Privacy Policy

Last updated: 20 July 2026

1. Who we are

Medline Wellness Ltd, trading as Medline Online Pharmacy & Clinics, is the controller responsible for the personal information used for its website, consultations, prescribing, monitoring, follow-up and, once registered, the dispensing and supply of non-controlled medicines.

This notice explains what information we collect, why we use it, who we share it with, how long we keep it and your rights. It applies to website visitors, patients, prospective patients, representatives, complainants and people who communicate with us.

2. Information we collect

• Identity and contact information, including name, date of birth, address, email, telephone number, photographic identification and account details.
• Health and clinical information, including symptoms, diagnoses, medical and family history, allergies, medicines, pregnancy or breastfeeding status, lifestyle factors, photographs, measurements, test results, consultation notes, prescriptions, monitoring and treatment outcomes.
• Professional and healthcare information received from your GP, specialist, regular prescriber, pharmacy, laboratory or another healthcare professional.
• Booking, payment, invoice, refund, order, delivery and subscription information. We do not retain full payment-card details where payment is processed by a specialist payment provider.
• Communications, complaints, feedback, incident reports, safeguarding information and records of consent or preferences.
• Website and technical information, including IP address, browser, device, security logs, cookies and interactions with online forms.
• CCTV images where CCTV is used to protect the pharmacy premises, people, medicines, equipment and records.
• Marketing preferences where you choose to receive updates.

3. How we collect information

• Directly from you through website forms, consultations, telephone calls, email, video appointments and face-to-face appointments.
• From a representative acting with your authority.
• From healthcare professionals, clinical systems, records or correspondence where necessary and lawful for safe care.
• From dispensing, delivery, payment, laboratory, diagnostic, identity-verification, IT and other service providers.
• Automatically through website logs, security tools, cookies and similar technologies.

4. Why we use your information

• To verify identity, age, eligibility, capacity and consent.
• To assess symptoms, risks and treatment suitability and to make safe prescribing and pharmacy decisions.
• To prescribe, dispense, supply and deliver medicines safely and lawfully.
• To provide medicine information, monitoring, safety-netting, follow-up and continuity of care.
• To communicate with your GP, specialist, regular prescriber or another healthcare professional where appropriate.
• To maintain clinical, prescription, dispensing, governance, safeguarding, financial and legal records.
• To manage bookings, payments, cancellations, refunds, customer support and delivery.
• To identify inappropriate requests, duplicate treatment, fraud, misuse or diversion.
• To investigate incidents, complaints, recalls, adverse drug reactions, data-security events and safeguarding concerns.
• To conduct audit, quality improvement, staff training, service evaluation, insurance and regulatory compliance.
• To protect our website, systems, premises, patients, staff, medicines and business.
• To send marketing where you have consented or where otherwise permitted by law, with the right to opt out.

5. Our lawful bases

Depending on the purpose, we process ordinary personal information because it is necessary to perform a contract or take steps at your request, comply with a legal obligation, protect vital interests, pursue legitimate interests, or because you have given consent.

Health information is special-category information. We process it where necessary for medical diagnosis, healthcare, treatment, pharmacy practice or management of healthcare services by or under the responsibility of a health professional subject to confidentiality duties. Where relevant, we may also rely on vital interests, substantial public interest, public-health or legal-claims conditions, or explicit consent, together with the Data Protection Act 2018 safeguards that apply.

Our legitimate interests include providing and improving safe services, preventing fraud and misuse, securing systems and premises, managing the business, handling complaints and defending legal claims. We balance those interests against your rights and expectations.

6. Prescribing and dispensing responsibilities

Medline is responsible for the clinical assessment, prescribing, monitoring, safety-netting and follow-up it provides. Once Medline’s premises are registered, Medline will dispense and supply non-controlled medicines from those premises.

Controlled drugs prescribed through Medline will be dispensed and delivered by DoseDirect, Room 5, Lower Ground Floor, Chantry House, Coleshill, B46 3BP, GPhC pharmacy premises registration number 9012841. We will share the minimum information necessary for DoseDirect to validate the prescription, complete its legal and clinical checks, label, supply, deliver and manage the controlled-drug prescription safely.

DoseDirect acts as an independent controller for the dispensing and supply activities it carries out. Medline remains the controller for its consultation, prescribing, monitoring and follow-up records. Each organisation is responsible for its own data-protection compliance and may need to share information with the other for safe care, incidents, recalls or complaints.

7. Who we may share information with

• Your GP, specialist, regular prescriber, hospital, safeguarding service or another healthcare professional where necessary for verification, safe care, continuity of treatment or protection from harm.
• DoseDirect where it dispenses and delivers a controlled drug prescribed through Medline.
• Clinical and pharmacy-system providers, including secure patient-record, prescribing, PMR, booking and communication platforms.
• Laboratories, diagnostic providers and healthcare suppliers involved in a test, kit or clinical service.
• Payment processors, accountants, banks and fraud-prevention providers.
• Delivery and logistics providers, who receive only the information needed to deliver and track an item.
• Website hosting, IT support, email, cybersecurity, identity-verification, document-storage and cookie-consent providers acting under appropriate arrangements.
• Professional advisers, insurers, auditors and legal representatives.
• The GPhC, MHRA, courts, law-enforcement, safeguarding bodies and other public authorities where disclosure is required or lawful.
• A buyer, investor or successor organisation if the business is reorganised or transferred, subject to confidentiality and data-protection safeguards.

We do not sell personal or health information.

8. International transfers

Some service providers may process information outside the United Kingdom. Where this occurs, we use an appropriate legal safeguard, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved contractual clauses or another lawful transfer mechanism, together with proportionate security checks.

9. How long we keep information

We keep information only for as long as needed for patient care, legal, professional, regulatory, safeguarding, financial, insurance, complaint-handling and business purposes. Retention periods differ according to the record and the age and circumstances of the patient.

• Clinical, prescribing, dispensing and patient-care records are retained in line with applicable legal, professional, safeguarding and indemnity requirements.
• Financial and transaction records are normally retained for at least six years where required for tax, accounting or legal purposes.
• Complaint, incident, audit and governance records are retained according to their seriousness, legal relevance and our retention schedule.
• CCTV footage and website security logs are kept for a proportionate period and longer only where needed for an incident, investigation or legal claim.
• Marketing information is retained until you unsubscribe or consent is withdrawn, subject to keeping a minimal suppression record so that we respect your choice.

10. Security

We use proportionate technical and organisational safeguards, including access controls, strong passwords, role-based permissions, secure clinical systems, encryption where appropriate, staff confidentiality requirements, locked storage, backups, audit logs, incident procedures and secure disposal. No internet or electronic system is completely risk-free, but we regularly review our controls.

11. Your rights

• To be informed about how your information is used.
• To request access to personal information we hold about you.
• To ask us to correct inaccurate or incomplete information.
• To ask for deletion where the law permits it.
• To ask us to restrict processing in certain circumstances.
• To object to certain processing, including direct marketing.
• To request transfer of information where data portability applies.
• To withdraw consent where processing is based on consent.
• To ask for human review where a decision is made solely by automated means and has a legal or similarly significant effect.

To exercise a right, contact hello@medlineclinics.co.uk. We may need to verify your identity. Some rights are limited where we must retain or use information for healthcare, pharmacy, legal, regulatory, safeguarding or public-interest reasons.

12. Automated processing and online screening

Online forms may use rules to identify missing information, possible exclusions, duplicate requests or the need for further assessment. A healthcare professional makes the final clinical decision. Treatment is not approved solely by an automated system.

13. Cookies

Our website uses essential cookies and may use optional analytics or marketing cookies with your consent. Details and controls are provided in our Cookie Policy and cookie banner. You can change optional-cookie choices at any time.

14. Children and representatives

Our services are primarily intended for adults. Where a service is lawfully provided to a child or young person, we will consider age, capacity, consent, safeguarding and the information rights of the child and any person with parental responsibility. A representative may act for an adult where they have appropriate authority, but we may still need to communicate directly with the patient.

15. Privacy questions and complaints

Contact us first at hello@medlineclinics.co.uk, telephone 0333 054 0542, or write to Medline Online Pharmacy & Clinics, 175 Chelmsford Road, Shenfield, Essex, CM15 8SA. We will take reasonable steps to investigate and respond. You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority for data protection.

16. Changes to this notice

We may update this notice to reflect changes in law, guidance, technology, suppliers or services. The current version and date will be displayed on the website. Where a material change affects how active patient information is used, we will provide additional notice where appropriate.