Privacy policy

1. Who we are

Pharmosphere is a service of Rouyah Pharma Limited (“we”, “us”), a company registered in England and Wales (company number 09778487). We are the data controller for the personal data described here. Contact: privacy@pharmosphere.co.uk.

2. What we collect

• Account: email address, your name, and your GPhC registration number.
• Your records: shifts you log (pharmacy, date, rate, hours, mileage, notes), invoices and payment status, and saved pharmacy contacts.
• Community: posts you choose to publish.
• Documents (optional): files you choose to upload — for example registration, indemnity, training or immunisation records — which may include health information (special-category data). These are uploaded only if you choose to, and are kept in private storage with restricted, audit-logged access.
• Technical: strictly-necessary cookies to keep you signed in, standard server logs, and — only with your consent — first-party analytics about how features are used (never third-party advertising trackers).

3. How we use it, and our lawful bases

• To provide the service (accounts, shifts, invoices, community) — contract.
• To verify your GPhC registration for trust features — legitimate interests.
• To keep the platform secure and working — legitimate interests.
• To understand feature usage through first-party analytics, and to send any product-update or insight emails you opt into — consent (off by default; change at any time in Settings).
• To store any health-related documents you choose to upload — explicit consent (the Article 9 condition for special-category data). You can delete these documents at any time.

We do not make decisions about you that have legal or similarly significant effects using solely automated processing.

4. The anonymised pay benchmark

When you log a shift, the locum rate may be added to an anonymised dataset to support fair-pay transparency. These records carry no link to you — only the pharmacy, region, rate and month — and figures are only ever shown as aggregates once enough pharmacists have reported. The lawful basis is legitimate interests, and because the data is genuinely anonymised it falls outside data-protection law. You can turn this off at any time in Settings.

5. Who we share data with

We never sell your data, and we never hold or move money between pharmacies and pharmacists. We use trusted processors to run the service:

• Supabase — database & authentication (data hosted in London, UK).
• Vercel — application hosting.
• Resend — sending sign-in and account emails.
• Sentry — error monitoring (technical error reports only; no account data).

When you use the optional address and mileage lookups, a postcode you enter is sent to two third-party lookup services — never your name, email or account data:

• postcodes.io — a free UK postcode lookup, to fill in address details and locate a postcode for the mileage estimate.
• OSRM (router.project-osrm.org) — an open routing service that estimates the driving distance between two postcodes for mileage; it receives only the approximate coordinates derived from them.

These lookups run over HTTPS and are not logged, and the mileage estimate is optional — you can always enter mileage yourself.

6. International transfers

Your data is stored in the UK. Some processors are US-based; where data is transferred outside the UK we rely on the UK International Data Transfer Agreement / Addendum and appropriate safeguards.

7. Retention

We keep your account data and records while your account is active. If you delete your account, your personal data and records are removed, with a backstop sweep within 30 days. Some categories have their own windows:

• First-party analytics events — 24 months.
• Security logs — 12 months.
• Consent records — account life plus 24 months (as proof of consent).
• Generated data exports — 30 days.

Anonymised rate data is not personal data and is retained for the benchmark.

8. Your rights & complaints

You have the right to access, correct, delete, restrict or object to our use of your data, to data portability, and to withdraw any consent you have given. You can delete your account and data from Settings, or contact us at privacy@pharmosphere.co.uk.

If you have a concern, please raise it with us first; we aim to acknowledge complaints within 30 days and to resolve them as quickly as we can. You can also complain to the UK Information Commissioner’s Office at any time (ico.org.uk).

9. Who can use Pharmosphere

Pharmosphere is intended for UK pharmacy professionals aged 18 or over. It is not directed at children, and we do not knowingly collect data from anyone under 18.

10. Cookies

We use strictly-necessary cookies to keep you signed in and to remember your cookie choices. With your consent, we also use first-party analytics (in our own systems) to understand how the platform is used so we can improve it. We do not use third-party advertising or cross-site tracking cookies. You can accept or reject non-essential cookies from the banner, and change your choice at any time in Settings.

11. Open data

Pharmacy statistics use NHSBSA and NHS England data, Public Health Scotland data, NHS Wales Shared Services Partnership data, HSC Business Services Organisation / Open Data NI data, and location data from postcodes.io / Office for National Statistics, all under the Open Government Licence v3.0. Contains public sector information licensed under the Open Government Licence v3.0.

12. Changes

We’ll update this policy as the service evolves and note the date above. See also our Terms of Service.