Policy template for pharmacies

AI patient assistant on our website

Our website uses an AI patient assistant ("AIPA") to answer general questions about our
services, opening hours and locations, to take enquiries and to pass messages to our team.
The assistant is provided by Digitalpharm Ltd trading as AIPA (company no. 11444197),
registered office Spaces, 1 Concourse Way, Sheffield City Centre, Sheffield S1 2BJ, ICO registration ZB884604.

We are the data controller for the information you give the assistant. AIPA acts as our
data processor under a written data processing agreement and only processes your data on
our instructions.

What we collect through the assistant
- The messages you send and the replies the assistant gives.
- Any contact details you choose to provide (for example name, phone number and email) when
  you ask to speak to a member of our team or submit a form.
- Technical information such as the page you were on, approximate location derived from the
  town or postcode you type, and the time of the conversation.

Please do not share detailed medical information in the chat. The assistant is not a
clinical service and cannot give medical advice. In an emergency call 999, or call 111 for
urgent medical help.

Why we process it and our lawful basis
- To answer your enquiry and provide our services — legitimate interests, or steps prior to
  entering a contract with you.
- To contact you back when you request it — legitimate interests or consent.
- To improve the accuracy and safety of the assistant — legitimate interests.
Where a message includes health information, we rely on Article 9(2)(h) UK GDPR (provision
of health care) or your explicit consent.

How long we keep it
Conversations and enquiries are retained for 12 months by default, or the shorter period
configured in our dashboard settings, and then deleted.

Who your data is shared with
AIPA and its sub-processors host the service, generate the assistant's replies and deliver
notification emails to us. The current list is published at https://aipax.co.uk/dpa.
Some of these providers are outside the UK; transfers are protected by UK adequacy
regulations or the UK International Data Transfer Addendum to the EU Standard Contractual
Clauses.

Your rights
You can ask us for a copy of your data, to correct it, or to delete it. Contact us at
[INSERT YOUR PHARMACY EMAIL] or write to [INSERT YOUR PHARMACY ADDRESS]. You also have the
right to complain to the Information Commissioner's Office (ico.org.uk).

Processors we use for the AI patient assistant

Digitalpharm Ltd trading as AIPA — provides the patient assistant and dashboard (UK).
AIPA uses the following sub-processors on our behalf:
- Cloudflare, Inc. — hosting and delivery of the website assistant (global edge).
- Supabase — database, authentication and file storage (EU).
- OpenAI, L.L.C. — generating assistant replies, speech and transcription (US).
- Postmark (ActiveCampaign, LLC) — notification and enquiry emails (US).
- Mollie B.V. — subscription billing for our pharmacy account (EU).
- Firecrawl (Sideguide Technologies, Inc.) — reading our published website content so the
  assistant can answer accurately (US).

An up-to-date list is maintained at https://aipax.co.uk/dpa.

AI assistant (cookies and local storage)

The AI patient assistant stores a small identifier in your browser so a conversation can
continue across pages, and remembers whether you have dismissed the chat window. These are
strictly necessary for the assistant to work once you open it. No advertising or
cross-site tracking cookies are set by the assistant.