Things we need to do to provide you with the services you've requested
Providing our products and services
We use your personal information to provide our products and services, for example to set up and run your account, process orders and transactions, respond to queries and comments and provide you with the best possible level of customer service. We may use it to contact you about orders you’ve placed or appointments you’ve booked or to send you reminders (e.g. about repeat prescriptions). We may also contact you in emergency situations, such as an urgent product recall or where we have a duty of care to notify you of information that relates to your health.
Can I opt out of having my data used for this?
No, because this covers the many processes and legal obligations that we need to carry out in order to provide you with the Boots service(s) you’ve requested and also to protect you in emergency situations.
Meeting our obligations
Legal, regulatory and contractual requirements
As a healthcare provider, we’re regulated by the General Pharmaceutical Council (GPhC), General Optical Council (GOC) and Care Quality Commission (CQC), all of which may set out standards and codes of practice with which we need to comply. Where we provide NHS services in our pharmacies or Boots Opticians practices, we also have to comply with NHS Information Governance requirements.
Keeping our records up to date
We have a legal obligation to keep the personal data we hold accurate and up to date, we share your personal data across our group companies in order to do this.
We periodically update our records against commercially or publicly available sources (using companies such as Experian) to update addresses where customers have moved or who are deceased. This is to fill gaps in the contact details we hold and to correct addresses that are incorrectly formatted.
This excludes the information we hold about you on our prescription dispensing system. The information held there originates from your prescriber (usually your GP or a hospital) and is used only in connection with dispensing prescriptions. Any updates you make to information held elsewhere in Boots, such as your boots.com account or Advantage Card, are not applied to information held on this system.
Can I opt out of this?
Yes, however there may be legal and regulatory requirements that require Boots to keep your information up to date if you’re using a Boots service.
Learning more about you
We'll consolidate the information we hold about you across the companies in Walgreens Boots Alliance and the different channels you use to interact with us (eg website, stores, our app, correspondence etc.). We do this to keep our records accurate and up to date, provide you with a seamless and consistent service and build a clearer picture of our customers both as a group and as individuals. By understanding you better we can offer you the best and most personalised service we can, but don't worry - we will only send you marketing material if you have agreed that we can.
Crime prevention and detection
Like all retailers, Boots undertakes certain activities that enable us to provide our customers and colleagues with a safe, secure and legal environment online and in stores.
When you place an order on our website we carry out identity verification, fraud prevention and anti-money laundering checks, validating the personal information you give against appropriate third party databases. This involves sharing your personal data with organisations such as Datacash, which verify those details and transactions and pick up on anything that may indicate illegal activity. This may in some cases involve the disclosure of information to a Credit Reference Agency, which will keep a record of that information and may pass it to the police.
In our stores, we use video and, in some places, audio recording to prevent and detect crime and anti-social behaviour. Where we do this we display clear signage, comply with the Information Commissioner’s Surveillance Camera Code of Conduct, and have internal processes in place to minimise the impact on your privacy.
Can I opt out of this?
No, as there will be legal and regulatory reasons that these activities need to be carried out that are mentioned above. Therefore, we’ll not be able to prevent processing your data for this reason as it’s essential to protect our customers, our colleagues and our business from criminal activity.
Things we do to provide you with a better service
The following are things we do as a business to help us operate effectively and efficiently, and in turn provide you with better and simpler services. It’s in our legitimate interests to do these things and we do them in a way that respects and minimises any impact on your privacy.
Learning more about our customers and our business
We carry out analytics on the information we hold about our customers to help us understand who our customers are, how they use our services, and how people interact with us. This enables us to plan our business - for example, stock and staffing levels make sure we offer the same experience online as in our stores, maximise the effectiveness of our advertising and understand how our business is performing. We don’t do this in a way that enables individual customers to be identified. It’s not related to the direct marketing or special offers that we send to you based on your use of Boots services.
Can I object to this?
Yes, you have the right to object to the way we use your data if you believe our legitimate interest in doing it is outweighed by your right to privacy. As this type of analysis is important in enabling Boots (like all major retailers) to operate efficiently and we carry it out in a way that doesn’t identify individuals, we believe it has no impact on your privacy.
Recognising you when you use our services
Whichever Boots services you use, wherever and however you interact with us, we want to give you the same level of service and make things simple and straightforward. We use your details across our services so we can recognise you as a customer and provide consistent care with whichever service you’re using. This also means you don’t need to give the same details each time you come in.
Can I object to this?
Yes, we do this because it makes things more efficient both for you and for Boots. You can object, but doing so will limit the Boots services you’re able to use in the future. If you don’t wish us to recognise you across our services, the following services will be affected and may not work to its full potential:
• .com/.ie account
• Boots Advantage Card
• Use of any of our private (non-NHS) healthcare services
• Booking an appointment using our appointment booking service online, by phone or in store
The following services will remain unaffected if you object:
• Having your prescriptions dispensed at Boots pharmacies as normal
• Having an NHS eye test in a Boots Opticians, although your details will only be held in the practice where your test takes place and won’t be accessible if you later attend a different Boots Opticians
• Having an NHS clinical service in a Boots pharmacy, such as a flu jab, but your records won’t be available to the pharmacist if you later have a clinical service in a different Boots pharmacy
• Use of our online clinics
• Placing an order on Boots.com/ie as a guest customer. You won’t be able to sign up for an account
How do I opt out?
If you’re a new customer on Boots.com, you should use the guest checkout rather than setting up a boots.com account as this will limit how Boots can use your data. If you’re visiting a store for an eye test or other NHS clinical service, you should indicate your preference when asked.
If you’re an existing customer, you’ll need to email the details given below with your request. Note that if you close your account, we may continue to hold your personal information for a period of time after you cease to be a customer (see section headed ‘how long do we hold your data’ below).
Personalising your online experience
We use your personal data such as your browsing history, username and purchases to personalise our websites so they’re more relevant to you, giving you a better online experience. We do this through our use of Cookies. For example, we may greet you by name, show search results that reflect things most likely to be of interest to you and show you content that’s more relevant to you and the things you have previously shown an interest in.
Can I object to this?
Yes, but we believe it’ll result in your online experience being less personal and relevant to you. The content and search results you see will be generic rather than related to your interests. Personalising your online experience doesn’t affect the marketing options you have selected, it’s to offer you a service personalised to your needs.
How do I object?
If you’re a registered customer you can email the contact details given below with your request. If you’re not a registered customer, information held in our Cookies may be used to select content that we feel is more relevant for you. To prevent this, you can clear your cookies.
Running our Advantage Card scheme
Advantage Card offers great benefits and rewards, and we aim to make these as relevant to you as we can. In order to do so, we need your personal information. If you’re a member of our Advantage Card scheme, we’ll build up a picture of you based on your use of Boots services. This includes your online and offline shopping habits, your browsing habits, information you give us about yourself and through any clubs you’re a member of (such as Parenting Club, Over 60s etc.) and any information you provide about your family. We also include any information we’ve obtained from consent-based, commercially available sources (such as Experian) about you and people with similar interests and attributes. By building up and fine-tuning this picture of you, we can provide you with tailored offers that are exciting and relevant to you. Please note that we only send you marketing material if you’ve agreed that we can.
Please be assured that information we hold about prescriptions that we’ve dispensed aren’t included in the picture we build up of you.
Can I object to this?
The benefit of being an Advantage Card member is to receive points and rewards on the products and services that interest you. Without building up a detailed picture of you we can’t tailor our offers and rewards to be personal to you and you won’t receive the full benefits of being an Advantage Card member. If you don’t wish to have your data used in this way, please contact us using the details provided below.
If you do not wish to have your personal data processed for any purpose related to the Advantage Card scheme, you’ll not be able to have an Advantage Card. If you’re an existing member, you therefore need to close your Advantage Card account. You’ll still be able to shop at Boots and use our services but you won’t earn points or receive rewards.
Building up a picture of you
We may analyse your personal information, including the products you view and buy, your browsing habits and other ways you interact with Boots to evaluate the effectiveness of our advertising and help us provide more relevant offers, advice and information across a variety of marketing channels including social media sites such as Facebook. This will include information about the way you interact with our other group companies, and information about your memberships such as Parenting Club and Over 60s. We may analyse your personal information, including the products you view and buy, your browsing habits and other ways you interact with Boots to evaluate the effectiveness of our advertising and help us provide more relevant offers, advice and information. This will include information about the way you interact with our other group companies, and information about your memberships such as Parenting Club and Over 60’s. We may also use information from external (consent-based) companies such as Experian. Rest assured that we’ll only send you marketing material if you’ve agreed that we can, and we’ll never use sensitive information about your health. If you’re an Advantage Card customer, we’ll carry out this type of analysis in order to provide the benefits of the scheme.
Some of our marketing selection processes are fully automated so that we can ensure we’re selecting offers, products and services that are the most relevant for each customer. In order to do this, we use data that we’ve obtained from your use of the Advantage Card such as what brands or products you like to purchase, how frequently you shop with us, how much you spend with us and which of our stores you shop in the most. We combine this with demographic data that we obtained when you signed up for the scheme, such as your gender, your age and where you live – this is particularly relevant when inviting you to events. This aggregated data is then compared against our other customers to understand your shopping habits in context. By doing this, we can tell you about products we already know you like and also suggest new products that we think you’d be interested in based on what people like you are buying.
Can I opt out of this?
Yes, but if you have asked to receive marketing you’ll receive only generic offers based on your gender, age, location rather than specific marketing based on preferences and how you use Boots services. If you wish to opt-out please use the contact information provided at the end of the Privacy Policy.
Healthcare analytics
We carry out analytics on data about the prescriptions we dispense, which enables us to understand how our business is operating so we can develop our products and services. It also enables us to provide valuable insights about dispensing activity which we may share with partner organisations. Before we undertake any such analytics with pharmacy data, we anonymise it in line with the ICO Anonymisation Standards so it’s not linked to you and you cannot be identified from it.
Can I object to this?
As the data we use in this activity is anonymised in line with the ICO anonymisation standards, it’s no longer personal data, so you cannot exercise a legal right to object to it.
Healthcare/clinical research and market research
We work with leading universities, healthcare and pharmaceutical companies and other bodies carrying out healthcare research. This may involve providing anonymised and/or aggregated data about our dispensing activities. We have a strict process for assessing research requests and we only agree to take part in projects that have received ethical approval. Where any third party has access to Boots premises or data, we have measures in place to ensure they access only the data we’ve authorised them to access and for purposes of the research only.
Being able to conduct, participate and contribute to this type of data enables Boots to assist with helping to find cures and better solutions for healthcare, which will hopefully go on to benefit the healthcare of the public and our customers.
Can I object to this?
We believe this is an important activity that will benefit the public and may lead to a breakthrough in the healthcare sector. Like any data we use or provide is anonymised in line with ICO guidance, it’s no longer personal data and you can’t exercise a right to opt out.
As a pharmacy-based retailer, research is vital to our business. Occasionally, we contact customers who meet a particular set of criteria, including health-related factors, to invite them to take part in clinical research. The research may be carried out by external companies acting on our behalf but we’ll never pass your personal information onto them unless we have your consent to do so. You’re always free to decline or withdraw your consent at any time by contacting us.
On occasion, we may work with researchers who are looking for volunteers to take part in various research studies. Therefore, our pharmacists in store may ask if you’re willing to take part in this type of research. If you’re interested in hearing more, we may then put you in touch with the researchers who will provide you with all of information required and ask for your consent before any research begins. In such cases, Boots doesn’t receive any details about people who decide to take part in the research, and your data will be processed by the researcher.
Customer feedback surveys and market research
We may invite you to give feedback on Boots services you’ve used or take part in market research activities such as customer surveys, questionnaires or focus groups. Although the invitation may be sent to you by third party agencies on our behalf, rest assured that we only send your contact details and, where relevant, data that we’ve collected through the use of your Advantage Card. We’ll only contact you by email if you’ve have indicated that you’re happy to receive marketing from Boots. Please be aware that you won’t be contacted more than once every six months for research purposes, unless you have signed up separately to our Viewpoint panel and we never sell your personal data.
Boots will only ever share your data with reputable agencies in a safe and secure manner. All personal data is deleted as soon as it’s been used. Keeping your data safe is our top priority.
Can I opt out?
Yes, you’ll always be able to decline to take part in research activities and you can opt out of these types of emails from Boots as well as other marketing emails. You can do this by managing your preferences online or following the unsubscribe link at the bottom of any of our emails
Using your data with your consent
Appointment booking – searching our systems
If you’ve previously had a prescription dispensed at a Boots pharmacy, we may have your contact details in our pharmacy system. These may be retrieved when we look up your details, but rest assured that we’re unable to access any pharmacy details beyond your contact details.
How we send you marketing material
We use your information to send you offers and information, and you’ll always be asked if you want to receive offers and information and via what channels you would like to receive them.
Can I opt out of this?
Yes, you can change your mind about receiving marketing material from us at any time by contacting our Customer Service Centre or logging into your account on boots.com.
Please be aware that as our marketing campaigns are prepared well in advance, you may still receive material by post for up to two months, and by e-mail or text for up to 28 days after updating your preferences.
You can also opt in or out of receiving our e-newsletters on a variety of health-related topics, as well as ‘weekly offers’ emails by visiting our online preference centre. Alternatively, you can click on the link at the bottom of any email we’ve sent you to opt out of that particular type of email.
Basket reminder emails
When you visit our website as a registered customer that is opted-in to marketing emails, we will use your email address to contact you with a reminder containing a list of unpurchased items that are still in your basket.
Can I opt out?
Yes, you will always be able to opt out of emails from Boots as well as other marketing emails. You can do this by managing your preferences online or following the unsubscribe link at the bottom of any of our emails.
Important: using information about your prescriptions
When you use our services, some of the information we collect may be about your health and include data from NHS bodies such as your GP or hospital. We understand the sensitivity of this information and will only use it to provide you with these services and fulfil our legal obligations to the NHS or similar bodies.
As a healthcare provider, we’re regulated by bodies including the GPhC, GOC and CQC. All of whom may set out requirements which we need to comply with when processing personal data, including timescales for keeping data, reporting requirements and professional codes of practice. Where we provide NHS services, we’re required to comply with NHS Information Governance requirements. One of the requirements is to complete an Information Governance Toolkit which is used to report compliance to a set of information, protection and governance standard to the NHS. The same standards are applied in Northern Ireland and Scotland.
Where we’re contracted to provide a service to, or on behalf of, the NHS or an individual NHS Trust or body, we’ll use your personal data to help us meet our contractual requirements to that body.
Dispensing prescriptions
The information we hold on your personal medical record is used only to enable us to dispense your prescription legally, safely and to fulfil our requirements to you and the NHS. As mentioned above, we may use your address and contact details with your consent to search across our other systems. You’ll always be asked for your consent to this and your consent can be withdrawn at any time.
Can I opt out of this?
No, if you request Boots Pharmacy to carry out this service we need to use this information to dispense your prescription safely and legally.
Summary Care Record
This is only used with your consent and in emergencies.
Prescription detail
We’ll never use information about your prescriptions for marketing, although we may use it to let you know about services we provide that might be useful and relevant to you when you come into our pharmacy. For example, when you collect a prescription a Boots pharmacist might ask if you’d like to take advantage of our New Medicines Service, a Medicines Use Review, Diabetic Support Services or other similar services that may be relevant and useful to you. These services are voluntary, but if you choose to use them we’ll need to ask you some health-related questions in order to fulfil our contractual obligations with the NHS. The information you give us will only be shared with the relevant NHS bodies and we won’t use it for any other purpose.
Sharing your information outside the Walgreens Boots Alliance Group
Legal obligations
We may share your personal information with third parties where required or permitted by law, if we believe we need to do so to protect our rights, or to comply with legal proceedings. In such cases, we’ll always do so legally and with due regard to your privacy.
Sharing with the NHS
We share information with NHS bodies to fulfil our legal obligations as a provider of pharmacy, optical and hearing care services, or where we have a duty of care to do so. For example, to obtain payment for the services we provide and to measure the effectiveness of services.
In some circumstances we might need to let your GP know we’ve prescribed an item or given you a particular service.
If you’ve asked us to register you for an NHS scheme or service such as the NHS Organ Donor scheme, we’ll pass your personal information to the NHS using a secure method of data transfer so the NHS can register you for the relevant scheme or service.
If you choose to have one of the NHS services provided in our pharmacies, such as a Medicines Use Review, we’ll ask you for health-related information which is needed to fulfil our contractual obligations to the NHS. We share this information only with NHS bodies and won’t use it in any other way. Although we may use your contact details to send you reminders about any follow-up appointments.
Non-Boots brands
From time to time we may contact you with special offers on behalf of brands we stock, but we’ll never sell or share your data with those brands for them to use in their own marketing.
If you give your contact details and any other personal information at one of the premium beauty counters in our stores, you may be giving the information to that company rather than to Boots. Each company has its own Privacy Policy which may not be the same as ours, so we advise that you check who is collecting your personal information and how they’ll use it before signing up to receive offers or information. Similarly, if you click through to another company’s website via a link on boots.com, check you’re happy with that company’s Privacy Policy before giving your personal information.
Changes to our business
If ownership of all or part of our business changes, or we undergo a reorganisation (including a merger or transfer between Walgreens Boots Alliance companies), we’ll transfer your personal information to the new owner or successor company so we can continue to provide our services.
Companies that provide services on our behalf
We share your personal information with companies that provide services on our behalf, such as printers, couriers, mailing houses, data hosting services, call centre providers, market research, manufacturers and suppliers. We always ensure these companies give your information the same level of care and security we do. If your information is to be sent outside Europe, we make sure it’ll be subject to standards of protection and security that are as high as those Boots uses here in the UK. For more information on the location of your data please see below.
Examples of the functions that may be carried out by external companies:
• Customer service centre
• Account set up and card issue
• Mailing houses and printers
• Delivery services such as couriers
• Market research
• Manufacturers or suppliers
• NHS bodies, such as GP and hospitals
• Payment providers
• Companies that provide web hosting, content providers, competitions, waiting lists etc.
• Companies that do fraud and money laundering checks
• Companies that provide IIT services & support inclusive of web hosting, data storage, data cleansing, content providers, competitions, waiting lists etc.
• Contact lens and glasses manufacturers and suppliers, and hearing care
Sharing data outside of the European Economic Area (EEA)
The EEA comprise of all of the European Union countries and Iceland, Liechtenstein and Norway. Personal data can be transferred, processed and stored within these countries safely and securely as they offer an adequate level of protection to personal data in comparison to the UK.
There are a number of additional countries that can also offer an adequate level of protection, these are Andorra, Argentina, Canada, Faroe Islands, Guernsey, Israel, Isle of Man, Jersey, New Zealand, Switzerland, Uruguay and the US.
Countries that Boots shares information with, which are outside of the above listed countries, are: Vietnam, China, India and Thailand. If your information is sent to any of these four countries, we make sure it’ll be subject to standards of protection and security that are as high as those Boots uses here in the UK.
We take your data very seriously, therefore we’ll always conduct a full review of all of our suppliers’ processes and procedures including storage solutions for our data. In order to ensure adequacy when sending your data outside of the EEA, we put in place contracts based on the Standard EU Model Contract Clauses which are designed by the European Commission to guarantee adequacy for any data transfer and processing of this nature.
Can I opt out of having my data shared?
As your data is stored safely and securely both inside and outside of the EEA, we cannot offer alternative storage solution. If you wish to opt out of having your data stored outside of the EEA, you’ll need to close your account with Boots.
How long do we keep your personal information?
We hold your personal information for as long as we have a legal or business reason to do so, which generally means as long as you remain a Boots customer or as required to meet our legal obligations, resolve disputes or enforce our agreements. To fulfil our obligations to the NHS, regulatory or similar bodies, health-related personal information may need to be retained for a period of time after you cease to be a Boots customer. We’ll always store your data securely and won’t use it for any other purpose.
Keeping your data secure: what you can do?
Securing your payment details online
Boots.com has been issued with a Secure Server Digital Certificate by the online Certification Authority, Digicert. This confirms that boots.com is a legitimate website that provides an encrypted communication channel to protect the information you pass to Boots when making a purchase. For more information about VeriSign Digital Authentication services and online security guarantees, visit the VeriSign website. In addition to this, all credit/debit card payments are securely handled by an industry-leading payment processor and are never stored on the Boots website.
Staying in control of your information: Your rights
We respect the fact that your personal information is your information, and we’ll make it easy for you to update or change your personal details or marketing permissions. Please help us to help you by letting us know if your contact details change, or if you spot any errors in the information we hold about you.
Your right of access
If you would like a copy of the information Boots holds about you or have any queries about the way Boots handles your personal information, please contact our Customer Service Centre.
What information am I entitled to?
You have to right to obtain a copy of the all information that Boots holds about you, such as personal details, correspondence, marketing preferences, consent information, complaints, queries and Advantage Card history, within a 30 day time limit and free of charge.
Your right to move your data (portability)
Under certain circumstances you can request that Boots moves your data to another service provider. The is not an automatic right, depending on the type of data that Boots holds about you and the reason Boots process the data will depend on what Boots are able to do. Please contact our Customer Service Centre to submit a request.
Your right to processing
You have to right to request that Boots stop certain data processing activities that involve processing your personal data, this can be processes such as collecting your name and address on your boots.com account to deliver goods to you, among other examples given above. This isn’t an automatic right, what Boots are able to do will depend on the type of data that Boots hold about you and why. Please contact our Customer Service Centre to exercise your right to object to Boots processing your data.
You have a right request deletion
While you remain a customer, we’ll process and retain your data as described in this Policy. Once you cease to be a customer we’ll hold your data for as long as required by law. You do have a right to request that Boots deletes your personal data it holds. This isn’t an automatic right, what Boots are able to delete will depend on the type of data that Boots hold about you. Please visit our Customer Service Centre to request you data to be deleted.
CCTV
If you require access to CCTV footage (for example, if you’re the victim of a crime that takes place on Boots’ premises), you should write to us at
Central Customer Care Team,
D94,
Nottingham
NG90 1BS
UK
We’ll ask the date and approximate time of the incident you wish to view and as much detail as you can to help us locate the correct footage, and we may make a small charge. We’ll do our best to help, but there are situations in which we may be unable to make CCTV footage available to you, such as where the incident occurred some time ago or if we believe that allowing you to view it would breach someone else’s privacy. CCTV is held for a 30 day period.
For all request mentioned above, there is a 30 day limit to which Boots must respond by and you’re required to provide proof of your identity.
Processing data about children
Boots Opticians and Boots Pharmacy process children’s data for appointments and when processing prescriptions. Children under the age of 16 using these services must be accompanied by an adult at all times. If you’re a member of the Parenting Club, Boots will also store and process your child’s data, such as their date of birth. In order to obtain a Boots Advantage Card or a boots.com account you must be at least 13 years old.
Who to contact
For all questions relating to this policy please contact boots.customercare_team@boots.co.uk
Your right to complain to the ICO
Although we hope it never comes to this, you do have the right to complain to the ICO about any of Boots processing activities at casework@ico.org.uk
Changes to this Privacy Policy
This Privacy Policy was updated in June 2019. We may update it from time to time so we recommend that you check back here occasionally. If we make changes we think may affect you significantly, particularly if they could have an impact on the choices you have made about marketing, we’ll provide you with a prominent notice by the most appropriate medium so you know about the changes before they happen.