Privacy notice
Who is responsible for your information
AT Health Ltd (company number 14519140, registered office 1 Beamont Crescent, Woodford, Stockport SK7 1NX) is responsible for your information. In data protection law it is the “controller”. AT Health Ltd runs Together Health and Together Clinic, and owns Wilmslow Pharmacy (GPhC registration 1029878), which dispenses your medicines.
AT Health Ltd is registered with the Information Commissioner’s Office (ICO), registration ZB558618. Our information governance lead is Ahmed Al-Liabi, Superintendent Pharmacist. To ask anything about your information, email info@at-health.co.uk.
What we collect
- Who you are: your name, date of birth, sex at birth, email address, phone number, home address and, if you give it, your NHS number.
- Your GP practice, and whether you agree to us telling your GP about your treatment.
- Your health information: your answers to the questions before a consultation, your height and weight readings, the medicines and allergies you tell us about, notes from your consultation, and the prescriber’s decision.
- Your prescriptions and supplies, what you have paid, and your appointments.
- The result of the photo ID check you completed when you ordered. We keep the outcome and a reference, not your ID document.
- Your account: your email address and password, and any passkeys you add (we keep a public key and the device name you chose, never your fingerprint or face).
- Security information: a scrambled form of your internet address, used only to stop repeated attempts to guess a date of birth or password.
When a pharmacy checks a prescription on the check page, it sees your name, date of birth, the medicines and the prescriber. A record of each dispensing is kept.
Why we use it, and the law that allows it
- To assess you, prescribe, dispense and deliver your medicines, and to look after you during treatment. The law allows this because we are providing your care (UK GDPR Article 6(1)(b)) and because health information may be used by health professionals to provide care (Article 9(2)(h)).
- To keep the prescription and pharmacy records the law requires (Article 6(1)(c)).
- To keep the service secure and to stop misuse, such as checks that you are not a computer program (Article 6(1)(f), our legitimate interest in a safe service).
- To tell your GP about your treatment, only if you agree, and to look at your NHS Summary Care Record, only if you agree.
A prescriber always makes the decision about your treatment. Automatic checks help them spot safety issues, but never decide on their own. We do not sell your information or use it for advertising.
Who we share it with
- The prescriber who consults you, and Wilmslow Pharmacy, which dispenses.
- Your GP, if you agree.
- Any pharmacy you choose to take your prescription to, through the check page.
- Companies that run parts of the service for us, under contract and only on our instructions:
- Supabase: our database, held in London.
- Vercel: hosts these websites, in London.
- Amazon Web Services: holds the key that signs prescriptions, in London.
- Resend: sends our emails, from Ireland. Emails never contain your health details.
- Stripe: takes payments and ran your photo ID check.
- Cloudflare: checks that a form is being used by a person.
- Microsoft Teams: for video consultations.
Some of these companies are part of groups based in the United States. If any of them handles your information outside the UK, it must be protected in the way UK data protection law requires.
Cookies
These sites use only the cookies they need to work. There are no advertising or tracking cookies, so we do not ask you to accept any.
| Cookie | What it does | How long |
|---|---|---|
| th_patient_dob | Remembers that you entered your date of birth for one emailed link | 30 minutes |
| sb-…-auth-token | Keeps you signed in to your account | Until you sign out or your session ends |
| th_verify_dob | Check page: remembers the prescription code and date of birth entered | 30 minutes |
| th_pharmacy_session | Check page: keeps a registered pharmacy signed in | 8 hours |
| th_pharmacy_signin | Check page: remembers a pharmacy halfway through signing in | 15 minutes |
The person check on our forms is run by Cloudflare, which may set its own cookies.
How long we keep it
We keep your records, including consultations, prescriptions and supplies, for 8 years after your last contact with us. Then we delete them.
Your rights
You can ask us to:
- give you a copy of the information we hold about you
- correct anything that is wrong
- delete your information, or stop using it. We may have to keep health and prescription records the law requires, and we will tell you if so.
- give you your information in a form you can pass to someone else
Email info@at-health.co.uk. We may ask you to prove who you are. We answer within one month, and it is free.
If you are unhappy with how we use your information, please tell us first. You can also complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.