At Naturecan Pharmacy, we are committed to protecting your personal information and being transparent about how we use it. This Privacy Notice explains what data we collect when we dispense and deliver your medication, why we collect it, how long we keep it, and what your rights are.
It applies to patients whose prescriptions we dispense, anyone who contacts us, and visitors to staging.naturecanpharmacy.co.uk. If you have any questions, contact us using the details in Section 13.
1. Who We Are
Naturecan Pharmacy is the trading name of MYC Dispensary Ltd, a mail-order pharmacy registered with the General Pharmaceutical Council (GPhC). We dispense prescriptions for cannabis-based products for medicinal use (CBPMs) issued by Naturecan Clinic and deliver them to patients across the UK.
| Legal name | MYC Dispensary Ltd |
| Trading name | Naturecan Pharmacy |
| Company number | 16403368 (registered in England and Wales) |
| Pharmacy address | Unit 28 Spindus Road, Compass Industrial Park, Liverpool, L24 1YA |
| GPhC registration | 9012908 |
| Superintendent Pharmacist | Hussain Abdeh MRPharmS |
| General enquiries | support-uk@naturecanpharmacy.com |
| Data protection contact | dpo@naturecanpharmacy.com |
MYC Dispensary Ltd is the Data Controller for the personal data we process in connection with dispensing, supplying and delivering your medication. Naturecan Clinic (Ropana Clinics Ltd) is a separate company and a separate Data Controller for your clinical consultations; its own Privacy Notice explains how it uses your data.
2. What Personal Data We Collect
Depending on how you use our service, we may collect the following categories of personal data.
Identity and Contact Information
-
Full name and date of birth
-
Delivery address, email address and telephone number
-
Your patient reference number
Prescription and Health Information
-
Details of your prescription, including the products, quantities and dosage directions, and the details of your prescriber
-
Information from Naturecan Clinic that our pharmacists need to dispense safely, such as the treatment parameters set by your doctor for repeat prescriptions under shared care
-
Information you give us when you request a repeat prescription, including whether your symptoms have changed
-
Records of pharmacist checks, clinical interventions and advice given to you
-
Reports of suspected side effects that you share with us
Payment Information
-
Payment status and transaction records for your orders
-
Card details are entered on our payment provider's secure payment page and are not stored by the pharmacy
-
Whether you chose to pay with Klarna (see Section 6)
Delivery Information
-
Royal Mail tracking numbers and delivery status
-
Records of missed deliveries, returned parcels and redelivery requests
Communications and Website Data
-
Emails, telephone calls and letters exchanged with our pharmacist team
-
Records of any complaints or feedback you give us
-
IP address, device information and cookie data when you visit our website (see our Cookie Policy)
3. How We Collect Your Personal Data
We collect your personal data:
-
From Naturecan Clinic: when your doctor issues a prescription, we receive an electronic notification and the signed FP10 prescription form
-
Directly from you: when you request a repeat prescription, contact our team, make a complaint or give feedback
-
From our payment providers: confirmation that payment has been made
-
From Royal Mail: tracking and delivery status for your parcel
-
From our website: through cookies and similar technologies, subject to your consent where required
4. Why We Use Your Personal Data
To Dispense Your Prescription
Lawful basis (Art. 6 UK GDPR): Art. 6(1)(b), performance of a contract; Art. 6(1)(c), legal obligation. Special category basis (Art. 9 UK GDPR): Art. 9(2)(h), provision of health care; DPA 2018 Schedule 1, paragraph 2.
-
To verify your prescription and the signed FP10 form before dispensing
-
For a pharmacist to carry out a clinical check of your prescription
-
To dispense, label and supply your medication
-
To review and issue repeat prescriptions under an approved shared care arrangement
-
To keep the records that pharmacies must keep for controlled drugs
To Take Payment and Deliver Your Order
Lawful basis: Art. 6(1)(b), performance of a contract; Art. 6(1)(c), legal obligation (financial record keeping).
-
To send you a secure payment link and confirm payment before dispatch
-
To process Klarna payments where you choose that option
-
To dispatch your parcel by Royal Mail Tracked & Signed and manage missed deliveries
To Communicate With You
Lawful basis: Art. 6(1)(b), performance of a contract; Art. 6(1)(f), legitimate interests.
-
To tell you when your prescription has arrived, when payment is due and when your order has been dispatched
-
To answer your questions and support requests
-
To handle complaints and feedback
To Meet Our Legal and Regulatory Obligations
Lawful basis: Art. 6(1)(c), legal obligation. Special category basis: Art. 9(2)(h) and Art. 9(2)(i), public health; DPA 2018 Schedule 1, paragraphs 2 and 3.
-
To comply with the Misuse of Drugs Regulations 2001 and GPhC standards for registered pharmacies
-
To report suspected adverse reactions to the MHRA through the Yellow Card scheme
-
To respond to lawful requests from regulators, the Home Office or law enforcement
To Improve Our Service and Website
Lawful basis: Art. 6(1)(f), legitimate interests; Art. 6(1)(a), consent for non-essential cookies.
We will never use your health data for marketing, and we will only send you marketing messages if you have given your consent. We do not sell your personal data to anyone.
5. Special Category Personal Data
Information about your prescriptions and medication is health data, which is special category personal data under UK GDPR and attracts a higher level of legal protection.
We process it because it is necessary for the provision of health care by, or under the responsibility of, a registered health professional who owes you a duty of confidentiality (Art. 9(2)(h)), and, where relevant, for reasons of public health such as medicines safety reporting (Art. 9(2)(i)).
Where we rely on your consent for any processing, you can withdraw it at any time. This does not affect processing that took place before you withdrew it, and we may still need to keep some records to meet our legal obligations.
6. Who We Share Your Personal Data With
We only share your personal data where it is necessary to supply your medication, required by law, or authorised by you.
Naturecan Clinic (Ropana Clinics Ltd)
We share information with Naturecan Clinic to confirm that your prescription has been dispensed, to raise clinical queries with your prescriber, and to support shared care and repeat prescriptions. This sharing is governed by a data sharing agreement between MYC Dispensary Ltd and Ropana Clinics Ltd.
Royal Mail
We give Royal Mail your name and delivery address so that your parcel can be delivered and signed for. Royal Mail is not told what the parcel contains.
Payment Providers
Card, Google Pay and Apple Pay payments are processed by our payment provider. Klarna provides its Pay in 3 and Pay in 30 days services where you choose them. We do not share clinical information with either provider. Klarna's privacy notice
Service Providers
We use trusted providers for services such as email, secure hosting and customer support. They process data only on our instructions under UK GDPR Article 28 data processing agreements.
Regulators and Authorities
-
The General Pharmaceutical Council (GPhC), for regulatory oversight and inspection
-
The Medicines and Healthcare products Regulatory Agency (MHRA), including Yellow Card reporting
-
The NHS Business Services Authority, where we must submit private controlled drug prescriptions for monitoring
-
The Home Office and law enforcement agencies, where required by law
7. How Long We Keep Your Personal Data
We keep your personal data only for as long as we need it for the purposes above, or for as long as the law and our regulators require.
Prescription, dispensing and controlled drug records are kept for the periods required by the Misuse of Drugs Regulations 2001, GPhC standards and NHS records management guidance.
At the end of the retention period, your data is securely deleted or irreversibly anonymised.
8. International Data Transfers
We aim to store and process your personal data within the United Kingdom. Where a service provider transfers data outside the UK, we make sure appropriate safeguards are in place, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, in line with UK GDPR Articles 44 to 49.
9. Your Rights
Under UK GDPR you have the following rights. To exercise any of them, contact us using the details in Section 13.
-
Right to be informed about how we use your data, which this notice provides
-
Right of access to a copy of the data we hold about you; we respond within one calendar month
-
Right to rectification of inaccurate or incomplete data
-
Right to erasure in certain circumstances, although we cannot delete records we are legally required to keep
-
Right to restrict processing in certain circumstances
-
Right to object to processing based on legitimate interests
-
Right to data portability where processing is automated and based on consent or a contract
-
Right to withdraw consent at any time where we rely on consent
If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ICO): ico.org.uk, telephone 0303 123 1113. We would encourage you to contact us first so we can try to put things right.
10. Cookies and Online Tracking
Our website uses cookies and similar technologies. Non-essential cookies are only used with your consent. For details of the cookies we use and how to manage them, see our Cookie Policy.
11. How We Protect Your Data
We take the security of your personal data seriously, especially given the sensitive nature of health information. Our measures include:
-
Access to patient records limited to authorised staff who need it for their role
-
Confidentiality obligations on all pharmacy staff, and professional duties of confidentiality on our pharmacists
-
Secure systems for storing and sending prescription and patient information
-
Data protection training for staff who handle patient data
If a personal data breach is likely to put your rights and freedoms at risk, we will notify the ICO within 72 hours and tell you without undue delay.
12. Changes to This Privacy Notice
We review this notice regularly and will update it to reflect changes to our service or the law. The version and date at the top of this page show when it was last updated. Where changes are significant, we will tell you by email.
13. How to Contact Us
To exercise your rights, make a subject access request or raise a concern about how we use your data, contact us:
-
Email: dpo@naturecanpharmacy.com
-
Post: Data Protection, MYC Dispensary Ltd, Unit 28 Spindus Road, Compass Industrial Park, Liverpool, L24 1YA
-
Telephone: 0203 808 6988 (Monday to Friday, 9am to 5pm)
We aim to respond to all data protection enquiries within one calendar month.