This is the privacy notice for Joseph Cowper Ltd (Cowper’s Chemist).
It explains the types of personal data we may collect about you when you interact with us. It also explains what we do with this information. Please read it carefully. We hope it will answer any questions you may have, but if not please do get in touch with us.
Who we are
Joseph Cowper Ltd. is an NHS Community Pharmacy and chemist’s shop and has been serving the people of Penrith and district for more than one hundred and seven years, since opening in 1899.
We aim to provide you with the highest quality of healthcare. To do this we need to keep records about you, your health and the care we have provided or plan to provide for you.
Our address is 49-50 King Street, Penrith, Cumbria, CA11 7AY.
Telephone number: 01768 862063.
Email is through our website: https://www.cowperspenrith.co.uk/
Data Controller
Because we are an NHS Community Pharmacy, we adhere to NHS rules and act on its instruction. For the purposes of data protection the organisation that decides the purposes for which and the way in which any personal information, or data is used, is the data controller. The NHS is therefore the data controller for recording what NHS services are provided for you and reporting this to them.
For all other services Joseph Cowper is the data controller. This privacy notice gives you information both about what the NHS instructs us to do with your personal data when we provide NHS services and what Joseph Cowper does with your personal data for its own purposes.
The person responsible for compliance with our data protection legislation is Catherine Hunt. You can contact her using the details given above.
Why we collect information about you
If anyone can be identified by any information that we collect, this information is called ‘personal data’. Data protection law says that Joseph Cowper Ltd. or its data controller/s must have a reason or ‘purpose’ for collecting and using personal data.
What we have agreed with the NHS that we will do:
keep records of the healthcare that we provide and any payment that we receive from you for this service; provide reports to the NHS so that they can use the information to ensure that appropriate professional and service standards are maintained, that any information that you give us is accurate and accurately recorded by us and for planning and research purposes.
You may choose to opt out of the NHS using your data for planning and research purposes – please ask for details.
Where Joseph Cowper Ltd. is the data controller, our purposes are to:
- provide medicines or other goods that have been prescribed by your doctor or another qualified person;
- deliver additional services such as flu or covid vaccinations;
- update you with any public health alerts, drug recall and changes in treatment advice and also information relevant to your condition(s);
- help in improving your wellbeing by informing your health decisions through advice, diagnostic testing and the management of chronic conditions;
- sell you our products through our shop or online;
- manage our relationship with you;
- keep internal records &
- inform you by email, web or post of relevant products and special offers, discounts, promotions, events, competitions etc.
Personal data we may collect about you:
- basic details about you, such as your name, date of birth and contact details;
- records of medicines you have been prescribed by your doctor or another qualified prescriber, which have been supplied by this pharmacy;
- details of medicine purchased from the pharmacy without a prescription (“over the counter medicines”);
- other details and notes about your health and medical treatment
- information relevant to your continued care from other people who care for you and know you well such as other health professionals and relatives;
- any other healthcare services that we provide to you, for example, a flu vaccination;
- eligibility for free prescriptions and other NHS services;
- payment details for both NHS and private purchases;
- details of your visits to our website including which site you came from to ours;
- your shopping preferences;
- any comments and product reviews you may post about us on our social media sites &
- information gathered by the use of cookies in your web browser to help us evaluate use of our site (for example popular areas) and improve the functionality of our site. To find out more about how we use cookies, click here or see Cookie Policy section on website
How we ensure that the processing we do is lawful
Joseph Cowper Ltd. cannot use your personal data for any reason unless we have a lawful basis to do so.
Special category personal data is information that is regarded as being particularly sensitive and therefore requires more protection. Information about a person’s health is classed as Special Category personal data and there must be an additional lawful basis.
The NHS states:
GDPR Article 6 (1)(e) – where we process personal data as part of our statutory functions under the Health and Social Care when requested by other bodies, such as the Devolved Administrations and IOMDHSC, the process is part of our public task.
NHS Digital processing of special category data (sensitive personal data)
GDPR Article 9(2) (h) – ‘processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services’.
Data Protection Act 2018, schedule 1, part 1, paragraph 2, sub paragraph (2), sub paragraph (f) – ‘the management of health care systems or services or social care systems or services’.
The lawful bases that Joseph Cowper Ltd. uses are:
Provide medicines or other goods that have been prescribed by your doctor or another qualified person;
Deliver additional services such as flu or covid vaccinations and
Update you with any public health alerts, drug recall and changes in treatment advice and also information relevant to your condition(s):
- The processing is necessary – to undertake a public task
For special category personal data:
- Processing is necessary for the purpose of preventative or occupational medicine, … or the management of health or social care systems and services...
Help in improving your wellbeing by informing your health decisions through advice, diagnostic testing and the management of chronic conditions:
- We have a legitimate interest in using your information
For special category personal data:
- The data subject has given explicit consent to the processing of the personal data for one or more specified purposes
Sell you our products through our shop or online
- The processing is necessary - for the performance of a contract to which the data subject is a party, or for the taking of steps at the request of the data subject with a view to entering into a contract;
- The processing is necessary for compliance with any legal obligations to which the data controller is subject, other than an obligation imposed by contract
Manage our relationship with you
- We have a legitimate interest in using your information. This information allows us to effectively process queries and improve delivery of our services to you. We may use feedback given to us.
Keep internal records
- The processing is necessary for compliance with any legal obligations to which the data controller is subject, other than an obligation imposed by contract
Keep you informed by email, web and post of relevant products and special offers, discounts, promotions, events, competitions and so on.
- The data subject has given consent to the processing.
If you give consent you have the right to withdraw this at any time by contacting us in writing using the address or contact details given in this privacy notice.
If you disagree with us using your personal data for one or more of our legitimate interests let us know in writing and we will assess whether we can stop using it for that purpose.
How long do we keep your information?
Whenever we collect or process your personal data, we’ll only keep it for as long as is necessary for the purpose for which it was collected.
At the end of that retention period, your data will either be deleted completely or anonymised, for example by aggregation with other data so that it can be used in a non-identifiable way for statistical analysis and business planning.
We keep:
- Details of financial transactions and payments for a period of 7 years.
- Contact and other details of customers with whom we have/have had a working relationship that is not related to provision of healthcare and for organisations or individuals who contact us, 7 years after the last contact.
- Medical records are kept for the length of time specified by the NHS – see https://www.england.nhs.uk/publication/corporate-records-retention-disposal-schedule-guidance/
Who Do We Share Your Personal Information With?
We sometimes share your personal data with trusted third parties. These are listed below.
When we share your personal data with these third parties who perform services for us, we require them to take appropriate steps to protect your personal information, and only to use the personal information for the purpose of performing those specific services.
Name of company/organisation
The service they perform for us
Bewell ( St Mary’s Court, The Broadway, Amersham, Buckinghamshire HP7 0UT) Same address as Medicine Chest)
IT/web site hosting
Bewell - Website maintenance
The Pharmacy Centre - Email
BT - Telephone (land line)
Saint & Co - Accountants
Barclays Bank - Bank
* Facebook (now Meta) - Social media platform
P&W Confidential - Confidential waste disposal
We will never sell or distribute your personal information to any other third parties or make it public unless we have a legal obligation to do so, for example when we provide the NHS with information.
*Please be aware that these firms are data controllers in their own right, and we recommend that you read their privacy notices.
We do not transfer personal data outside the European Economic Area.
Your rights
You have rights in relation to the personal information we hold about you. These are:
- The right to be informed about the collection and use of your personal data. We do this by providing you with this privacy notice.
- The right of access. This is commonly referred to as ‘subject access’. You have the right to make a request to see all the personal data that Joseph Cowper holds holds about you, including any medical records. You can make this request verbally or in writing and we must respond within one calendar month.
- The right to rectification. If you believe that any information we are holding on you is incorrect or incomplete, please write to or email us as soon as possible at the above address and we will promptly record your request and amend our records if required.
- The right to erasure. This is also known as ‘the right to be forgotten’. You can make this request verbally or in writing. This right only applies in certain circumstances.
- The right to restrict processing. This right only applies in certain circumstances. If we agree to restrict your personal data for one or more purposes we will store it but not use it.
- The right to data portability. This allows you to obtain and re-use your personal data for your own purposes across different services. If you would like us to transfer your personal data electronically, we will do this. It only applies to information you have given us, which we hold electronically and where Joseph Cowper Ltd. is the data controller.
- The right to object. You have the right to object to the processing of your personal data in certain circumstances. You can make an objection verbally or in writing. You have the absolute right to stop your personal data being used for direct marketing.
- Rights in relation to automated decision making and profiling. Joseph Cowper Ltd. does not use any of your personal data to make automated decisions, however we do create profiles of our clients/customers. You have the right to stop us doing this and can do so by contacting us in writing at the address given.
If we are unable to act upon your request we will explain to you the reasons for this.
In addition, as a provider of services for local government and/or the NHS, Joseph Cowper Ltd’s clients or their representatives have the right to opt out of having clients’ personal data being disclosed for anything other than their care or support.
The National data opt-out does not currently apply to any personal data which Joseph Cowper Ltd. discloses, however we wish to make clients aware of this right.
How to complain
If you are unhappy about the way we handle your personal data please let us know verbally or in writing by contacting us at the address given.
We will explain how we have processed your personal information and if we have made a mistake will tell you how we will put this right.
If you are still dissatisfied, you may report your concern to the Information Commissioner’s Office (ICO) by contacting:
Wycliffe House, Water Lane, Wilmslow SK9 5AF
Tel. 0303 123 1113
or go online to www.ico.org.uk/concerns
Original: March 2023
Review and updated: Jan 2026
Next review due: Jan 2029 or before if changes
