Privacy Policy

This Privacy Policy explains how we collect, use, store, and share personal data when you create an account, subscribe, use enterprise features, generate reports, contact us, or browse our websites.

PharmAnalyser provides organisation-level NHS pharmacy and GP analytics for business and research professionals. We do not provide patient-identifiable care records and we do not ask you to upload patient-identifiable special category health data.

Our Terms of Service govern your use of the service and complement this policy.

We collect and store the categories below in our application database (hosted PostgreSQL). We do not copy bulk NHS datasets into user account tables.

A. Account and authentication

• Name, email address, password hash (if you use email sign-in), and profile preferences.
• Authentication identifiers and OAuth tokens when you choose Google sign-in.
• Session metadata needed to keep you signed in securely.

B. Billing and subscriptions

• Main-app subscription status, plan tier, Stripe customer and subscription identifiers, and invoice metadata.
• Enterprise contracts and entitlements are recorded separately from consumer checkout; we do not run fixed Stripe Checkout for bespoke enterprise deals.

C. Enterprise membership

• Organisation name, team membership, roles, permissions, invites, and workspace settings.
• Audit-relevant membership changes may be retained for contract administration.

D. Product usage (signed-in users)

• Page navigation and in-app activity events stored in our app database (first-party analytics via /api/session/pulse and /api/session/note).
• Device class and viewport signals included in pulse payloads to understand product use — not used to build advertising profiles.

E. Reports, snapshots, and sharing

• Report job records, billing linkage, selected section identifiers, and storage keys for generated PDFs and frozen JSON snapshots in private object storage.
• Optional public share tokens you create, revocation timestamps, and optional expiry when that product setting is enabled.
• Email addresses and optional notes you enter when using in-product “email this report” sharing — used only to send the message you request.

F. NHS and open data displayed in the product

• We display organisation-level pharmacy, GP, and geography data sourced through our analytics pipeline and read API.
• These datasets are not patient-identifiable and are not stored in your user profile as bulk NHS tables.

G. Local Search Intelligence (on-demand)

• When you run on-demand local search intelligence queries, we process pharmacy identifiers, query parameters, job status, and quota accounting in our analytics infrastructure.
• Fresh ranking observations are fetched by our background analytics pipeline using specialist local-search, mapping and business-information providers (Google Maps SERP–style tasks: keyword, coordinates, and pharmacy context — not your account email). The public analytics API enqueues jobs only; it does not embed vendor credentials in the browser.

H. Cookies, similar technologies, and email

• Essential cookies for login and consent preferences; optional analytics cookies only after consent (see Cookies section).
• Transactional email delivery metadata (recipient, template type, provider message id, bounces/complaints) via our email provider.
• Contact form submissions including name, email, message, and limited device metadata for abuse prevention.

PharmAnalyser aggregates and presents organisation-level statistics from official NHS and open-government publishers. Figures may revise when publishers issue updates.

Official data publishers (NHS bodies, regulators, open-government portals) decide their own purposes and lawful bases for publishing datasets. They are independent controllers or public authorities for those publications — not subprocessors of your account data merely because we download or display organisation-level figures.

Our first-party analytics infrastructure (pipeline, read API, and organisation-level database) stores and serves those datasets under our control. It processes your account data only when you use the product; bulk NHS tables are not copied into your user profile.

Some NHS, regulatory, and open-business datasets we display include names or contact details relating to healthcare professionals, company officers, or business contacts (for example GP practitioners listed against a practice, pharmacy superintendent or owner names from regulator records, or officers returned from a Companies House lookup you initiate). These individuals are usually not PharmAnalyser account holders.

Why we process this information

• To provide organisation-level search, pharmacy and GP detail pages, reports, and related analytics you request.
• To present regulator-sourced professional roles where the source dataset includes them.
• To support login-gated company lookups you choose to run (search terms and identifiers are sent server-side; we do not expose bulk practitioner exports in the browser).

Lawful basis

For these indirectly sourced professional data we rely on legitimate interests: operating a professional B2B analytics service, presenting data already published or lawfully disclosed by third-party sources, and minimising fields shown where the product allows. Where we contact you about your account, contract performance applies instead.

Sources and storage

• NHS and PHS open-data feeds ingested by our analytics pipeline (for example practitioner directories linked to GP practices).
• Regulatory registers (GPhC, PSNI, and related pharmacy metadata).
• Companies House API responses for lookups you request while signed in.
• Local Search Intelligence may include business listing titles and addresses from Maps search observations — typically organisation or commercial listings rather than patient data.

These fields live in our analytics database and object storage used for reports — not in your user profile row. Retention follows pipeline refresh cycles and report storage rules below; we do not retain Companies House officer responses as a separate marketing list.

Disclosure

Professional identity fields may appear to you and other authorised users according to plan, enterprise permissions, and report sharing settings you control. We do not sell personal data lists.

Your rights

If you are named in published professional data and wish to exercise UK GDPR rights, contact support@pharmanalyser.co.uk. We will consider requests in light of source publication, our role, and applicable exemptions. Where Article 14 requires direct transparency to individuals, we address that through our privacy programme and source attribution in the product.

We rely on UK GDPR lawful bases as follows:

• Contract — to provide accounts, subscriptions, enterprise access, reports, watchlists, and support you request.
• Legitimate interests — to secure the service, prevent abuse (including contact-form and public report share rate limits), monitor errors, improve product quality, and operate organisation-level analytics infrastructure.
• Consent — for non-essential analytics cookies and tags (Google Analytics 4 and Ahrefs) until you opt in via our consent banner.
• Legal obligation — where we must retain billing records for tax and accounting.

The table below separates parties by role. “Subprocessor” means a provider that processes personal data on our documented instructions for the purposes in this policy.

Subprocessors (on our instructions)

• Vercel — hosting, CDN, Speed Insights, and Vercel Analytics traffic metrics.
• Supabase / PostgreSQL (application database) — user, billing, enterprise, notifications, and first-party usage events.
• Sentry — error monitoring when enabled (stack traces, request context, optional user id tag — no NHS patient data).
• Resend — transactional email (support, invites, watchlist alerts, report share messages). We do not use open/click tracking on these service emails.
• Cloudflare Turnstile — contact-form bot protection.
• Google Analytics 4 — product analytics with Consent Mode (storage denied until you opt in).
• Ahrefs — site analytics script loads only after the same analytics consent choice.
• Specialist local-search, mapping and business-information providers — on-demand Local Search Intelligence Maps queries from our pipeline (keywords and coordinates near a pharmacy — not your account email).
• Mapbox — map tiles when you open map features (token requests may log IP and device signals at Mapbox).
• Amazon Web Services (S3) — private storage for generated report PDFs and frozen report snapshots.
• Sanity — content management for legal and editorial pages when enabled; published legal text is served read-only to the website.
• IndexNow — optional server-side notification of public URL changes to search engines (URLs only, no user profiles).

Independent controllers (your direct relationship)

• Google — when you choose Google sign-in, Google processes authentication data under its own terms and privacy notice.
• Stripe — when you pay for a main-app subscription, Stripe processes payment data as merchant processor under its terms.
• Companies House — when you run a lookup, Companies House processes your query under its API terms; officer names in responses are their publication.

First-party infrastructure we operate

• PharmAnalyser analytics API and analytics database — organisation-level NHS and regulatory datasets; internal service keys stay server-side.
• Hetzner, Cloudflare edge, and Upstash Redis — infrastructure for analytics hosting, protection, and rate limiting where deployed.

We will update subprocessors before relying on new providers for personal data on our instructions. NHS and open-government publishers remain data sources, not subprocessors of your account, as described in the NHS data section.

Some subprocessors and infrastructure providers may process personal data outside the United Kingdom (for example in the United States or European Economic Area). Transfer mechanisms depend on the provider, our contract with them, and UK GDPR requirements at the time of processing.

Contractual transfer tools depend on each provider. You may request information about transfers relevant to your account by contacting support@pharmanalyser.co.uk.

We keep personal data only as long as necessary for the purposes above:

• Account and enterprise records — for the life of the account plus any legal or contractual hold.
• Billing records — up to seven years for tax and accounting obligations.
• First-party usage events — typically up to twenty-four months, then aggregated or deleted.
• Contact submissions — typically up to twenty-four months for operational follow-up.
• Generated report PDFs and frozen snapshot JSON in your account — until you delete the report or close your account, subject to backup and legal retention limits.
• Public share links — until you revoke the link or an expiry time passes when the product applies a default link lifetime; revoking or expiring a link stops public access but does not by itself delete the underlying report files stored for your account.
• Email delivery logs and suppression lists — operational periods needed to prevent repeat sends to invalid or complaining addresses.

Essential cookies include your authentication session and consent preferences. Google Analytics uses Consent Mode v2 with analytics storage denied by default until you opt in. Ahrefs measurement loads only after the same analytics consent.

Vercel Analytics and Speed Insights run as part of hosting and are not gated by the analytics consent cookie. You can change analytics consent when cookie controls are shown on the site.

When you generate a report, we store organisation-level content you selected in private storage and link it to your account for download and optional sharing.

Share links (/r/{token}) display frozen organisation-level report web copy. Depending on product configuration at the time we enable a release, links may work for anyone with the URL (bearer access) or may require the recipient to sign in to a PharmAnalyser account. When sign-in is required, a Free account is sufficient to open a link you were invited to view; signing in does not grant access to the purchaser’s account, billing, or other reports.

Share-by-email sends a transactional message to addresses you enter (up to five recipients per request). When sign-in is required for shared reports, emails contain the web link and sign-in guidance only — not a PDF attachment. When bearer access applies, emails may include a PDF attachment as well as the link.

We do not operate a separate “report viewer analytics” product that tracks identifiable viewers of shared links. Standard web server and CDN logs, short-lived in-memory rate limits on share-by-email actions, and security monitoring may process IP addresses and user agents for abuse prevention.

You may revoke a share link in the product. New links may receive a fixed lifetime from creation (for example thirty days) when that product default applies. Revocation or expiry ends public access; your stored report in the account is handled under the retention rules above.

On-demand Local Search Intelligence sends parameterized queries through our analytics API. Usage counts toward plan or enterprise quotas. Failed or empty provider observations may be credited according to product rules described in our Terms when those rules are enabled.

Fresh observations are retrieved by our ETL pipeline via specialist local-search, mapping and business-information providers (Google Maps SERP–style results). Requests include search keywords and coordinates near the subject pharmacy — not your login email. Those providers are listed in the subprocessor category above; vendor terms and transfer arrangements are managed under our supplier review process and internal vendor register.

We implement access controls, encryption in transit, and monitoring appropriate to a B2B analytics platform. No online service is completely secure; please use a strong password and notify us promptly if you suspect unauthorised access.

Under UK GDPR you may request access, correction, deletion, restriction, objection, or portability of your personal data where applicable.

Contact support@pharmanalyser.co.uk to exercise these rights. We may need to verify your identity. You may also complain to the Information Commissioner's Office (ICO) if you believe processing is unlawful.

PharmAnalyser is intended for healthcare business, analytics, and research professionals. It is not directed at children and must not be used for clinical decision-making about individual patients.

We may update this policy when our processing activities or subprocessors change. Material updates will be reflected with a revised last-updated date. Coordinated releases may align with updated Terms when we enable new product features.

Privacy requests and questions: support@pharmanalyser.co.uk. Postal address: 32 St. Andrews Road, Glasgow, Scotland, G41 1PF, United Kingdom.