Our approach to your privacy
We want you to feel confident about sharing your personal data with us and to understand how your information is collected, used and protected.
We are committed to being transparent about how we handle personal data, keeping information secure and respecting your privacy.
This privacy notice explains who we are, what information we collect when you use the Community Pharmacy website, how we use it and what rights you have in relation to your personal data.
What is this privacy notice for?
Community Pharmacy is a website providing information about the Community Pharmacy programme, including policies, research, clinical knowledge and other information relevant to community pharmacy in Scotland.
This privacy notice applies to your use of the website and explains how we handle personal data collected through your visit, including information submitted through website forms.
Who we are
Community Pharmacy is a website provided by NHS National Services Scotland (NHS NSS) in support of the Scottish Government’s Community Pharmacy programme.
NHS NSS is part of NHS Scotland and provides a range of national support services on behalf of the Scottish Government. NHS NSS operates this website on behalf of the Scottish Government.
For the purposes of data protection legislation, NHS NSS is identified as the data controller for the personal data described in this notice. A data controller determines the purposes and means of processing personal data.
We may use other organisations to provide services that support the operation of the website. Where these organisations process personal data on our behalf, they may act as data processors. Other organisations may also process information in accordance with their own responsibilities and applicable privacy notices.
The organisations and services relevant to this website may include:
Microsoft Azure
Microsoft Azure provides cloud infrastructure used to host the website. Access to personal data by the hosting provider is subject to the applicable service arrangements, security controls and contractual terms.
Google provides reCAPTCHA v2, which is used to help protect website forms against spam and automated submissions. Google Analytics is also used to collect information about website usage, as described in the relevant sections below.
The remainder of this notice explains what information we collect and how it is used.
The data we collect and how we use it
We may collect the following categories of information when you use the website.
Technical information
When you visit the website, technical information may be collected automatically through server logs and other technologies. This may include:
- Your internet protocol (IP) address.
- Browser type and version.
- Operating system and device information.
- Time zone settings.
- Information about requests made to the website.
- The date and time of your visit.
This information helps us operate, maintain and secure the website, investigate technical problems and monitor its performance.
Technical information may be capable of identifying an individual, particularly when combined with other information. We therefore handle it in accordance with applicable data protection requirements.
Information submitted through website forms
If you submit information through a form on the website, we will process the information you provide for the purpose for which it was collected.
Please avoid including unnecessary personal or confidential information in form submissions.
Information submitted through the website is accessible only to authorised persons and service providers where access is necessary for the operation of the service, subject to applicable security arrangements and data protection requirements.
Information collected through security services
We use Google reCAPTCHA v2 to help distinguish genuine visitors from automated activity and reduce spam submissions through website forms.
When reCAPTCHA operates, Google may process technical information about your browser, device and interactions with the website to assess whether activity is likely to be automated. Depending on the implementation, Google may also use cookies or similar technologies.
Further information is available in Google’s reCAPTCHA documentation.
Information collected through analytics
We use Google Analytics to understand how visitors use the website and to help us identify areas for improvement.
The information collected may include pages visited, the duration of visits, the source of website traffic, browser and device information, and errors encountered while using the website.
The information available to us depends on the Google Analytics configuration and the consent choices made by visitors.
Further information about Google’s data collection practices is available in Google’s Analytics documentation.
Retaining your data
We retain personal data only for as long as necessary for the purposes for which it was collected, taking account of applicable legal, operational and records-management requirements.
Technical information and server logs are retained in accordance with the website’s retention arrangements. The retention period for server logs is currently specified as no more than 90 days, subject to confirmation against the applicable hosting and logging configuration.
Information collected through Google Analytics is subject to the retention settings configured for the service.
Information submitted through website forms is retained in accordance with the relevant purpose, applicable retention schedule and records-management requirements.
Cookies and similar technologies
Cookies are small files stored on your computer, phone or tablet when you visit a website. Websites may also use other technologies to store or access information on your device.
We use cookies and similar technologies to support website functionality and security and, where enabled, to understand how visitors use the website.
The cookies and other technologies used depend on the services enabled on the website and how those services are configured.
Strictly necessary cookies
Some cookies or similar technologies may be necessary to provide a service you request or to support essential website functionality and security.
We use Google reCAPTCHA v2 to help protect forms against spam and automated submissions. Google reCAPTCHA may use cookies and process technical information to assess potentially automated activity.
Google identifies a cookie named _GRECAPTCHA as being used for risk analysis by reCAPTCHA. Other Google cookies or storage technologies may also be involved, depending on the implementation.
Where a cookie or similar technology is strictly necessary under applicable law, consent may not be required. This does not mean that every cookie associated with a security service is automatically exempt.
Analytics cookies
Google Analytics may use cookies, including _ga and _ga_*, to distinguish users and sessions and help measure website usage.
These cookies are not strictly necessary for the basic operation of the website. Where consent is required, analytics cookies and associated storage will only be used after you have given consent.
The information collected and the length of time it is retained depend on the analytics configuration.
Managing your cookie preferences
You can manage your cookie preferences through the cookie controls provided on the website, where available.
You can also block or delete cookies through your browser settings. The help section of your browser provides instructions on how to do this.
Blocking certain cookies or technologies may affect some website functionality.
For more information about cookies and similar technologies, see the Information Commissioner’s Office guidance.
Purpose and legal basis for processing
We process personal data to operate and maintain the Community Pharmacy website, provide its information and functionality, protect it against spam and automated activity, monitor its performance and improve the service.
The legal basis for processing depends on the purpose and type of information involved.
Where applicable, NHS NSS relies on Article 6(1)(e) of the UK GDPR, which permits processing where it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
Where special category personal data is processed, an additional condition under Article 9 of the UK GDPR may be required.
Where cookies or similar technologies are used, the requirements of the Privacy and Electronic Communications Regulations (PECR) must also be considered. The legal basis for processing personal data does not, by itself, remove any separate requirement to obtain consent for cookies or similar technologies.
Keeping information secure
We take appropriate technical and organisational measures to protect personal data against accidental loss, destruction or damage, and against unauthorised access, alteration or disclosure.
Access to personal data is restricted to authorised individuals and service providers who require it for legitimate purposes.
No internet-based service can be guaranteed to be completely secure. We work to maintain appropriate safeguards and to manage security risks in accordance with our responsibilities.
Your data protection rights
Under the UK GDPR and Data Protection Act 2018, you may have the following rights in relation to your personal data:
- The right to be informed about how your personal data is used.
- The right to access your personal data.
- The right to have inaccurate personal data corrected.
- The right to have personal data erased in certain circumstances.
- The right to restrict processing in certain circumstances.
- The right to data portability in certain circumstances.
- The right to object to certain types of processing.
- Rights relating to decisions made solely by automated means, including profiling, where applicable.
You also have the right to complain to the Information Commissioner’s Office (ICO) if you believe your personal data has been handled incorrectly.
These rights are subject to legal conditions and exemptions. Some rights may not apply in every situation. Requests will be considered in accordance with applicable data protection legislation.
Exercising your rights
If you have a question about this privacy notice, wish to exercise your data protection rights or have a concern about how your personal data is handled, please email: nss.showteam@nhs.scot
For information about personal data processed by NHS NSS, you can also consult the NHS NSS data protection notices:
Contact details of the NHS NSS Data Protection Officer
NHS National Services Scotland
Email: nss.dataprotection@nhs.scot
Postal address: Gyle Square, 1 South Gyle Crescent, Edinburgh, EH12 9EB
Telephone: 0131 275 6000
Information Commissioner’s Office
If you are dissatisfied with how your personal data has been handled, you can raise a complaint with the Information Commissioner’s Office (ICO), the UK’s independent data protection regulator.
Website: https://ico.org.uk/
Postal address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Telephone: 0303 123 1113