Privacy Policy

Effective Date: April 2026 · Infohealth Ltd (Company No. 04004930) · Software as a Medical Device (SaMD) — Class I Medical Device

1. Introduction

Infohealth Ltd (“we”, “us”, “our”) operates Pharmacy1st.ai, an AI-powered clinical decision-support platform provided as a Software as a Medical Device (SaMD), classified as a Class I Medical Device. Pharmacy1st.ai is a business-to-business (B2B) SaaS platform used by pharmacies to offer AI-assisted consultations to their patients under the NHS Pharmacy First programme.

This Privacy Policy explains how personal data is collected, processed, and protected in connection with the Platform. It is intended for pharmacy customers, their staff, and patients whose data is processed through the Platform.

This policy should be read alongside the Platform’s Terms of Use, the Data Processing Agreement (DPA) between Infohealth Ltd and each pharmacy customer, and the pharmacy’s own privacy notice provided to patients.

2. Data Controller and Data Processor Roles

The data governance model for the Platform is as follows:

2.1 Patient Clinical Data

Data Controller:The pharmacy that subscribes to and uses the Platform (“the Customer”). For all purposes and intents, the Customer pharmacy is the data controller in respect of all patient personal data and special category health data entered into and processed through the Platform. The Customer pharmacy determines the purposes and means of processing, is responsible for ensuring a valid lawful basis, providing patients with privacy information, and handling data subject rights requests.

Data Processor: Infohealth Ltd. We process patient personal data solely on behalf of and under the documented instructions of the Customer pharmacy, in accordance with the Data Processing Agreement executed between the parties. We do not determine the purposes or means of processing patient data.

2.2 Website and Marketing Data

For personal data collected directly through the Pharmacy1st.ai website (e.g. contact forms, newsletter sign-ups, sales enquiries, analytics cookies), Infohealth Ltd acts as the data controller. This data is processed in accordance with the UK GDPR and this Privacy Policy.

2.3 Customer Account Data

For personal data relating to pharmacy staff who hold accounts on the Platform (e.g. pharmacist names, email addresses, login credentials, professional registration details), Infohealth Ltd acts as a joint controller or, where specified in the subscription agreement, as a processor on behalf of the Customer pharmacy. The applicable arrangement is set out in the Data Processing Agreement.

3. Data Processing Agreement

In accordance with Article 28 of the UK GDPR, Infohealth Ltd enters into a Data Processing Agreement (DPA) with each Customer pharmacy before patient data is processed through the Platform. The DPA sets out:

• The subject matter, duration, nature, and purpose of the processing
• The categories of personal data and data subjects
• The obligations and rights of the Customer as data controller
• The obligations of Infohealth Ltd as data processor
• Technical and organisational security measures
• Sub-processor disclosures and obligations
• Data breach notification procedures
• Data return and deletion obligations upon termination

A copy of the DPA is provided to each Customer as part of the onboarding process and is available on request.

4. Personal Data Processed Through the Platform

4.1 Patient Data (Controller: Customer Pharmacy)

• Full name, date of birth, age, and sex
• Contact details (email address, telephone number, postal address)
• NHS number (where provided)
• GP practice details
• Clinical information provided during consultations, including symptoms, medical history, current medications, allergies, and lifestyle factors
• Pregnancy and breastfeeding status
• Responses to clinical screening questions
• AI-generated QA document outputs, including triage results, PGD eligibility assessments, red-flag alerts, and clinical recommendations
• Pharmacist review decisions and annotations
• Audit trail records

This includes special category data (health data) within the meaning of Article 9 of the UK GDPR.

4.2 Pharmacy Staff Data (Controller: as per DPA)

• Pharmacist and staff names
• Professional registration numbers (GPhC)
• Email addresses and login credentials
• Platform usage and activity logs

4.3 Website Visitor Data (Controller: Infohealth Ltd)

• IP address and approximate geolocation
• Browser type, version, and operating system
• Device type and screen resolution
• Pages visited, time spent, and navigation paths
• Referral source
• Contact form submissions and enquiry details

5. Lawful Bases for Processing

5.1 Patient Data (Determined by Customer Pharmacy)

The Customer pharmacy, as data controller, is responsible for identifying the lawful basis for processing patient data. Typical lawful bases for NHS Pharmacy First consultations include:

• Public Task (Article 6(1)(e)): Processing necessary for the provision of NHS healthcare services.
• Healthcare Provision (Article 9(2)(h)): Processing of special category health data necessary for healthcare under the management of a health professional bound by professional secrecy obligations.
• Legal Obligation (Article 6(1)(c)): Processing necessary to comply with GPhC record-keeping and NHS reporting requirements.

Infohealth Ltd, as data processor, processes patient data solely on the basis of the Customer’s documented instructions as set out in the DPA.

5.2 Website and Marketing Data (Controller: Infohealth Ltd)

Where Infohealth Ltd is the data controller (website visitor data, sales enquiries), we rely on:

• Legitimate Interests (Article 6(1)(f)): For website analytics, security monitoring, and responding to sales enquiries.
• Consent (Article 6(1)(a)): For non-essential cookies and marketing communications.
• Contract Performance (Article 6(1)(b)): For managing Customer subscriptions and accounts.

6. Who Has Access to Personal Data

6.1 Patient Data

Patient data processed through the Platform may be accessed by:

• The Customer Pharmacy: Including the responsible pharmacist and authorised pharmacy staff, as the data controller.
• Infohealth Ltd Staff: Authorised technical and support personnel, acting as data processor, where necessary for Platform operation, maintenance, and support, subject to strict access controls and confidentiality obligations.
• Sub-Processors: Third-party service providers engaged by Infohealth Ltd to support Platform infrastructure (e.g. cloud hosting, AI model inference). All sub-processors are disclosed in the DPA and are bound by data processing agreements that provide equivalent protections.
• NHS Systems: Where integration is enabled (e.g. Electronic Prescription Service, GP Connect, NHS Spine), as directed by the Customer pharmacy.

6.2 Regulatory and Legal Disclosures

Patient data may be disclosed to regulatory bodies (GPhC, MHRA, NHS England), the Information Commissioner’s Office (ICO), or law enforcement agencies where required by law. Such disclosures will be made by the Customer pharmacy as data controller, or by Infohealth Ltd where we are legally compelled to do so, in which case we will notify the Customer unless legally prohibited from doing so.

We do not sell personal data to third parties. We do not use patient data for direct marketing.

7. International Data Transfers

We store and process personal data primarily within the United Kingdom. Where sub-processors operate outside the UK/EEA, we ensure appropriate safeguards are in place, including:

• UK International Data Transfer Agreements (IDTAs)
• Standard Contractual Clauses (SCCs) approved by the ICO
• Adequacy decisions recognised by the UK Government

Details of international transfers and safeguards are set out in the DPA. Customer pharmacies may request further information from our Data Protection Officer.

8. AI and Automated Processing

8.1 How the AI Processes Patient Data

Patient data entered during a consultation is processed by:

• Natural language processing models that extract and validate clinical information from patient responses
• A binary logic engine that evaluates PGD eligibility based on inclusion and exclusion criteria
• A QA document generator that produces a structured clinical summary for pharmacist review

8.2 No Solely Automated Decisions

The Platform does not make any decision that has a legal or similarly significant effect on a patient without human intervention. Every AI-generated QA document is reviewed by a registered pharmacist who makes the final prescribing decision. The Platform is a decision-support tool, not a decision-making tool.

8.3 AI Model Training

We do not use identifiable patient data to train AI models. Where consultation data is used for model evaluation, quality assurance, or performance monitoring, it is anonymised or aggregated so that individual patients cannot be identified. Any such use is documented in the DPA.

9. Data Retention

Data retention for patient clinical data is determined by the Customer pharmacy as data controller, in accordance with NHS records management guidelines and GPhC requirements. Infohealth Ltd retains patient data for the period specified in the DPA or as instructed by the Customer.

Indicative retention periods:

• Patient clinical and consultation records: as directed by the Customer, typically 10 years from the consultation date in accordance with NHS guidelines
• Audit trail and governance records: as directed by the Customer, typically 10 years
• Pharmacy staff account data: for the duration of the subscription plus 12 months
• Website visitor and analytics data: 12 months from collection (where Infohealth is controller)
• Cookie data: as specified in our Cookie Policy

Upon termination of the subscription, patient data is returned or securely deleted in accordance with the DPA.

10. Data Security

We implement appropriate technical and organisational measures to protect personal data, including:

• Encryption of data in transit (TLS 1.2+) and at rest (AES-256)
• Role-based access controls and multi-factor authentication
• Regular security assessments, vulnerability scanning, and penetration testing
• Incident response and data breach notification procedures
• Staff training on data protection and information security
• Data processing agreements with all sub-processors
• Physical and logical segregation of customer data environments

Security measures are described in further detail in the DPA and are subject to periodic review.

11. Data Subject Rights

11.1 Patient Rights

Patients whose data is processed through the Platform have the following rights under the UK GDPR: access, rectification, erasure (subject to legal retention requirements), restriction, data portability, objection, and rights related to automated decision-making.

Important: Because the Customer pharmacy is the data controller for patient data, patients should direct data subject rights requests to their pharmacy in the first instance. The pharmacy will handle the request, and we will assist as data processor in accordance with the DPA.

If a patient contacts Infohealth Ltd directly with a data subject rights request, we will redirect them to the relevant Customer pharmacy unless we are legally required to act directly.

11.2 Pharmacy Staff and Website Visitor Rights

Where Infohealth Ltd is the data controller (website visitors, sales contacts) or joint controller (pharmacy staff accounts), data subject rights requests should be directed to:

Data Protection Officer: [email protected]
Post: Data Protection Officer, Infohealth Ltd d.b.a Pharmacy1st.ai, 1st Floor Offices, 28 Chipstead Valley Road, Coulsdon, Surrey, CR5 2RA

We will respond within one calendar month of receipt.

11.3 Complaints

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO).

12. Children’s Data

The Platform may process data relating to children where a specific Pharmacy First clinical pathway permits (for example, certain pathways accept patients aged 1 and above). Where a child’s data is processed, the Customer pharmacy as data controller is responsible for ensuring that appropriate safeguards are in place and that any necessary parental/guardian involvement is obtained in accordance with applicable guidance.

13. Sub-Processors

Infohealth Ltd engages third-party sub-processors to support the delivery of the Platform. A current list of sub-processors is maintained and provided to Customer pharmacies as part of the DPA. We notify Customers of any intended changes to sub-processors in accordance with the DPA, allowing the Customer to object where permitted.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be communicated to Customer pharmacies in writing and published on the Platform. The “Effective Date” at the top of this document indicates when the policy was last updated.

15. Contact Us

If you have any questions about this Privacy Policy or how personal data is handled in connection with the Platform, please contact us: