Data Protection Agreement
The Data Processing Addendum that governs how Pharmace Digital processes personal data on behalf of subscribing pharmacies.
Schedule 1 — Data Processing Addendum (DPA). This Data Processing Addendum forms part of the Subscription Agreement between Pharmace Digital Limited (Processor) and the subscribing pharmacy organisation (Controller).
1. Roles of the Parties
The Customer acts as Data Controller, determining the purposes and means of personal data processing. Pharmace Digital Limited acts solely as a Data Processor, processing personal data on behalf of and under the instructions of the Controller. The Processor processes data only per documented Controller instructions unless legally required otherwise.
2. Nature and Purpose of Processing
The Processor provides pharmacy operation software including prescription tracking, patient notifications, controlled drug register management, incident recording, and staff management. Processing encompasses collection, storage, retrieval, transmission (for messaging), and deletion of data.
3. Categories of Data and Data Subjects
Data Subjects
Patients, pharmacy staff, and members of the public (incident records).
Personal Data
Names, addresses, contact numbers, encrypted NHS numbers, prescription/medication information, staff details, and incident records.
Special Category Data
Health-related data associated with prescriptions and controlled drug records.
4. Data Ownership and Use
The Customer retains full ownership of all personal data processed under this Agreement. Pharmace Digital does not acquire any rights in the data. The Processor cannot sell data, share it with third parties for independent purposes, or use it for analytics or marketing unrelated to service delivery. Customers retain the right to export their data.
5. Data Sharing and Sub-processors
Data sharing occurs only for service delivery. The following approved sub-processors are used solely for service delivery:
- Amazon Web Services (UK)
- MongoDB Atlas (UK region)
- Esendex (UK)
All sub-processors maintain appropriate data protection obligations.
6. Duration and Retention
Processing continues throughout the Subscription Agreement. Following termination, data will be retained in line with pharmacy and medico-legal requirements for a minimum of 7 years, after which it will be securely deleted.
7. Security and Processing Obligations
The Processor implements encryption, role-based access controls, secure authentication, and audit trails. Resilience measures include hourly snapshot backups and continuous backup with point-in-time recovery. Personnel maintain confidentiality obligations. The Processor notifies Controllers of breaches promptly and assists with GDPR compliance.
8. International Transfers
No personal data is transferred outside the United Kingdom.
9. Audit and Compliance
The Processor provides information demonstrating compliance and supports reasonable audit requests.
10. Governing Law
This Addendum shall be governed by the laws of England and Wales.
11. Status of this Addendum
This Addendum automatically forms part of the Subscription Agreement without requiring signature unless the parties agree otherwise.
Questions about this policy?
Get in touch and a real person who knows the work will help. No ticket numbers.