Version 2.0 · 26 August 2026

Privacy Notice

1. Who we are

N-Chem Consultancy Ltd trading as The Big Health Community is the controller of the personal information described in this notice. Company number 15016760. Registered office: 1 Clay Street, Soham, Ely, Cambridgeshire, CB7 5HJ. Contact: enquiries@thebighealthcommunity.co.uk.

2. Scope

This notice applies to visitors to the public website, prospective and current pharmacy customers, customer account users, supplier and professional contacts, people who contact us, and people who make a complaint or exercise data-protection rights.

The portal is a read-only business administration and reporting area. The service is not designed to receive patient records.

3. No patient or clinical data

We do not ask customers to provide patient names, NHS numbers, prescription details, consultation notes, medical histories, diagnoses or other patient-identifiable clinical information. Customers and users must not submit such information through the website, portal, forms or ordinary support email.

If patient or special-category information is sent to us unexpectedly, we will limit access, assess what happened and securely delete, isolate or otherwise handle it in accordance with applicable law and security requirements.

4. Personal information we may collect

• Names, job titles, business email addresses, business telephone numbers and employer or organisation details.
• Website, device, IP address, security, access-log and authentication information.
• Customer account details, account-user records and login activity.
• Pharmacy business details, participating locations, tiers, bolt-ons, charges, billing status and service notes.
• Order summaries, terms-acceptance records, payment references and mandate-status information. Full card or bank-account credentials are handled by the selected payment provider rather than stored by us.
• Aggregate campaign reporting information, including Monthly Views and campaign summaries.
• Service requests, billing questions, complaints and correspondence.
• Supplier, professional-adviser and business-partner contact information.
• Records needed for security, fraud prevention, dispute handling, legal claims, accounting and regulatory compliance.

5. Where information comes from

We may obtain information directly from you, from your employer or another authorised representative, from participating pharmacies, from public business sources, from our website and security systems, and from service providers such as hosting, email, payment or accounting providers.

6. Why we use personal information and lawful bases

We use personal information for the following purposes:

• Enquiries and pre-contract steps: to respond to enquiries, prepare proposals and discuss services. Depending on the context we rely on steps taken at an individual’s request before entering into a contract or our legitimate interests in developing and administering business relationships.
• Customer administration and service delivery: to create and administer accounts, manage participating pharmacies, deliver campaigns, handle service changes, publish reporting and communicate with authorised users. Where the contract is with an individual we may rely on contract; for incorporated customers and their staff we generally rely on legitimate interests in performing and managing the business relationship.
• Billing and records: to administer charges, payment references, accounting and tax records. We rely on contract, legitimate interests and legal obligation as applicable.
• Security and fraud prevention: to protect accounts, systems, data and the service, investigate suspicious activity and maintain logs. We rely on legitimate interests in network and information security and, where applicable, legal obligation.
• Complaints, disputes and legal claims: to investigate concerns, preserve evidence, obtain professional advice and establish, exercise or defend legal rights. We rely on legitimate interests and legal obligation as applicable.
• Necessary service communications: to send account, security, billing, operational and contractual messages. We rely on contract or legitimate interests depending on the relationship.
• Optional business marketing: where we send promotional communications, we rely on an appropriate lawful basis and comply with applicable electronic-marketing rules. Recipients may object or opt out at any time.

Where we rely on legitimate interests, those interests include operating and securing the service, administering customer and supplier relationships, maintaining accurate records, improving business processes, protecting legal rights and communicating with business contacts. We consider necessity, reasonable expectations and privacy impact before relying on this basis.

7. Special-category and criminal-offence information

Our normal service does not require special-category or criminal-offence data. We do not intentionally use such information for campaign targeting, customer profiling or advertising. If it is received unexpectedly, we will only retain or use it where a lawful Article 6 basis and any additional condition required by law apply.

8. Sharing and recipients

We may share relevant information with categories of service providers including website hosting, email delivery, cybersecurity, backup, payment, accounting, professional advisers and technical support. We may also disclose information to competent regulators, courts, law-enforcement bodies, insurers, auditors or prospective purchasers of the business where lawful and necessary.

We do not sell personal information and do not share customer-contact information with advertisers for their independent advertising purposes.

9. Payment information

Payment or mandate links may direct users to an external payment provider. That provider acts under its own privacy terms for payment details it collects. Our systems may retain transaction references, status information, invoice records and other information reasonably necessary to administer the account, but are not intended to retain full payment credentials.

10. International transfers

Some service providers may process information outside the United Kingdom. Where a restricted international transfer occurs, we will use an appropriate legal mechanism such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses or another lawful safeguard, together with additional measures where required.

11. Retention

We retain information only for as long as reasonably necessary for the purpose collected, including legal, accounting, tax, security and dispute-resolution requirements. As a general guide:

• Unsuccessful general business enquiries are normally retained for up to 24 months after the last meaningful contact unless a longer period is justified.
• Customer, contract, order, payment-reference, service, reporting and dispute records are normally retained for the contract term and up to six years afterwards where needed for contractual, tax, audit or legal purposes.
• Security and technical logs are generally retained for a shorter proportionate period unless they are needed for an incident, investigation or legal claim.
• Marketing suppression records may be retained for as long as needed to respect an opt-out.

We may anonymise information instead of deleting it where it can no longer identify an individual.

12. Security

We use proportionate technical and organisational measures including access controls, password protection, secure hosting, software updates, backups, monitoring and restricted administrative access. No internet service can be guaranteed completely secure, so users must also protect their credentials and devices.

13. Personal data breaches

We assess suspected personal data breaches promptly. Where a breach is likely to result in a risk to people’s rights and freedoms, we will notify the Information Commissioner’s Office without undue delay and, where required, within 72 hours of becoming aware of it. Where a high risk to individuals exists, we will also communicate with affected individuals unless an exemption applies.

14. Your rights

Depending on the circumstances, you may have rights of access, correction, erasure, restriction, objection and data portability, and rights relating to certain automated decisions. Where we rely on consent, you may withdraw it. Where we rely on legitimate interests or use personal information for direct marketing, you may object.

Rights are not absolute and may be subject to legal exemptions. We may need to verify identity before acting on a request.

15. Automated decision-making

We do not currently make decisions producing legal or similarly significant effects about individuals solely by automated means as part of this service.

16. Children’s data

The service is business-to-business and is not directed at children. We do not knowingly create portal accounts for children or seek children’s personal information through the service.

17. Direct marketing

Where we send optional marketing to business contacts, we will respect applicable UK GDPR and Privacy and Electronic Communications Regulations requirements. You may opt out of marketing at any time without affecting necessary service communications.

18. Cookies and storage technologies

Our use of cookies and similar storage or access technologies is described in the Cookie Policy. We do not intentionally activate non-essential analytics or advertising tracking without first implementing the transparency and consent controls required by law.

19. Complaints

You can raise a data-protection concern through our Data Protection Complaint page or email enquiries@thebighealthcommunity.co.uk. You also have the right to complain to the Information Commissioner’s Office.

20. Changes to this notice

We may update this notice when our services, suppliers, technologies or legal obligations change. The current version and date will be shown on this page.

PDPR