Privacy Notice

1. Who we are

Imaan Ltd is the data controller for personal data collected through WalkInClinics.uk.

• Registered address: 2 Micklehead Business Village, St Michaels Road, St Helens, Merseyside WA9 4YU
• Company number: 06415284
• ICO registration number: ZA387968 (Tier 1, registered 29 May 2018)
• Contact email: info@imaanhealthcare.com
• Data Protection Officer: not appointed (not required for our processing).

2. Data we collect

• MenB priority list details you submit: contact email, mobile number, postcode and your consent choice.
• Information you choose to send us if you contact us, make a privacy request, or ask a support question.
• Technical data: IP address, browser type, device, pages visited, referrer.
• Cookies: see our cookies policy.

3. How we use your data and our lawful basis

• To send you updates about the MenB programme and local pharmacy appointment information where you have joined the priority list, lawful basis: consent.
• To share your details with participating pharmacies where you have consented and may be eligible, lawful basis: consent.
• To keep the site secure and prevent fraud, lawful basis: legitimate interests.
• To measure how the site is used, lawful basis: consent (via the cookie banner).
• To meet legal obligations, lawful basis: legal obligation.

4. Who we share data with

For the MenB programme, where you have given consent, we share the minimum data needed (such as your email, mobile number and postcode area) with one or more GPhC-registered pharmacies near you so they can contact you about the MenB service. Those pharmacies are separate data controllers responsible for your clinical care, and their own privacy notices will apply once they contact you. You can withdraw this consent at any time.

We use service providers ("processors") who act only on our instructions:

• Hosting and infrastructure: Hostinger (server hosting) and Supabase (database and authentication).
• Text messages: The SMS Works Ltd (appointment confirmations and service messages by SMS).
• Email delivery: Google (Google Workspace / Gmail, appointment confirmations and service messages by email).
• Analytics: not currently used.
• Payment processing: not applicable (we do not take payments).

We do not sell your personal data. We share data with regulators or law-enforcement only where required by law.

5. Nomination requests to a pharmacy

A pharmacy's website can let you ask it to be your nominated pharmacy for NHS prescriptions. If you use that form, these are the details it collects:

• your name, date of birth, address and postcode, and email address
• your middle names, GP surgery and mobile number, if you give them
• the words you agreed to when you ticked the box, and when you ticked it

Who uses them. The pharmacy you asked uses them to set your nomination on the NHS system, and to contact you about your request. The pharmacy is the data controller for them. We run the website and the system that holds them for it.

Lawful basis. Providing NHS services (public task), and health or social care for anything about your health. The box you tick records that you agreed to the nomination, as NHS rules require. It is not the lawful basis for using your details.

Emails. We email your details to the pharmacy's own email address, so its team can act on them. We email you when your request arrives, and again when your nomination is set. Google delivers these emails for us.

How long we keep them. A request is kept for 2 years after the pharmacy sets your nomination. If it is never set, it is kept for 2 years after it arrived. That is long enough for the pharmacy to answer a question or complaint about your nomination. Then it is deleted automatically, with our record of the emails about it. The email the pharmacy receives stays in its mailbox, under its own records policy.

To ask about your request, or to use your rights below, contact the pharmacy or use our privacy request form.

6. Click and collect orders

If you order from a pharmacy's shop on this site to collect in store, we collect:

• your name, mobile number and email address
• anything you write in the note, and what you ordered and when
• a scrambled form of your internet address, used only to stop repeated orders from the same place on the same day

Who uses them. We take your order and pass it to the pharmacy you chose, and we email and text you about it (when it is received, and when it is ready). We are the data controller for that. The pharmacy supplies the items and takes payment, and is a separate data controller for the sale and for any conversation with its pharmacist. Its own privacy notice applies to those.

Lawful basis. Taking steps at your request to enter a contract (your order). Where an order includes a pharmacy medicine, the pharmacist uses it to speak to you when you collect, as part of providing health or social care.

How long we keep them. An order is kept for 2 years after it is collected or cancelled, which is long enough to answer a question or complaint about it, and is then deleted automatically with our record of the messages about it. The scrambled internet address is deleted after 2 days. The pharmacy keeps its own record of the sale under its own records policy.

7. International transfers

Your data is processed in the UK, our database (Supabase) is hosted in London. If a processor ever stores or accesses data outside the UK, we rely on UK adequacy regulations or, where needed, the UK International Data Transfer Agreement (IDTA) / Addendum to the EU SCCs.

8. How long we keep data

• MenB priority list (email, mobile number and postcode area): until you withdraw consent, or up to 24 months after the MenB programme ends, whichever is sooner.
• Nomination requests (section 5): 2 years after the nomination is set, or after the request arrived if it never is.
• Click and collect orders (section 6): 2 years after the order is collected or cancelled; the scrambled internet address, 2 days.
• Booking records: not currently collected on this public site.
• Account data: not currently collected on this public site.
• Support correspondence: up to 24 months.
• Analytics: not currently collected (we use essential cookies only).

9. Your rights

Under the UK GDPR you have the right to:

• Access a copy of your personal data.
• Have inaccurate data corrected.
• Have your data erased ("right to be forgotten").
• Restrict or object to processing.
• Receive your data in a portable format.
• Withdraw consent at any time (where we rely on consent).
• Complain to the Information Commissioner's Office (ICO), ico.org.uk.

To exercise any of these rights use our privacy request form. We will respond within one month.

10. Security

We use technical and organisational measures appropriate to the risk, including encryption in transit and access controls. No online service can be guaranteed 100% secure.

11. Children

Our services are not directed at children under 13. Where a service is intended for older minors (e.g. the MenB university programme), we collect only the data needed for that purpose.

12. Changes to this notice

We will update the "Last updated" date above when this notice changes. Material changes will be highlighted on the homepage.