – such as IP addresses, pages viewed on our website and links you’ve clicked on.
- We may acquire some personal data from commercially available data sources (e.g. the electoral roll) to keep your data accurate and help us better understand your needs.
- If you have given us appropriate permission to do so, or if we deem we have a legitimate interest in getting touch, we may send you information about products and services we offer. We will never sell your details to third parties for their own marketing purposes.
- To help you get the most out of our marketing, we may sometimes (but not always) tailor it to you using your personal data. We will do this by building a profile about you, for example, to understand what services you currently use, or may have a future need for. Where we carry out this activity, you can object to this (explained later) and receive non-personalised marketing instead.
- We may share your information within our wider group of companies where there is a legal need, or justified business need, to do so.
- We use selected and trusted third parties to provide some of our services (e.g. courier companies to deliver online orders) and will share the minimum personal data necessary with them where we require something more than, for example, your name and a business address for delivery.
- Like most organisations, we use third parties to support the running of our business (e.g. using an application) and, in certain circumstances, these third parties may have access to your data. This may be from outside of the European Union. Where this is the case, we have appropriate protective measures in place to ensure your information is appropriately protected.
- With the exception of tailored marketing (as mentioned above) we do not make any automated decisions – i.e. a decision which does not involve a human providing an opinion – about you in delivering our services.
What we specifically collect and how we use it depends how you interact with us and the specific services you’ve requested. Some examples of specific data use are listed below for your information:
- We process your bank details to provide the services or products you have requested. For any orders of products or services made by you online via our website, via a cascade order or our internal teams, or if you opt to have your details stored for future payments, our third-party processing agency securely holds your payment card details and provides us with a unique token that represents that card; this token is only valid for payment to us.
- If you have an account with us and use our online ordering portal online, we may collect your IP address as part of the log in process. This is a security feature to protect your account.
- If you call us, we may record or monitor the call. We do this for regulatory purposes, for training, to ensure and improve quality of service delivery, to ensure safety of our staff and customers, and to resolve queries or issues. Doing so is also sometimes a legal obligation. Where we analyse calls to improve our service, we do so as a legitimate business interest.
- If you enter one of our premises, we may capture you on CCTV. We use CCTV to ensure the safety and security of our staff and customers. The images captured may be used to prevent and detect crime, and therefore may be shared with law enforcement. We carry out this processing activity either for our own legitimate interest (e.g. to keep our staff safe) or for the wider public interest (e.g. where it is shared with law enforcement).
- As part of delivering our service to you, we may use your personal information to contact you. For example, to send you payment reminders and invoices or to notify you of an account change. We may also provide your telephone number to third party delivery services to allow them to contact you about your specific delivery. This could be, for example, to let you know of any urgent delivery issues, or that we are unable to safely approach the pharmacy. Where we do so, we ensure the third party only uses the information for this specific purpose and processes it in accordance with an established legal contract.
- If you visit one of our offices as a guest (contractors, suppliers, guests, other non-customer individuals) on an ad-hoc basis or as part of a long-term agreement, personal data will be collected in relation to your visit for the purposes of site security, and health and safety.
Patient data processing:
Our pharmaceutical products are available to hospitals, clinics, and pharmacies up and down the UK. To fulfil our regulatory obligations, we may process your personal data if you tell us about a particular side effect, make a complaint or request medical information.
This means that, in practice, you may choose to share details about your health with Key Pharmaceuticals – either by our website’s contact us form, email, telephone or letter. We then store a log of this and may share information with the Medicines and Healthcare products Regulatory Agency (“MHRA”), who regulate and monitor pharmaceutical products. The information you provide is crucial to understand medical trends and ensure public health advice is up to date.
Who we share your personal data with
In the previous section we described instances where we share your personal information with others. There are also other third parties that we use to help us deliver and improve our services to you. In this section, we have summarised the categories of third parties who we may share your data with.
- Postal services and couriers – for typical business purposes, to deliver order
- Other third party processors – for example, system and platform operators.
- Law Enforcement Agencies (LEA) – where we are required to do so by law, we will release personal data to LEA’s (g. the police). This will most likely be for the detection or prevention of crime, or to exercise or defend a legal claim.
Where we process your personal data
We may need to transfer your information outside the UK to service providers, agents, and subcontractors in countries where data protection laws may not provide the same level of protection as those in the European Economic Area. Where this happens, we agree specific safeguards and assurances in our contracts with those providers to ensure there are appropriate controls in place to protect your data. Where necessary, we also ensure we have conducted a full Transfer Risk Assessment alongside any necessary contractual obligations. This is an area of legislation that is subject to change, so we always ensure we are fully up to date with updates from the UK Government, the Information Commissioner’s Office, and the European Commission.
Your privacy rights and how to exercise them
Under data protection laws, you have the following rights:
- Right of Access (typically called a “Subject Access Request” or “SAR”): you have the right to know how we process your personal data (as explained in this notice) and also a right to receive a free copy of your personal data.
- Right to Rectification: you can ask us to change or complete any inaccurate or incomplete personal data held about you.
- Right to Object: you have the right to object, in certain circumstances, to us processing your personal data. For example, you can object to us sending you marketing material, or using your personal data to create a profile about you that is related to direct marketing.
- Right to Erasure: in certain circumstances, you can ask us to delete your personal data. For example, where it is no longer necessary for us to use it, you have withdrawn consent, or where we have no lawful basis to keep it.
- Right to Portability: you have the right to ask us to send a copy of certain elements of your personal data (predominantly information you have shared directly with us) to another company.
- Right to Restrict Processing: you can ask us to restrict the personal data we use about you where you have asked for it to be erased (and the erasure has not taken place, or we were unable to erase the data when we should have) or where you have objected to our use of it.
To make a subject access request, or to exercise any other data subject rights, you can contact us using the information provided in this notice.
It is free to exercise your privacy rights and we will respond to any request as quickly as we can. Under current data protection laws, we have 30 days to respond to any request, unless an exemption applies. We will contact you as soon as we can where we are applying an exemption, which may extend the time we have to process your request.
Children’s data and safeguarding
Key Pharmaceuticals will never knowingly process personal data related to children for any purpose other than in the following unique circumstances:
- Where welfare or safeguarding concerns are raised about a child or children. This may involve Key Pharmaceuticals liaising with local authorities to ensure the protection of those involved. Wherever this occurs, Key Pharmaceuticals will always consider whether consent is appropriate and, if it is not, another legal basis will be established.
You can find out more about what cookies we use in our separate Cookie Policy.
There may be occasions where it becomes necessary to safeguard individuals, either from others or themselves. We always take any decision around sharing data of this nature with other authorities or bodies incredibly seriously, and we ensure that our internal policies also reflect this. Data protection laws are still applicable, and, in serious cases, the sharing of personal data will likely be done using one or more of the following legal bases:
- Vital interests (to protect those of the data subject/s).
- Reasons of substantial public interest, which may include:
- Preventing or detecting unlawful acts.
- Protecting the public.
- Safeguarding of children and individuals at risk.
- Safeguarding of economic wellbeing of certain individuals.
We also have a responsibility to safeguard adults who lack mental capacity under the Mental Capacity Act (2005).
Key Pharmaceuticals always weighs up the necessity of sharing any personal data for purposes above and beyond that which the data subject is already aware of and considers whether consent is an available option. Any personal data this is ultimately shared will be done so after internal consideration alongside Key Pharmaceuticals’s Data Protection Officer and other senior responsible individuals, and only the minimum amount of information is securely shared.
How long we retain your personal data
Key Pharmaceuticals will retain your personal data for as long as we are legally or contractually required to do so, or for a period which is justifiable to meet our business needs. The exact retention period varies depending on the type of information and purpose for use, and our internal policies support this activity.
Marketing and communications
If you have given your consent, or if we believe we have a legitimate interest to do so we may, from time to time, contact you about the products and services we offer.
The marketing we send to you may be tailored to make it more relevant. This is done by analysing the data we hold on you (e.g. services previously used, age, address, previously stated product interests) to create a profile. If you want to receive marketing from us, but do not want this to be tailored then you can object to the profiling as described under “What your privacy rights are and how to exercise them”. Alternatively, unsubscribing from marketing will also cease the profiling activity we conduct.
We may also contact you in the following scenarios:
- To request that you take part in customer feedback and surveys. This allows us to collect insights on the service we provide and what our customers may want from us in the futur
- To provide an update on an order you have placed.
- To confirm a delivery slot for an order you have placed.
We will send these communications to you either by email, post – or both – depending on the content and context of the communication. Every marketing communication we send will include instructions on how to opt-out. Some of our communication will be contractual in nature, however if our communication is of a direct marketing nature, you can change your marketing preferences at any time using the contact information provided in this notice.