Privacy Policy

Version: Review Draft 1

1. INTRODUCTION

Welcome to Curigo.

Curigo is committed to protecting your privacy and ensuring that your personal information is handled responsibly, securely and in accordance with applicable UK data protection legislation and professional healthcare standards.

This Privacy Policy explains how Curigo collects, uses, stores, protects and shares your personal information when you visit our website, create an account, complete an online consultation, purchase medicines or healthcare products, communicate with us, or otherwise use our services.

As a provider of healthcare services, we recognise that much of the information we process is sensitive health information requiring the highest standards of confidentiality and security. We are committed to processing your personal information fairly, lawfully and transparently while ensuring that appropriate safeguards are in place to protect your privacy.

Please read this Privacy Policy carefully before using our services.

By accessing our website or using any of our services, you acknowledge that you have read and understood this Privacy Policy.

2. WHO WE ARE

Curigo ("Curigo", "we", "our" or "us") is a United Kingdom private online pharmacy providing clinical consultations, healthcare advice and the supply of medicines and pharmacy products to eligible patients.

Our services are delivered remotely through our secure online platform and may include consultations conducted under Patient Group Directions (PGDs), independent prescribing services (where available), private prescriptions, and other private healthcare services introduced as our business develops.

The healthcare services available through Curigo may change from time to time. This Privacy Policy applies to all services, products and features made available through our website unless otherwise stated.

All medicines supplied by Curigo are subject to an appropriate clinical assessment and are only provided where our pharmacists or prescribers determine that treatment is safe, appropriate and in the patient's best interests. The availability of medicines or services on our website does not guarantee that treatment will be supplied.

3. DATA CONTROLLER

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, Curigo is the Data Controller responsible for determining how and why your personal information is processed.

Our contact details are:

Curigo

Email: privacy@curigo.co.uk

Website: www.curigo.co.uk

If Curigo appoints a Data Protection Officer (DPO), or another individual responsible for data protection compliance, their contact details will be published on our website.

4. LEGISLATION AND REGULATORY COMPLIANCE

Curigo processes personal information in accordance with applicable legislation and professional standards, including where relevant:

• UK General Data Protection Regulation (UK GDPR)
• Data Protection Act 2018
• Privacy and Electronic Communications Regulations (PECR)
• Human Rights Act 1998
• General Pharmaceutical Council (GPhC) Standards for Registered Pharmacies
• Medicines legislation applicable within the United Kingdom
• Professional standards applicable to pharmacists, pharmacy technicians and prescribers
• Other legislation and regulatory guidance relevant to the operation of a UK private online pharmacy.

Where legislation or regulatory guidance changes, Curigo may update this Privacy Policy accordingly.

5. SCOPE OF THIS PRIVACY POLICY

This Privacy Policy applies whenever you:

• visit our website;
• create a Curigo account;
• complete an online consultation;
• upload information or documents;
• communicate with Curigo by email, telephone or secure messaging;
• purchase medicines or pharmacy products;
• receive a private clinical consultation;
• receive medicines supplied under a Patient Group Direction (PGD);
• receive medicines prescribed by an independent prescriber (where available);
• make an enquiry;
• submit a complaint;
• interact with our customer support team;
• participate in surveys or service feedback; or
• otherwise interact with Curigo.

This Privacy Policy applies to website visitors, prospective patients, registered patients, customers, carers, legal representatives and authorised individuals acting on behalf of patients where appropriate.

6. OUR COMMITMENT TO CONFIDENTIALITY

Maintaining patient confidentiality is fundamental to the services we provide.

Healthcare professionals working for or on behalf of Curigo are subject to professional duties of confidentiality as well as legal obligations relating to the handling of personal information.

Access to personal information is restricted to authorised personnel who require access to perform their professional duties.

All members of our workforce receive appropriate training regarding confidentiality, information governance and data protection.

Curigo continually reviews its procedures to ensure patient information remains protected throughout its lifecycle.

7. DEFINITIONS

For the purposes of this Privacy Policy:

Account

Your secure Curigo patient account through which you access consultations, orders, communications and other online services.

Clinical Consultation

Any assessment carried out by Curigo for the purpose of determining whether healthcare advice, medicines or treatment are clinically appropriate.

Consultations may include online questionnaires, secure messaging, telephone consultations, video consultations or any combination of these methods.

Data Controller

The organisation responsible for determining how and why personal information is processed.

For the purposes of this Privacy Policy, Curigo is the Data Controller.

Independent Prescriber

A suitably qualified healthcare professional legally authorised to prescribe medicines independently within the scope of their professional registration and competence.

Medicines

Prescription Only Medicines (POMs), Pharmacy Medicines (P Medicines), General Sales List (GSL) medicines, medical devices and other healthcare products supplied by Curigo where applicable.

Patient Group Direction (PGD)

A written instruction permitting specified medicines to be supplied or administered to groups of patients meeting defined clinical criteria without an individual prescription, in accordance with UK legislation.

Patient Medication Record (PMR)

The electronic clinical record maintained by Curigo containing information relating to medicines supplied, consultations, clinical decisions, pharmacist interventions and other information necessary to support your pharmaceutical care.

Personal Data

Information that identifies, or could identify, an individual.

Examples include:

• name;
• date of birth;
• address;
• telephone number;
• email address;
• account details;
• IP address;
• order history; and
• consultation information.

Special Category Personal Data

Information requiring additional legal protection under UK GDPR, including information relating to:

• physical health;
• mental health;
• medical history;
• medicines;
• allergies;
• diagnoses;
• consultation responses;
• photographs submitted for clinical assessment;
• pregnancy status where clinically relevant; and
• any other information necessary for the safe provision of healthcare.

Processing

Processing means any operation carried out on personal information including collection, recording, organisation, storage, retrieval, consultation, use, sharing, disclosure, deletion or destruction.

Website

The Curigo website, patient portal and any associated digital platform through which Curigo provides its services.

8. OUR DATA PROTECTION PRINCIPLES

Curigo processes personal information in accordance with the principles set out within UK GDPR.

We ensure that personal information is:

• processed lawfully, fairly and transparently;
• collected only for specified, explicit and legitimate purposes;
• adequate, relevant and limited to what is necessary;
• accurate and kept up to date where appropriate;
• retained only for as long as necessary;
• protected through appropriate technical and organisational security measures; and
• processed in a manner that demonstrates accountability and compliance with applicable data protection legislation.

9. INFORMATION WE COLLECT

To provide our services safely, effectively and in accordance with applicable legal and professional requirements, Curigo collects different categories of personal information depending on how you interact with us.

We only collect information that is necessary for the provision of our services, the safe supply of medicines, compliance with our legal and regulatory obligations, and the protection of patient safety.

Information may be collected directly from you, automatically when you use our website, or from third parties where it is lawful and appropriate to do so.

The categories of information we collect are described below.

10. INFORMATION YOU PROVIDE DIRECTLY

When you register for a Curigo account, complete an online consultation, purchase products or medicines, contact us or otherwise use our services, you may provide us with personal information including:

• Full name
• Date of birth
• Residential address
• Delivery address
• Email address
• Telephone number
• Gender where clinically relevant
• Emergency contact information where appropriate
• Communication preferences
• Any additional information you voluntarily provide.

We use this information to identify you correctly, communicate with you, administer your account, provide healthcare services and comply with legal and regulatory obligations.

11. ACCOUNT INFORMATION

When you create a Curigo account we may collect and maintain information including:

• Username
• Securely encrypted password
• Account preferences
• Communication preferences
• Previous consultations
• Order history
• Consultation outcomes
• Login history
• Account activity
• Marketing preferences where applicable

You are responsible for maintaining the confidentiality of your account credentials.

You should notify Curigo immediately if you believe your account has been accessed without your permission.

12. HEALTH INFORMATION

Because Curigo provides healthcare services, we collect health information that is necessary to assess your suitability for treatment.

This information is classified as Special Category Personal Data under UK GDPR and receives additional legal protection.

Depending upon the service you are accessing, we may collect information including:

• Current symptoms
• Presenting complaint
• Medical history
• Previous illnesses
• Existing medical conditions
• Current medications
• Previous medications where clinically relevant
• Allergies
• Previous allergic reactions
• Previous adverse drug reactions
• Height
• Weight
• Body Mass Index (BMI) where relevant
• Smoking status where clinically relevant
• Alcohol consumption where clinically relevant
• Pregnancy status where clinically relevant
• Breastfeeding status where clinically relevant
• Relevant family medical history where necessary
• Lifestyle factors affecting treatment
• Previous treatments
• Previous consultations with Curigo
• Information necessary to assess clinical eligibility.

We only request information that is reasonably necessary for the healthcare service being provided.

13. CLINICAL CONSULTATION INFORMATION

When you complete one of our online clinical consultations we may collect information including:

• Answers to consultation questionnaires
• Clinical declarations
• Eligibility assessments
• Risk assessment responses
• Clinical screening questions
• Free-text responses
• Follow-up information
• Consent confirmations
• Clinical notes recorded by pharmacists or prescribers
• Advice provided
• Clinical decisions
• Outcomes of consultations

The questions asked during consultations vary depending on the service requested.

They are designed to ensure our pharmacists and prescribers have sufficient information to determine whether treatment is safe and clinically appropriate.

Completing a consultation does not guarantee that treatment will be supplied.

Our healthcare professionals may request additional information before making a clinical decision.

14. YOUR RESPONSIBILITY TO PROVIDE ACCURATE INFORMATION

Curigo relies upon the information you provide to make clinical decisions regarding your care and the supply of medicines.

It is your responsibility to ensure that all information provided during consultations is:

• accurate;
• complete;
• truthful; and
• kept up to date.

Failure to provide accurate information may result in:

• treatment being delayed;
• treatment being refused;
• inappropriate treatment recommendations;
• medicines not being supplied; or
• increased risks to your health.

If your circumstances change after completing a consultation, you should notify Curigo as soon as reasonably possible before treatment is supplied.

15. PHOTOGRAPHS, DOCUMENTS AND OTHER UPLOADED INFORMATION

Some healthcare services may require you to upload photographs or supporting documentation.

Examples include:

• photographs of skin conditions;
• photographs of affected areas;
• copies of prescriptions;
• proof of identity;
• proof of address;
• supporting clinical documentation; or
• any other documents reasonably required to assess your eligibility for treatment.

These documents form part of your clinical record where appropriate.

They are only accessible by authorised healthcare professionals and authorised members of our workforce who require access to perform their duties.

Uploaded documents are stored securely and retained in accordance with this Privacy Policy and applicable legal and professional requirements.

16. PATIENT MEDICATION RECORDS (PMRs)

Where Curigo supplies medicines or provides pharmacy services, we maintain a Patient Medication Record (PMR) in accordance with applicable legal, regulatory and professional requirements.

The PMR forms an essential part of your healthcare record and enables us to provide safe, effective and continuous pharmaceutical care.

Depending upon the services you use, your PMR may contain:

• your personal details;
• medicines supplied;
• dates of supply;
• quantities supplied;
• dosage instructions;
• prescribing information;
• consultation outcomes;
• allergies and sensitivities;
• relevant medical conditions;
• pharmacist or prescriber clinical notes;
• interventions made by healthcare professionals;
• safety advice provided;
• referrals made;
• records of adverse reactions reported;
• follow-up information; and
• other information necessary to support your ongoing pharmaceutical care.

PMRs are maintained using secure pharmacy systems with access restricted to authorised personnel.

Access to your PMR is limited to individuals who require access to perform their professional duties or where disclosure is otherwise permitted or required by law.

17. IDENTITY VERIFICATION

Protecting patients from fraud and ensuring medicines are supplied to the correct individual is an important part of our professional responsibilities.

Where appropriate, Curigo may verify your identity before providing healthcare services or supplying medicines.

Depending on the circumstances, we may request information including:

• proof of identity;
• proof of address;
• confirmation of your date of birth;
• confirmation of your contact details;
• photographic identification;
• or other reasonable evidence necessary to verify your identity.

Identity verification requirements may vary depending upon the service requested and the medicines involved.

If adequate identity verification cannot be completed, Curigo reserves the right to delay or refuse treatment until satisfactory verification has been obtained.

18. PAYMENT INFORMATION

Where you purchase medicines, pharmacy products or healthcare services through Curigo, payments are processed securely by authorised third-party payment service providers.

Curigo does not store your full payment card details on its own systems.

We may receive limited payment-related information including:

• payment status;
• transaction reference numbers;
• payment confirmations;
• refund information;
• partial payment identifiers where required for reconciliation; and
• information necessary to investigate payment disputes or suspected fraud.

Our payment providers process payment information in accordance with applicable payment security standards and their own privacy policies.

19. COMMUNICATIONS WITH CURIGO

If you contact Curigo, we may retain records of communications including:

• emails;
• secure messages;
• live chat conversations;
• telephone conversations (where recorded);
• complaints;
• compliments;
• feedback;
• customer service enquiries;
• clinical follow-up communications; and
• correspondence relating to your account or orders.

These communications may be retained for purposes including:

• maintaining accurate clinical records;
• responding to enquiries;
• resolving complaints;
• improving our services;
• staff training;
• quality assurance;
• protecting patient safety;
• complying with legal obligations; and
• defending legal claims where necessary.

20. INFORMATION RECEIVED FROM THIRD PARTIES

In certain circumstances Curigo may receive information from third parties where it is lawful and appropriate to do so.

This may include information received from:

• your GP or GP practice;
• other healthcare professionals involved in your care;
• hospitals or clinics;
• identity verification providers;
• payment service providers;
• delivery providers;
• fraud prevention agencies;
• regulatory authorities; and
• publicly available sources where legally permitted.

Where information is received from third parties, it will be processed in accordance with this Privacy Policy and applicable data protection legislation.

21. TECHNICAL INFORMATION

When you use our website, certain technical information may be collected automatically.

This may include:

• Internet Protocol (IP) address;
• browser type and version;
• operating system;
• device type;
• device identifiers;
• pages visited;
• dates and times of website access;
• referral websites;
• browsing behaviour;
• diagnostic information;
• security logs; and
• other technical information necessary to maintain and improve our website.

This information helps us:

• maintain website security;
• identify technical problems;
• prevent unauthorised access;
• improve website performance;
• understand how visitors use our website; and
• enhance the user experience.

Where possible, website analytics information is anonymised or pseudonymised.

22. COOKIES AND SIMILAR TECHNOLOGIES

Curigo uses cookies and similar technologies to improve the functionality, security and performance of our website.

Cookies may be used to:

• remember your preferences;
• maintain secure login sessions;
• improve website performance;
• understand how visitors use our website;
• analyse website traffic;
• protect against fraudulent activity; and
• enhance your browsing experience.

Further information about our use of cookies, including how you can manage your cookie preferences, is available in our separate Cookie Policy.

23. FRAUD PREVENTION AND MISUSE OF SERVICES

Curigo has a legitimate interest in protecting patients, healthcare professionals and the wider public from fraud and the misuse of healthcare services.

We may process personal information to:

• verify identities;
• detect fraudulent activity;
• investigate suspicious transactions;
• prevent misuse of medicines;
• prevent unauthorised access to accounts;
• investigate breaches of our Terms and Conditions;
• comply with legal obligations; and
• protect the integrity of our services.

Where appropriate, information may be shared with relevant authorities or fraud prevention organisations where permitted or required by law.

24. DATA QUALITY

Curigo is committed to maintaining accurate and up-to-date records.

We take reasonable steps to ensure that personal information is accurate, complete and, where necessary, kept up to date.

If you believe that any information we hold about you is inaccurate or incomplete, please contact us as soon as possible so that we can review and, where appropriate, update our records.

25. HOW WE USE YOUR PERSONAL INFORMATION

Curigo only processes personal information where it is lawful, necessary and proportionate to do so.

The way in which we use your information depends upon the services you request and your interactions with us.

We may process your personal information for purposes including:

• creating and managing your Curigo account;
• verifying your identity;
• assessing your eligibility for treatment;
• conducting clinical consultations;
• determining whether medicines can be supplied safely;
• issuing private prescriptions where appropriate;
• supplying medicines and pharmacy products;
• maintaining accurate Patient Medication Records (PMRs);
• communicating with you regarding your consultations, orders or treatment;
• responding to enquiries;
• processing payments and refunds;
• arranging deliveries;
• maintaining accurate business records;
• complying with legal and regulatory obligations;
• protecting patient safety;
• investigating complaints;
• preventing fraud and misuse of medicines;
• improving our services;
• monitoring website performance;
• protecting our systems against cyber threats; and
• exercising or defending legal claims where necessary.

Curigo will only process information that is reasonably necessary for the relevant purpose.

26. OUR LAWFUL BASES FOR PROCESSING

UK GDPR requires organisations to identify a lawful basis for every processing activity.

Depending upon the circumstances, Curigo may rely upon one or more of the following lawful bases.

Performance of a Contract

Where you request healthcare services or purchase products from Curigo, we process your information because it is necessary to fulfil our contractual obligations to you.

This includes:

• creating your account;
• providing consultations;
• processing orders;
• supplying medicines;
• arranging deliveries;
• responding to enquiries relating to your order or treatment.

Legal Obligation

Curigo is subject to various legal and regulatory obligations requiring us to process certain personal information.

Examples include obligations relating to:

• pharmacy legislation;
• medicines legislation;
• taxation;
• accounting;
• anti-fraud measures;
• court orders;
• regulatory inspections;
• record keeping;
• safeguarding; and
• reporting obligations imposed by law.

Legitimate Interests

In certain circumstances, Curigo processes personal information because it is necessary for our legitimate interests provided those interests are not overridden by your rights and freedoms.

These legitimate interests include:

• maintaining secure IT systems;
• improving website functionality;
• quality assurance;
• investigating complaints;
• staff training;
• business administration;
• fraud prevention;
• cyber security;
• protecting our legal rights;
• improving patient services.

Whenever we rely on legitimate interests, we carefully balance those interests against your privacy rights.

Consent

Certain processing activities rely upon your consent.

Examples include:

• receiving marketing communications;
• participating in optional surveys;
• accepting non-essential cookies; and
• other situations where consent is required by law.

You may withdraw your consent at any time.

Withdrawal of consent does not affect processing carried out before consent was withdrawn.

27. SPECIAL CATEGORY PERSONAL DATA

Much of the information processed by Curigo relates to your health and is classified under UK GDPR as Special Category Personal Data.

Such information receives enhanced legal protection.

Curigo only processes Special Category Personal Data where an appropriate legal condition applies.

Provision of Healthcare

The primary basis upon which Curigo processes health information is that it is necessary for the provision of healthcare and pharmaceutical services.

This enables us to:

• assess eligibility for treatment;
• conduct consultations;
• prescribe medicines where appropriate;
• supply medicines safely;
• monitor treatment;
• maintain healthcare records.

Medical Diagnosis

Health information may also be processed where necessary for:

• clinical assessment;
• medical diagnosis;
• identifying clinical risks;
• determining whether medicines are appropriate;
• identifying contraindications;
• identifying interactions;
• preventing inappropriate treatment.

Healthcare Management

Curigo may process health information where necessary for:

• maintaining Patient Medication Records;
• clinical governance;
• professional supervision;
• healthcare administration;
• quality assurance;
• patient safety;
• internal audit.

Public Health

Where required by law or professional guidance, Curigo may process health information for reasons relating to public health.

Examples include:

• medicine safety monitoring;
• reporting adverse drug reactions;
• safeguarding;
• responding to regulatory investigations; and
• complying with statutory reporting obligations.

28. CLINICAL DECISION-MAKING

All decisions relating to the supply of prescription medicines or clinical treatment are made using professional judgement.

Clinical decisions may take into account:

• the information you provide;
• consultation responses;
• relevant medical history;
• current medication;
• allergies;
• applicable clinical guidelines;
• professional standards;
• prescribing guidance;
• patient safety considerations.

Providing inaccurate, incomplete or misleading information may affect the safety of any treatment supplied.

Curigo reserves the right to decline, delay or refuse treatment where we consider this necessary to protect patient safety or where sufficient information has not been provided to allow a safe clinical assessment.

29. CLINICAL SAFETY

Patient safety is our highest priority.

Completion of an online consultation does not guarantee that treatment will be supplied.

Our pharmacists and prescribers may:

• request additional information;
• ask further clinical questions;
• request supporting evidence;
• recommend an alternative treatment;
• recommend that you consult your GP;
• advise attendance at another appropriate healthcare service; or
• decline treatment where it is not clinically appropriate.

Medicines are only supplied where our healthcare professionals are satisfied that doing so is safe, appropriate and in the patient's best interests.

30. EMERGENCY MEDICAL SERVICES

Curigo is not an emergency medical service.

Our online consultations and pharmacy services are not intended to replace emergency medical care.

If you believe you or another person is experiencing a medical emergency, you should immediately:

• call 999;
• attend your nearest Accident and Emergency (A&E) department;
• contact NHS 111 where appropriate; or
• seek urgent medical assistance without delay.

You should not rely upon Curigo's online services where urgent emergency medical assessment or treatment is required.

31. AUTOMATED PROCESSING

Curigo may use technology to assist with administrative and operational processes including:

• directing consultations;
• identifying incomplete questionnaires;
• detecting duplicate submissions;
• fraud prevention;
• website security;
• appointment administration;
• workflow management; and
• system monitoring.

However, decisions relating to the prescribing or supply of prescription medicines are not made solely by automated means.

Where a clinical decision is required, it will always be reviewed by an appropriately qualified healthcare professional.

32. ARTIFICIAL INTELLIGENCE (AI)

Curigo may use secure technological tools, including artificial intelligence, to support administrative functions, improve operational efficiency and assist healthcare professionals.

Artificial intelligence is used only to support appropriately qualified healthcare professionals and does not replace professional clinical judgement.

Responsibility for decisions regarding prescribing, diagnosis and the supply of medicines remains with the responsible pharmacist or prescriber.

33. MEDICINES SAFETY AND PATIENT PROTECTION

Patient safety remains our highest priority throughout the healthcare journey, including after medicines have been supplied.

Where necessary, Curigo may process and use your personal information to:

• contact you regarding important medicine safety information;
• notify you of medicine recalls;
• advise you of significant changes to safety information;
• communicate important updates relating to medicines supplied by Curigo;
• respond to safety alerts issued by the Medicines and Healthcare products Regulatory Agency (MHRA) or other competent authorities;
• investigate reports of suspected adverse drug reactions;
• review the ongoing safety of treatments supplied;
• provide updated clinical advice where new information becomes available; and
• take any other action reasonably necessary to protect patient safety.

Where we believe that important safety information may affect your treatment, we may contact you using the contact details held within your Curigo account.

Where appropriate, we may also recommend that you contact your GP, attend another healthcare provider or seek urgent medical attention.

34. PHARMACOVIGILANCE

As a healthcare provider, Curigo supports the ongoing monitoring of medicine safety.

Where required or appropriate, we may process personal information for pharmacovigilance purposes, including:

• recording suspected adverse drug reactions;
• investigating reports of side effects;
• monitoring medicine safety;
• complying with legal and regulatory reporting obligations; and
• sharing relevant information with competent regulatory authorities where required by law.

Information shared for pharmacovigilance purposes will be limited to that which is necessary and processed in accordance with applicable legal and professional requirements.

35. QUALITY ASSURANCE, CLINICAL GOVERNANCE AND SERVICE IMPROVEMENT

Curigo continually reviews the quality and safety of the services we provide.

Personal information may be reviewed by appropriately authorised pharmacists, prescribers or other authorised members of our clinical governance team for purposes including:

• clinical audit;
• prescribing review;
• quality assurance;
• patient safety investigations;
• professional supervision;
• internal governance;
• regulatory compliance;
• service development;
• staff training; and
• continuous quality improvement.

Where reasonably practicable, information used for audit, reporting or service improvement will be anonymised or pseudonymised so that individuals cannot be readily identified.

Access to identifiable patient information is strictly limited to authorised personnel who require access to perform legitimate professional duties.

36. RESEARCH AND STATISTICAL ANALYSIS

Curigo may use aggregated, anonymised or pseudonymised information to:

• understand how our services are used;
• improve patient experience;
• monitor clinical outcomes;
• evaluate service performance;
• identify trends;
• improve website functionality;
• support business planning; and
• improve the quality of healthcare services we provide.

Where information has been anonymised so that individuals can no longer be identified, it is no longer regarded as personal data under UK data protection legislation.

Curigo will not publish information that identifies individual patients without an appropriate legal basis or your explicit consent.

37. SHARING YOUR PERSONAL INFORMATION

Curigo treats your personal information as confidential and will only share it where there is a lawful basis to do so.

We do not sell your personal information to third parties.

We may share your information only where it is necessary to provide healthcare services, comply with our legal obligations, protect patient safety or operate our business effectively.

Depending on the circumstances, your information may be shared with the organisations and individuals described below.

38. HEALTHCARE PROFESSIONALS

Where necessary to provide safe and effective healthcare, Curigo may share relevant information with healthcare professionals involved in your care.

This may include:

• pharmacists;
• independent prescribers;
• doctors;
• nurses;
• other registered healthcare professionals; and
• appropriately authorised members of our clinical team.

Information shared will be limited to that which is necessary for the provision of healthcare or the protection of patient safety.

39. YOUR GP AND OTHER HEALTHCARE PROVIDERS

Where clinically appropriate, or where required by law or professional standards, Curigo may share relevant information with your GP or other healthcare providers involved in your care.

This may include details of:

• consultations;
• medicines supplied;
• prescribing decisions;
• significant medical findings;
• adverse drug reactions;
• safeguarding concerns; or
• other information necessary to support continuity of care.

Where appropriate, we may seek your consent before sharing information. However, there may be circumstances where information is shared without consent where this is permitted or required by law or is necessary to protect you or others from serious harm.

40. SERVICE PROVIDERS

Curigo works with carefully selected third-party service providers who support the operation of our business.

These providers may include:

• secure hosting providers;
• cloud storage providers;
• IT support providers;
• software providers;
• payment processors;
• website developers;
• customer communication providers;
• identity verification providers;
• cybersecurity providers; and
• professional advisers.

These organisations are only permitted to process personal information on our behalf in accordance with our instructions and appropriate contractual safeguards.

41. PAYMENT PROVIDERS

Payments are processed through secure third-party payment providers.

These providers process payment information in accordance with applicable payment security standards and their own privacy notices.

Curigo does not receive or retain your complete payment card details.

42. DELIVERY PARTNERS

Where medicines or other products are supplied, we may share limited personal information with delivery providers to enable delivery of your order.

This may include:

• your name;
• delivery address;
• contact telephone number where required;
• parcel reference information; and
• delivery instructions where appropriate.

Delivery providers are only provided with the information necessary to complete delivery services.

43. REGULATORS, LAW ENFORCEMENT AND LEGAL REQUIREMENTS

Curigo may disclose personal information where disclosure is required or permitted by law.

This may include disclosures to:

• the General Pharmaceutical Council (GPhC);
• the Medicines and Healthcare products Regulatory Agency (MHRA);
• the Information Commissioner's Office (ICO);
• HM Revenue & Customs (HMRC);
• the police;
• the courts;
• safeguarding authorities; or
• other competent public authorities.

Information will only be disclosed where there is an appropriate legal basis for doing so.

44. SAFEGUARDING

Curigo recognises its safeguarding responsibilities.

Where we believe that an individual may be at risk of abuse, neglect or serious harm, we may share relevant information with appropriate safeguarding authorities, healthcare professionals or emergency services where permitted or required by law.

Such disclosures will always be carefully considered and limited to information necessary to protect the individual concerned or others at risk.

45. FRAUD PREVENTION

Curigo may share relevant information with fraud prevention agencies, payment providers, law enforcement bodies or other authorised organisations where necessary to:

• prevent fraud;
• investigate suspected criminal activity;
• prevent misuse of medicines;
• verify identities;
• protect our services; or
• comply with legal obligations.

46. DATA SECURITY

Curigo takes the security of your personal information seriously.

We maintain appropriate technical and organisational measures designed to protect information against:

• accidental loss;
• unauthorised access;
• unlawful processing;
• alteration;
• disclosure;
• destruction; and
• cyber threats.

Security measures may include:

• encryption;
• secure servers;
• access controls;
• password protection;
• multi-factor authentication where appropriate;
• staff confidentiality obligations;
• staff training;
• security monitoring;
• audit logs;
• regular software updates; and
• incident response procedures.

Although we take reasonable steps to protect your information, no electronic transmission or storage system can be guaranteed to be completely secure.

47. PERSONAL DATA BREACHES

Curigo maintains procedures for identifying, investigating and responding to personal data breaches.

Where a personal data breach is likely to result in a risk to the rights and freedoms of individuals, Curigo will notify the Information Commissioner's Office (ICO) where required by law.

Where legally required, affected individuals will also be informed without undue delay.

All suspected data breaches are investigated and documented as part of our governance procedures.

48. DATA RETENTION

Curigo retains personal information only for as long as necessary to fulfil the purposes for which it was collected, including compliance with legal, regulatory, professional and contractual obligations.

Retention periods may vary depending upon the type of information held and the services provided.

When information is no longer required, it will be securely deleted, destroyed or anonymised in accordance with our retention procedures and applicable legal requirements.

49. INTERNATIONAL TRANSFERS

Curigo primarily stores and processes personal information within the United Kingdom.

Where personal information is transferred outside the UK, we will ensure that appropriate safeguards are in place in accordance with UK data protection legislation.

Such safeguards may include:

• UK International Data Transfer Agreements;
• adequacy regulations;
• approved contractual clauses; or
• other legally recognised transfer mechanisms.

50. YOUR DATA PROTECTION RIGHTS

Subject to applicable law, you may have the right to:

• request access to your personal information;
• request correction of inaccurate information;
• request erasure of personal information in certain circumstances;
• request restriction of processing;
• object to certain processing activities;
• request the transfer of your personal information where applicable;
• withdraw consent where processing relies upon consent; and
• lodge a complaint with the Information Commissioner's Office.

Requests may be subject to legal or regulatory exemptions.

We may ask for proof of identity before responding to requests.

51. CHILDREN'S PRIVACY

Curigo's services are intended for individuals who are legally eligible to receive the healthcare service requested.

Where services are provided to children or young people, personal information will be processed in accordance with applicable legislation, professional guidance and safeguarding requirements.

Where appropriate, we may require the consent or involvement of a parent, guardian or another individual with parental responsibility, unless the child or young person is legally able to make decisions regarding their own healthcare.

52. CHANGES TO THIS PRIVACY POLICY

Curigo may update this Privacy Policy from time to time to reflect changes in legislation, regulatory guidance, technology, business operations or the services we provide.

The most recent version will always be published on our website.

Where changes are significant, we may take additional steps to notify users where appropriate.

53. CONTACTING CURIGO

If you have any questions about this Privacy Policy or the way in which Curigo processes your personal information, you may contact us using the contact details published on our website.

We will endeavour to respond to enquiries within a reasonable timeframe.

54. COMPLAINTS

If you are dissatisfied with the way Curigo has handled your personal information, we encourage you to contact us first so that we have an opportunity to investigate your concerns.

You also have the right to make a complaint to the Information Commissioner's Office if you believe your data protection rights have been infringed.

Making a complaint to Curigo does not affect your right to complain directly to the Information Commissioner's Office.

55. REGULATORY COMPLIANCE

Curigo is committed to maintaining compliance with all applicable data protection legislation, pharmacy legislation and relevant professional standards.

Where legal or regulatory requirements change, we may amend our policies and procedures accordingly to ensure ongoing compliance.

56. ENTIRE PRIVACY POLICY

This Privacy Policy forms the complete statement of how Curigo collects, uses, shares, stores and protects personal information in connection with its website, online pharmacy services and associated healthcare services.

If any provision of this Privacy Policy is found to be invalid or unenforceable, the remaining provisions shall continue in full force and effect.