Legal
Privacy Policy
Last updated: [date]
Who we are
MAST is an online service operated by [MAST Clinic Ltd], a company registered in Scotland ([company no.]). Prescribing is carried out by UK-registered prescribers and medicines are dispensed by [Macbon Chemist], a pharmacy registered with the General Pharmaceutical Council (GPhC reg. 1042517). The data controller is [MAST Clinic Ltd], [registered address]. Our Data Protection contact is [name / email].
The information we collect
To provide a safe prescribing service we collect: your name, date of birth, contact and delivery details; your answers to the medical questionnaire; relevant health information including medicines you take and conditions you have (“special category” health data); your GP details where you provide them; and payment information (processed by our payment provider, not stored by us).
Why we use it, and our legal basis
We use your information to assess your suitability for treatment, to issue and dispense a prescription where appropriate, to deliver your order, and to keep the clinical and pharmacy records the law requires. Under UK GDPR our lawful bases are: performance of a contract with you; compliance with our legal and regulatory obligations; and, for health data, the provision of health care by or under the responsibility of a health professional (Article 9(2)(h)).
Who we share it with
We share your information only as needed to provide the service: with the prescriber reviewing your order, the dispensing pharmacy, our delivery partner (plain packaging, no clinical detail on the outside), and our IT and payment providers acting on our instructions. With your consent we may write to your GP. We may disclose information where we are legally required to. We never sell your data or share it with marketers.
How long we keep it
Clinical and prescribing records are retained for the periods required by UK pharmacy and healthcare record-keeping rules [insert retention period, e.g. up to 10 years], after which they are securely deleted.
Your rights
You have the right to access your data, to have inaccurate data corrected, and, subject to our legal record-keeping duties, to erasure, restriction and portability. To exercise any right, contact [email]. You can also complain to the Information Commissioner's Office (ico.org.uk).
Security & storage
Your records are encrypted and held on UK-based systems. Access is limited to the staff and clinicians who need it to provide your care.