Privacy policy
Last updated: 20/06/2026
Contents
1. Who we are
GRWTH is a trading name of Hightown Pharmacy. We are the data controller responsible for your personal data when you use the GRWTH website and services.
| Registered pharmacy | Hightown Pharmacy |
| GPhC registration | 05087703 |
| Superintendent pharmacist | Daniel Higham |
| Registered address | Alt Road, Hightown, L38 0BF |
| ICO registration | ZA123456 |
| Contact email | support@getgrwth.co.uk |
When we refer to "GRWTH", "we", "us", or "our" in this policy, we mean Hightown Pharmacy in its capacity as operator of the GRWTH service.
2. What data we collect
The personal data we collect depends on how you interact with our service. We may collect the following categories of information:
Information you provide directly
- Identity and contact details — your name, email address, postal address, date of birth, and telephone number.
- Consultation responses — information about your hair loss, medical history, current medications, allergies, and health conditions submitted through the online consultation form.
- Photographic information — images of your hair or scalp if uploaded as part of the consultation process.
- Payment information — billing details processed via our payment provider. We do not store full card numbers on our systems.
- Communications — messages, emails, or queries you send to our support team.
Information collected automatically
- Device and browser data — IP address, browser type and version, operating system, device type, and screen resolution.
- Usage data — pages visited, time spent on pages, referral source, and interaction patterns.
- Cookie data — information collected through cookies and similar technologies as described in the Cookies section below.
3. How we use your data
We process your personal data only where we have a valid legal basis under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. The table below sets out the purposes for which we process your data and the corresponding legal basis.
| Purpose | Legal basis |
|---|---|
| Processing your consultation and assessing suitability for treatment | Performance of a contract; explicit consent for health data (see section 4) |
| Dispensing and delivering prescribed treatment | Performance of a contract; legal obligation (pharmacy regulations) |
| Maintaining pharmacy records as required by the GPhC | Legal obligation |
| Communicating with you about your order, treatment, or account | Performance of a contract; legitimate interests |
| Processing payments | Performance of a contract |
| Providing follow-up clinical support and aftercare | Performance of a contract; legitimate interests |
| Sending service-related notifications (order updates, delivery, prescriber messages) | Performance of a contract |
| Sending marketing communications (only with your consent) | Consent |
| Improving our website and service | Legitimate interests |
| Analysing website usage and advertising performance | Consent (via cookie consent) |
| Preventing fraud and ensuring security | Legitimate interests |
| Complying with legal or regulatory requirements | Legal obligation |
Where we rely on legitimate interests, we have assessed that our interests do not override your rights and freedoms. You can request further detail about this assessment by contacting us.
4. Health and medical data
The consultation process requires us to collect information about your health, medical history, and current medications. This is classified as "special category data" under UK GDPR and is subject to additional protections.
We process health data on the following legal bases:
- Explicit consent — you provide explicit consent when you submit your consultation form, having been informed that your responses will be reviewed by a prescriber for the purpose of assessing clinical suitability.
- Health and social care purposes — processing is necessary for the provision of healthcare, managed by a health professional subject to a duty of confidentiality (Article 9(2)(h) UK GDPR and Schedule 1, Part 1, Paragraph 2 of the DPA 2018).
- Legal obligation — we are required to maintain certain records under pharmacy and medicines legislation.
Your health data is only accessible to the clinical team involved in your care and to authorised pharmacy staff. It is not used for marketing purposes and is not shared with third parties except as described in section 5.
You may withdraw your consent to the processing of health data at any time by contacting us. If you do, we may not be able to continue providing treatment, but this will not affect the lawfulness of any processing carried out before your withdrawal.
5. Who we share data with
We do not sell your personal data. We share data only with the following categories of third parties, and only to the extent necessary to operate the GRWTH service:
| Third party | Purpose | Data shared |
|---|---|---|
| Priorly (platform provider) | Website hosting, consultation form collection, customer record management, and order processing | Identity, contact, consultation, and order data |
| Ryft (payment processor) | Processing payments securely | Payment and billing information |
| SendGrid (email service) | Sending transactional and service emails | Email address, name, order/consultation references |
| Google (analytics) | Website usage analysis | Anonymised usage data, device information (subject to cookie consent) |
| Reddit (advertising) | Measuring advertising performance | Anonymised conversion data (subject to cookie consent) |
| Delivery partners | Shipping treatment to your address | Name and delivery address |
| Prescribers and clinical staff | Reviewing consultations and approving treatment | Consultation responses and health data |
We may also share data where required by law, regulation, or court order, or to protect the safety of individuals.
All third-party processors are bound by data processing agreements and are required to handle your data in accordance with UK GDPR. Where data is transferred outside the UK, appropriate safeguards are in place (such as standard contractual clauses or an adequacy decision).
6. Cookies and tracking
We use cookies and similar technologies on our website. A cookie is a small text file placed on your device that helps us understand how you use our site.
Cookies we use
| Cookie | Type | Purpose |
|---|---|---|
| Session cookies | Strictly necessary | Required for the website and consultation form to function. These cannot be disabled. |
| Google Analytics | Analytics | Helps us understand how visitors use our website so we can improve it. Data is anonymised. |
| Reddit Pixel | Advertising | Measures the effectiveness of our advertising campaigns on Reddit. Tracks conversions, not browsing activity. |
Analytics and advertising cookies are only set with your consent. You can manage your preferences through the cookie consent tool displayed when you first visit the site, or by adjusting your browser settings.
Most browsers allow you to refuse or delete cookies. Blocking strictly necessary cookies may affect the functionality of the website.
7. How long we keep your data
We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law.
| Data type | Retention period |
|---|---|
| Prescription and dispensing records | Minimum of 8 years from the date of dispensing, as required by GPhC and NHS guidance |
| Consultation and clinical records | 8 years from the date of the last consultation or treatment |
| Order and transaction records | 6 years from the date of the transaction (in line with HMRC requirements) |
| Account and contact information | Duration of your account plus 2 years, unless longer retention is required for the records above |
| Marketing consent records | Duration of consent plus 1 year |
| Cookie and analytics data | As defined by the relevant cookie (typically 12–26 months) |
When data is no longer required, it is securely deleted or anonymised.
8. Your rights
Under UK GDPR, you have the following rights in relation to your personal data:
- Right of access — you can request a copy of the personal data we hold about you.
- Right to rectification — you can ask us to correct inaccurate or incomplete data.
- Right to erasure — you can ask us to delete your data in certain circumstances. This does not apply where we are legally required to retain records (for example, prescription records).
- Right to restrict processing — you can ask us to limit how we use your data in certain circumstances.
- Right to data portability — you can request your data in a structured, commonly used format.
- Right to object — you can object to processing based on legitimate interests. You can object to direct marketing at any time.
- Right to withdraw consent — where processing is based on consent, you can withdraw it at any time.
To exercise any of these rights, contact us at support@getgrwth.co.uk. We will respond within one month. There is no fee for most requests, though we may charge a reasonable fee for repetitive, excessive, or unfounded requests.
If you are not satisfied with how we handle your request, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
| Website | ico.org.uk |
| Telephone | 0303 123 1113 |
9. Data security
We take appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include:
- Encryption of data in transit (TLS/SSL) and at rest where applicable.
- Access controls limiting data access to authorised personnel only.
- Secure hosting through our platform provider with regular security monitoring.
- Payment processing handled by a PCI DSS-compliant payment provider (Ryft), meaning we do not store or process full card details on our systems.
While we take reasonable steps to protect your data, no system is completely secure. If you become aware of any security concern, please contact us immediately at support@getgrwth.co.uk.
10. Children
Our service is not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will take steps to delete it.
11. Changes to this policy
We may update this privacy policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. Where changes are significant, we will notify you by email or by displaying a notice on our website.
We encourage you to review this page periodically. The "last updated" date at the top of this page indicates when the policy was most recently revised.
12. Contact us
If you have questions about this privacy policy, your personal data, or wish to exercise any of your rights, contact us:
| support@getgrwth.co.uk | |
| Post | Data Protection, Hightown Pharmacy, Alt Road, Hightown, L38 0BF |