Privacy policy

Fast Meds (“we”, “us”) runs this website and is the data controller for the personal information you give us. This policy explains what we collect, why, who we share it with and the rights you have under UK data protection law (the UK GDPR and the Data Protection Act 2018).

• Account details: your email address, password (stored encrypted, we can never see it) and phone number if you give one.
• Identity check: your name, date of birth, photo ID and a selfie, collected by our verification partner when you register. We keep the result of the check and the name on your ID, not copies of your documents.
• Orders: delivery addresses, the products you order, order notes, and your payment reference. You pay by bank transfer, so we never see or store card details.
• Prescriptions: any prescription you upload at checkout for a product that needs one.
• Messages: what you send us through the contact form, by email or on WhatsApp.
• Technical data: the cookies needed to keep you signed in, and standard server logs (such as IP address and browser type) kept for security.

Some of this is special category data: the products you buy and any prescription can reveal information about your health, and the identity check uses your facial image. We only process it with your explicit consent, which you give when you register and when you upload a prescription.

• To verify you are who you say you are before you can order, because we sell medicines (your consent, and our legal obligations).
• To process and deliver your orders, match your bank transfer, and send order emails (to perform our contract with you).
• To answer your questions and handle returns and complaints (our contract with you, and our legitimate interests).
• To keep records we are required to keep, such as sales records for tax (legal obligation).
• To prevent fraud and misuse and keep the website secure (our legitimate interests).

We don't send marketing emails unless you have opted in, and we never sell your information. Emails about your account and orders are not marketing and will still be sent.

We share only what each service needs to do its job, under a contract that requires it to protect your data:

• Didit, our identity verification provider.
• Supabase, which hosts our database and file storage.
• Vercel, which hosts this website.
• Resend, which sends our emails.
• Delivery companies, who receive your name and delivery address.
• Our bank, which processes your transfer.

We may also share information when the law requires it, for example with the police or regulators.

Some of our providers process data outside the UK, for example in the European Economic Area or the United States. When they do, we rely on UK adequacy regulations or the UK International Data Transfer Agreement (or Addendum) so your data has the same level of protection.

• Order and payment records: 6 years after the end of the tax year they relate to, as tax law requires.
• Account details and identity check result: while your account is open, then up to 6 years so we can answer questions about past orders.
• Prescriptions: as long as the related order record.
• Contact messages: up to 2 years.

You have the right to:

• get a copy of the personal information we hold about you;
• have inaccurate information corrected;
• have your information deleted, unless we must keep it by law;
• restrict or object to how we use it;
• receive your information in a portable format;
• withdraw your consent at any time (this doesn't affect what we did before you withdrew it).

To use any of these rights, contact us using the details below. We reply within one month.

We only use the cookies needed to run the website, such as keeping you signed in. Read our cookie policy for details.

Your data is encrypted in transit and at rest. Access is limited to staff who need it, and uploaded prescriptions are stored privately so only you and our staff can open them.

If you're unhappy with how we have handled your information, please contact us first. You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.

We may update this policy. The date at the top shows when it last changed, and we'll email you about any important change.

• Email: fastmedsco@gmail.com
• Or use our contact form.