Privacy Policy

Digitalpharm Ltd (company no. 11444197), trading as AIPA, of Spaces, 1 Concourse Way, Sheffield City Centre, Sheffield S1 2BJ, is the data controller for the personal data described in this policy. We are registered with the Information Commissioner's Office under reference ZB884604.

Our Data Protection Officer is Lewis Norwood, who can be reached at lewis@pharmacymentor.com. General privacy enquiries and data rights requests can also be sent to privacy@aipax.co.uk.

• As a controller — for our website visitors, prospects, and the staff accounts of pharmacies that subscribe. This policy covers that.
• As a processor — for patient conversations and enquiries handled by the assistant on a pharmacy's website. There, the pharmacy is the controller and decides why data is used. Our terms for that are in the Data Processing Agreement, and patients should read the pharmacy's own privacy notice.

• Account data — name, work email, phone, job role, pharmacy name and locations, password hash.
• Billing data — plan, billing contact, VAT details, invoices and payment references. Card details are handled by our payment provider, not stored by us.
• Usage data — pages viewed, features used, log data, IP address, browser and device information, and error diagnostics.
• Support and enquiry data — messages you send us, demo requests and correspondence.
• Customer content — the website content we scan for your knowledge base, plus the assistant configuration you set.
• Patient conversation data — processed on behalf of pharmacies, and may include contact details a patient leaves and health-related information a patient chooses to type. We do not ask patients for health data, and the assistant is configured to deflect clinical questions to your team.

• Providing the service and managing your account — performance of a contract.
• Billing, collections and accounting records — contract and legal obligation.
• Support, security, fraud prevention and service monitoring — legitimate interests in running a safe, reliable service.
• Product improvement using aggregated or anonymised statistics — legitimate interests.
• Marketing emails to business contacts about AIPA — legitimate interests or consent, with an unsubscribe link in every message.
• Non-essential cookies and analytics — consent, which you can withdraw at any time.
• Complying with law, regulators and lawful requests — legal obligation.

Where patient conversations contain health information, the pharmacy as controller relies on its own condition under Article 9 of the UK GDPR (and the EU GDPR where the pharmacy is established in the EU), usually the provision of health care by or under the responsibility of a professional bound by confidentiality.

We share data with service providers who process it on our instructions. Our current sub-processors are listed in the Data Processing Agreement and include our cloud hosting and database provider, our AI model providers, our email delivery provider, our payment provider and our error monitoring provider.

We also share data with professional advisers, and with regulators or law enforcement where we are legally required to. We do not sell personal data.

Our cloud hosting, database and payment processing providers are based in the UK and EU. Some providers — our AI model provider, email delivery provider and website-scanning provider — are based in the US.

For transfers outside the UK we rely on UK adequacy regulations, or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses. For transfers outside the EU/EEA we rely on EU adequacy decisions or the EU Standard Contractual Clauses. In each case we carry out a transfer risk assessment and apply supplementary measures where needed.

• Account data — for the life of the subscription and 12 months after closure.
• Billing and accounting records — 6 years, as required by UK tax law.
• Patient conversation transcripts — 12 months by default, or the shorter period configured by the pharmacy.
• Enquiry and form submissions — retained under the pharmacy's own retention policy, and deleted on their instruction.
• Server and security logs — 90 days.
• Marketing contacts — until you unsubscribe, then a suppression record only.

We use encryption in transit and at rest, row-level access controls in the database, role based access for staff, least-privilege service credentials, audit logging, and monitoring with incident alerts. No system is completely secure, and we will notify affected customers and the ICO where a reportable breach occurs.

• Strictly necessary — sign-in session, security and load balancing. These are always on.
• Functional — remembering your theme and widget state.
• Analytics — understanding how the site is used, set only with your consent.

Non-essential cookies are only set after you agree on our cookie banner. You can change your choices at any time using the Cookie preferences link in the footer of any page, or in your browser settings.

Under UK GDPR (and EU GDPR where you are in the EU), you have the right to:

• Access a copy of your personal data.
• Have inaccurate data corrected.
• Have data erased where there is no continuing reason to keep it.
• Restrict or object to processing, including objecting to direct marketing at any time.
• Receive your data in a portable format.
• Withdraw consent where consent is the basis, without affecting earlier processing.

To exercise a right, email privacy@aipax.co.uk. We respond within one month. If you are a patient who used a pharmacy's assistant, please contact that pharmacy first, as they control the data. You can also complain to the Information Commissioner's Office at ico.org.uk, or to your local EU data protection authority if you are in the EU.

AIPA is sold to pharmacy businesses and is not directed at children. The assistant may be used by members of the public on a pharmacy website, and pharmacies must configure it in line with their own safeguarding and age-related policies.

We may update this policy. We will post the new version here with a revised date, and notify account holders by email where the change is material.