Privacy Policy

1. Who controls your information

XRP Health Ltd, trading as Letter Box Pharmacy, is the data controller for information processed through this public website and for pharmacy services we provide. Our company number is 13961391 and our address is 4 Brick Lane, London E1 6RF.

Some linked services may involve another pharmacy, prescriber, clinician, NHS body or technology provider acting as a separate controller or processor. Where that applies, the relevant service will identify them and provide any additional privacy information before data is collected.

2. What this notice covers

This notice covers visits to letterboxpharmacy.co.uk, enquiries sent to us, NHS prescription support, pharmacy services, consultations, orders, deliveries, feedback and complaints handled by Letter Box Pharmacy.

Our TRT and weight-loss pages include an embedded booking form supplied by XRP Clinical Platform at xrp-clinical-platform-web.vercel.app. Information you enter in that form is submitted directly to the booking platform and is handled under the privacy information shown within that service, alongside the parts of this notice that apply to Letter Box Pharmacy’s clinical or dispensing role.

When you follow a link to app.letterboxpharmacy.co.uk or another service, information entered there is handled under the privacy information displayed by that service as well as any parts of this notice that apply to Letter Box Pharmacy’s clinical or dispensing role.

3. Information we may use

• Identity and contact details: name, address, date of birth, email address, telephone number, NHS number and identity-check information.
• Health and care information: symptoms, diagnoses, medicines, allergies, medical history, consultation answers, prescriptions and records of pharmacy care. Health data receives additional legal protection.
• Order and transaction details: products or services requested, payment status, invoices, delivery instructions and communications. Full card details are normally handled by the payment provider rather than stored by us.
• Professional and service details: information received from or shared with your GP, prescriber, NHS services, another healthcare professional, carer or authorised representative.
• Technical information: IP address, browser and device type, requested pages, timestamps, security events and server logs generated when the site or linked service is used.
• Feedback and correspondence: messages, calls, complaints, survey responses and records of how an issue was handled.

4. Why we use information and our legal bases

Where we rely on legitimate interests, we balance the purpose against your rights and reasonable expectations. We do not use solely automated decisions that produce legal or similarly significant effects unless the relevant service explains the safeguards and lawful basis.

5. Who we may share information with

We share only what is reasonably necessary with:

• our pharmacists, pharmacy staff, prescribers and other healthcare professionals involved in your care;
• your GP, NHS organisations, the Electronic Prescription Service and other care providers where needed for safe care, payment or an NHS service;
• authorised technology, hosting, payment, communications, identity-check, dispensing and delivery suppliers working under contract;
• professional advisers, insurers, auditors, regulators, public authorities or law-enforcement bodies where required or permitted by law; and
• a buyer or successor if our business is reorganised, subject to appropriate confidentiality and data protection safeguards.

We do not sell personal or health information. If a supplier processes information outside the UK, we use a lawful transfer mechanism and appropriate safeguards, or another permitted basis, as required by UK data protection law.

6. How long we keep information and how we protect it

We keep information only for as long as needed for the purpose collected and to meet pharmacy, NHS, professional, tax, insurance and legal obligations. The period depends on the record:

• the public-site demonstration forms retain nothing after the page is closed or reset;
• routine enquiries are normally kept for up to 24 months after they are resolved, unless they form part of a care, order or complaint record;
• clinical, prescription, dispensing and NHS records follow the applicable statutory, NHS and professional retention periods;
• transaction, tax and contractual records are normally kept for up to six years after the relevant financial year or contract ends; and
• security logs are kept for the shortest practical period consistent with investigating faults, abuse and security incidents.

We use administrative, technical and physical safeguards appropriate to the sensitivity of the information. No internet service is completely secure, so use the secure service offered for health or payment information and tell us promptly if you believe information has been compromised.

7. Your data protection rights

Depending on the circumstances, you may have rights to be informed, obtain a copy of your information, correct inaccurate information, request deletion or restriction, receive certain data in a portable format, object to processing, and withdraw consent. You also have rights relating to solely automated decisions.

Some rights are limited where pharmacy, NHS, medicines or other laws require us to retain or use a record. We may need to verify your identity before acting. There is normally no fee, and we will respond within the period required by law.

Your right to object: you can object at any time to direct marketing. You may also object to processing based on legitimate interests by explaining your circumstances.

8. Children and representatives

Our services are not designed for children to purchase restricted medicines independently. A parent, guardian, carer or authorised representative may act for another person where the law and the relevant service allow it. We may verify authority and, where appropriate, consider the child or patient’s capacity, confidentiality and best interests.

9. Contact, complaints and updates

Contact us to exercise a right or complain about how we have handled your information. Please write “Data protection” in the subject line. We will investigate and explain our response.

If you remain unhappy, you can complain to the Information Commissioner’s Office. We would appreciate the opportunity to address your concern first.

We review this notice when our services, suppliers or legal duties change. Material changes will be published here with a new update date.