Privacy notice

For the Oswaldtwistle Pharmacy website and app. Last updated 20 October 2026.

This notice explains what personal information we collect through our website and app, why, who we share it with, how long we keep it, and your rights. It covers the website and app only. When you visit the pharmacy in person, or we provide NHS services such as dispensing your prescriptions, our in-store privacy notice also applies; ask us for a copy.

Who we are

, trading as Oswaldtwistle Pharmacy, 300 Union Road, Oswaldtwistle, Accrington, BB5 3JD, is the data controller for the information described here. We are a registered pharmacy (GPhC registration 9010870) and are registered with the Information Commissioner's Office (registration ).

Our data protection lead is . You can contact them about anything in this notice: call 01254 399898, email , or write to us at the address above.

What we collect, and why

What	Why	Our lawful basis
Your name, mobile number, email and delivery address when you order	To prepare, deliver or hand over your order, take payment and contact you about it	Contract; legal obligation (keeping sales records)
What you tell us when you ask to return something (the reason and what's happened), and any refund	To sort out the return, refund or replacement, kept with your order	Contract; legal obligation (consumer rights, sales records)
Your mobile number, if you press Notify me on something out of stock	To text you once when it's back in stock (the text doesn't say what it is). Deleted once we've texted you, or after 90 days	Consent (you asked us to)
Answers to health questions when you buy a pharmacy medicine	So a pharmacist can check the medicine is safe and suitable for you, as the law requires	Contract and legal obligation; health data: providing health care (UK GDPR Article 9(2)(h))
Appointment and vaccination bookings: your name, date of birth, contact details, GP practice, NHS number if you give it, your answers to eligibility and health questions, and what was done. If we book you by phone or at the counter with just your mobile, we text you a private link to a form for the rest: it shows only your first name, works only for that booking until the end of its day, and what you send goes on your booking	To provide the service safely, keep a record of the care we gave, and tell your GP or the NHS where the service requires it	NHS services: performing a task in the public interest; private services: contract. Health data: providing health care (Article 9(2)(h))
Repeat prescriptions, when you tell us you've ordered one (and where, and whether we're your nominated pharmacy) or ask us to order it: the patient's name, date of birth, mobile number, GP surgery, NHS number if you give it, the medicines and quantities, and a delivery address if you choose delivery	To look out for the prescription or ask the GP surgery for it (we email the surgery the patient's name, date of birth, NHS number and the medicines, from our secure NHSmail account), get it ready, and tell you when it's ready. If part of it is owed (our supplier hasn't got it), we record what's owed and when we expect it, show it to you in Your visits, and message you when it arrives (the message never names a medicine). Next time, the page shows your last request so you can order it again in one tap, but only to someone with your 6-digit code and postcode, your phone (a code we text to it), or a phone or computer you asked us to remember. Typing your name on a form never shows it	Providing health care (UK GDPR Article 6(1)(e) and, for health data, Article 9(2)(h))
Repeat prescriptions we order for you from your GP surgery on a schedule, if you've asked us to: the patient's name, date of birth, address and postcode, mobile, email and NHS number if we have them, the medicines we order, how often, the date of the next order, your GP surgery, your prescription exemption (or that you pay), collect or delivery, and each order (when, by whom, what, from which surgery, and whether the surgery issued it; the last 100)	To ask your GP surgery for your repeat prescription in good time, every time, and have it ready for you. We send your surgery your name, date of birth, NHS number and the medicines, from our secure NHSmail account to the surgery’s own nhs.net address (or our staff send it themselves and note how), and note when it was sent, by whom and to which address. We keep a copy of each request we send to your surgery, and a record of what our staff did with your repeat (without your name in it), for two years; if you ask us to erase your details, your part is taken out of each copy. If we managed your repeats in Healthera before, our staff may bring your name, medicines and next order date across from it, with the contact details Healthera holds for you, and we keep a copy of what it said with your repeat (as long as your repeat). One brought across before we set them up straight away is deleted after 30 days if it isn't set up here	Providing health care (UK GDPR Article 6(1)(e) and, for health data, Article 9(2)(h))
Blister packs, if you sign up (or sign up someone you look after): the patient's name, date of birth, address and postcode, GP surgery, mobile and email if given, NHS number if you give it, every medicine for the packs with how many at each time of day, medicines that can't go in a pack, allergies, when their medicines run out, how often the prescription comes, who orders it, and collect or delivery. If you look after them, your name, mobile and how you know them. It's kept on your account, which the form makes if you haven't one	For a pharmacist to check the medicines suit a pack, to make up the packs for each supply, to order the prescription from the GP surgery if you asked us to, and to message you: a reminder to order two weeks before packs are due (if you order it yourself), that we've ordered it, and that the packs are ready. The messages never name a medicine	Providing health care (UK GDPR Article 6(1)(e) and, for health data, Article 9(2)(h))
Prescription reminders, only if you ask for them: the patient's first name, the mobile number, how often the prescription is due, when the next one is due, and when you asked	To remind you about a week before your next repeat prescription is due. The message never names a medicine	Your consent, which you can withdraw at any time (the link in every reminder, or ask us)
Checking in when you arrive, on the screen in the pharmacy or on your phone: the patient's name, address and postcode, date of birth if you give it (we need it, and not the address, to find an appointment), why you're here (collecting a prescription, a missed delivery or an online order, or an appointment), your answers to that visit's questions (such as who you're collecting for, and their name), and any note you add. If we can't find your appointment, what it's for and your mobile number, to book you in as a walk-in (an appointment record, as above, with the details you gave), and, if you ask, a text with a link to add the rest. If you save your details, they go in your profile (below)	To let the team know you're here, find your prescription, delivery or appointment (and mark you arrived for it, or book you in for it if we can't find it), and call your number. The team sees, next to your ticket, what else you have with us that day (another appointment, blister packs, a prescription request or an online order), so they don't have to look for it. The screen itself never shows your appointment. Waiting-time reports use totals only, never names. The waiting-room screen shows ticket numbers only	Providing health care (UK GDPR Article 6(1)(e) and, for health data, Article 9(2)(h))
Your saved details and 6-digit code, only if you choose to save them (after checking in, booking, filling in the form we text you, asking for a prescription or registering for a jab) or have an account: your name, date of birth, mobile, email, address, postcode and NHS number if you give them, and when the code was last used. Appointments, check-ins, orders and prescription requests you make for yourself while signed in or with your code are linked to them, and you can see those in Your account. Details you give for someone else (booking for a child, say) are never saved to yours	So the code, with your postcode, fills your details in at the check-in screen, on our website and in our app, and you don't have to type them again. The list helps the pharmacy team look after you	Your choice to save them (contract); the list: providing health care (Article 9(2)(h))
Each year, the pharmacy team looks back at who we've seen, and works out from age and past jabs who looks eligible for an NHS flu or COVID-19 vaccination that season. Before contacting anyone, we check our dispensing records or the NHS Spine. If we know someone has passed away, we keep their name and date of birth so they're never contacted	To invite people who may be eligible for a free NHS jab, so nobody who should be offered one is missed, and never to upset a family by contacting someone who has died	NHS vaccinations: performing a task in the public interest; health data: providing health care (Article 9(2)(h)). Tell us if you'd rather not be invited, and we won't
In our app only, and only if you say yes: your phone works out whether you're at the pharmacy, to offer you the check-in. Your location is checked on your phone and is never sent to us or anyone else	To offer the check-in as you walk in	Your choice; you can turn it off in your phone's settings at any time
The offers list, only if you join it: your mobile number, your first name if you give it, and what you agreed to, when and where	To text you offers and seasonal health news, no more than twice a month	Your consent, which you can withdraw at any time (the link in every text, or ask us)
Our email newsletter, only if you sign up and confirm: your email address, your first name if you give it, the topics you chose, and what you agreed to, when and where. If you've ordered from us with the same email address, we use that to choose which newsletters go to you (for example, one for recent customers)	To email you health news, seasonal advice and offers, no more than twice a month	Your consent, which you can withdraw at any time (the unsubscribe link in every newsletter, or ask us)
A basket reminder, only if you ticked “remind me” at checkout (we no longer ask; the last ones go within 7 days): your mobile number, your email and first name if you give them, and what's in your basket (never pharmacy medicines)	To send you one text (or email) two hours later if you haven't finished your order, with a link that puts your basket back. It never says what's in it	Your consent: place your order, or ask us, and we delete it
Messages you send us in live chat (and what our virtual assistant, if it's switched on, said back), and requests for a business account	To answer you	Legitimate interests (helping customers); contract
An account, if you create one: your mobile number (if you sign in with a code we text you) or your email and a password, your name, your saved details and code (above), and when your mobile was last checked. A password is stored only as a one-way hash, which nobody can read, our staff included. The sign-in codes we text are kept only as a scrambled (one-way) version, for a day	So you don't have to type your details each time, and so only you can see and spend your points. If you forget your password, a pharmacist can set a new one for you	Contract
If you ask us to text you your 6-digit code: a scrambled (one-way) version of the mobile number you typed and when you asked. We text the code only to the number we already have for you, and never show it on the screen	To stop the same number being texted more than three times a day	Legitimate interests (preventing misuse)
Loyalty points, gift cards and discount codes	To give you the rewards you've earned or bought	Contract
Security records: sign-in attempts and a scrambled (hashed) form of your internet address	To stop people guessing passwords or flooding the site	Legitimate interests (keeping your information safe)
If a page breaks in your browser: the error's own words, which of our files and which page, and the kind of device (phone, tablet or computer). Nothing about you, nothing you typed, and no address; kept for 30 days	To find and fix what's broken	Legitimate interests (keeping the site working)
Only if you agree: which of our public pages you visit, roughly where you came from (such as a Google search), your device type and town or region, through Google Analytics cookies	To see how people use the site so we can improve it	Your consent, which you can withdraw at any time

We only send marketing (our offers texts and email newsletter) to people who've signed up themselves, and anyone can leave at any time. To see which products people look at, the shop counts views, baskets, checkouts and searches by the day without knowing who: no cookies, and nothing is kept on your device. To count each visitor only once a day, the website briefly keeps a scrambled (one-way) version of your internet address and browser, mixed with a random value that changes every day, and deletes it after two days; we can't work out your address from it, and only the day's count is kept (our legitimate interest in understanding how the shop is used). We don't sell your information, we don't use it to make automated decisions about you, and the website and app don't show adverts or follow you around other websites.

Texts and WhatsApp messages

If you give us a mobile number, we may send you messages about your order or appointment, such as a reminder the day before. We send them by WhatsApp where you use it (it's cheaper for us), and otherwise by text. They never say which service or medicine they're about. Reply STOP or call us if you'd rather not get them.

If you reply to one of our messages, we keep your reply, your number and the name on your WhatsApp profile for 30 days, so a member of staff can read it and answer you (by WhatsApp if you wrote to us there in the last day, otherwise by text, or by ringing you), and then it's deleted automatically. We keep what we answered with it. If you reply STOP, your prescription reminders and offers stop straight away. Replies are only seen by the pharmacy's staff, and the email that tells us a reply has arrived never says who it's from or what it says.

If you get blister packs, we message whoever looks after them (you, or the person you named): two weeks before packs are due if you order the prescription yourself, when we order it if we do, and when the packs are ready. These are part of the service, so they come whether or not you've asked for other reminders.

Prescription reminders and offers only go to people who've asked for them. Every one has a link to stop them, and stopping takes effect straight away. Offers always come by text, never WhatsApp, between 9am and 8pm.

Live chat and our virtual assistant

Our live chat may be answered first by a virtual assistant. It is an AI, not a person, and the chat says so. It answers simple questions about our opening hours, services, prices and delivery from what is on this website. It hands your chat to a member of staff when it can't help, when you ask for a person (the “Talk to a person” button is always there), and when you mention an emergency. It never gives medical advice, and it can't see your orders, prescriptions or any account.

To answer, the words of your chat are sent to Anthropic, the company that runs the AI, in the USA. Before they go, we remove anything that looks like an email address or a phone number, and we never send the name or number you gave to start the chat. Please don't put health details or personal information into the chat: ask for a person instead. Anthropic handles it under its commercial terms, which don't allow it to train its AI models on it.

If you choose Continue on WhatsApp, WhatsApp opens with the chat so far typed in for you, and a short reference. Nothing is sent until you press Send in WhatsApp. When it reaches us, your WhatsApp number is kept with that chat, what you send on WhatsApp joins it, and our replies go to your WhatsApp (or by text, if it's been more than a day since you last wrote there). The chat is kept for as long as any other chat.

A member of staff can read the whole chat, including what the assistant said, and can step in at any time. Once one does, the assistant stops. We keep a chat for as long as any other chat (see below). We also keep a count of how many questions the assistant answered each day, with nothing from the chats in it, for 90 days.

Who we share it with

Only the companies that run parts of the service for us, under contracts that only let them use it to do that, and only what each one needs:

Netlify, Inc. hosts the website and app and stores the records described above.
Twilio sends our texts and WhatsApp messages, and WhatsApp (Meta) delivers the WhatsApp ones. They see your number and the message.
Anthropic runs the AI behind our live chat virtual assistant, if it's switched on. It sees the words of your chat with email addresses and phone numbers removed, and never your name or number.
Our email provider sends the emails about your order or appointment, and password reset links, if you gave us an email address. It sees your email address and the email: for an order, what you ordered and the total; for an appointment, the time but never what it's for.
Stripe takes card payments. You type your card details into Stripe's own secure form; we never see or keep your card number. Stripe is told the amount and your email address (it sends your receipt there), never what you ordered. If you pay with Apple Pay or Google Pay, Apple or Google passes your payment to Stripe in the same way. Stripe also uses payment details to prevent fraud, as its own privacy policy explains. If your business has an account with us, Stripe also sends your invoices, and sees the business name, the email address they go to, and what's on them.
Cloudflare checks that forms like booking, sign-up and prescription requests are sent by a person, not a program (Cloudflare Turnstile). It looks at how your browser behaves, not what you type, and sets no cookies.
Google runs Google Analytics for us, only if you agree to analytics cookies (see below).
Ideal Postcodes finds the addresses for a postcode when you check in, if we've switched the address finder on. It's sent the postcode only, never your name.

Google reviews on our home page. The reviews at the bottom of the home page are public reviews of the pharmacy on Google Maps. When you scroll to them, our server asks Google for the latest ones and passes the reviewers' profile pictures on to you, so your browser doesn't contact Google to show them and nothing about you is sent to Google. We don't keep a copy of the reviews.

Some of these companies are based in, or use systems in, the USA. Where your information is handled outside the UK, it's protected by the safeguards UK law requires, such as the UK International Data Transfer Addendum or the UK-US data bridge.

We also share information when the care we give needs it (for example, asking your GP surgery for a repeat prescription, telling your GP about a vaccination, or recording it on the NHS's own vaccination system), or when the law requires it.

How long we keep it

Orders, payments and gift cards: 6 years, for our accounts and tax records.
Invoices for card payments (your name, email and, for a delivery, address; what you bought and the VAT): 6 years, as the law requires for VAT records. If you ask us to erase your details, we keep the invoice but remove your name, email and address from it. You can see and print yours on the Track your order page, with your order reference and mobile number.
Pharmacy medicine sales and the health answers given: kept with the order, 6 years.
Appointments, consultations and vaccinations: as health records, following the NHS Records Management Code of Practice (generally 8 years after your last care for adults, and longer for children).
Your account: until you delete it.
Live chat: 2 years after the last message. Business account requests: 2 years after we last dealt with them.
The vaccine waiting list: 1 year after you joined.
Checking in at the pharmacy: 1 year.
Your saved details and 6-digit code: until 2 years after you last used them, unless you have an account (then until you delete it). You can ask us to delete them at any time.
Repeat prescription requests: 1 year after it was collected, delivered or cancelled. The record of what we dispensed is kept in our dispensing system, as the law requires.
Repeat prescriptions we order for you on a schedule: while we order them, then 1 year after they stop.
Blister packs: while you get them, then 1 year after they stop. A form we text you that isn't filled in: 30 days. The record of what we dispensed is kept in our dispensing system, as the law requires.
Prescription reminders: until you stop them, then 90 days. If you haven't told us about a prescription for a year, they stop and are deleted.
The offers list: until you leave it, when you're taken off straight away. If we haven't sent you an offer for a year, you're taken off.
The email newsletter: if you don't confirm, 7 days. Then until you unsubscribe, when you're taken off straight away. If we haven't sent you a newsletter for a year, you're taken off.
A basket kept for a reminder: 7 days at most, and deleted as soon as you order.
Which texts and emails we sent you: 90 days (we only keep the last three digits of your number, and the first letter and domain of your email address, in these logs).
Password reset links: they work for an hour, and we delete them the next day.
Sign-in codes we text you: they work for 10 minutes, and we delete them the next day. A request to text you your 6-digit code: two days.
Backups: we copy everything once a day so nothing is lost if something goes wrong, and delete each copy after 14 days. If we erase your details, they're gone from the backups 14 days later.
Security records: a day for sign-in attempts; a year for our security log, which never holds your contact details.

The shorter periods are cleared automatically each day.

How we keep it safe

Everything travels encrypted (HTTPS). Staff each have their own named account, and only pharmacists can look up, export or erase a customer's records. Passwords are stored only as one-way hashes. Every staff sign-in and every look-up, export or erasure of customer data is recorded in a security log that can't be edited.

Cookies and what's saved on your device

The site keeps your basket, wishlist and preferences in your browser (or the app) so they're there next time; these aren't sent to us until you order. A cookie keeps you signed in if you have an account, and if you tick Remember me on this device when you use your 6-digit code, a cookie called owp_patient fills your details in for a year (Not you? on any form forgets it). Your choice of day or night colours, whether you've seen the "get the app" message, and your answer about the check-in offer in the app are kept in your browser too. These are needed for the site to work, so they don't need your agreement. The check-in screen in the pharmacy remembers its language and accessibility settings, and nothing about you (it never remembers a code): it clears your details from the screen 30 seconds after you've checked in.

Analytics cookies, only if you say yes. We ask before using Google Analytics, and nothing from it runs until you agree. If you do, its cookies (named _ga and _ga_ followed by letters and numbers) last up to 13 months and tell us which of our public pages are used, how people find us, and their device type and rough area. We've set it up so that:

it never runs on staff pages, your appointment or order look-ups, or the private links we text you;
it isn't told what you search for, your name, phone number, booking references or what you order (only an order's total value);
Google can't use it for adverts or link it to your Google account (Google signals and ad personalisation are switched off);
Google acts for us under its data processing terms, and may handle the data in the USA, with the safeguards UK law requires.

You can change your mind at any time: . Saying no removes the analytics cookies from this browser.

The fonts on our pages come from our own site, not from other companies. You can clear everything the site saved at any time on the Delete your account or data page.

Your rights

You have the right to:

get a copy of the information we hold about you;
have anything wrong corrected;
have it erased, or its use restricted, where we don't have to keep it (we can't erase a health record we're required to keep, but we can stop using it for anything else);
object to how we use it, where we rely on legitimate interests;
delete your account yourself at any time, on the Delete your account or data page.

If you're unhappy with how we've handled your information, please tell us. You can also complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, or call 0303 123 1113.

Your NHS data and the national data opt-out

Information from NHS services we provide may be used, in a form that doesn't identify you where possible, for planning and research. You can choose to stop your confidential information being used this way: see nhs.uk/your-nhs-data-matters. This doesn't affect the care you receive.

Changes to this notice

We'll update this page if anything changes, and change the date at the top.