Version 2.0 · 26 August 2026
Data Protection Complaints and Rights Requests
Send a data-protection complaint or rights request to enquiries@thebighealthcommunity.co.uk. Please use a clear subject such as “Data protection complaint”, “Subject access request”, “Correction request” or “Objection to marketing”.
1. Information to include
- Your name and business contact details.
- Your relationship to The Big Health Community or a customer business.
- A clear description of the concern or right you wish to exercise.
- Relevant dates, account details or reference information.
- The outcome you are seeking.
Do not send patient or clinical information unless it is strictly necessary. Contact us first if the matter may involve sensitive or special-category information.
2. Identity verification
We may ask for proportionate information to verify identity or authority before disclosing or changing personal information. We will not ask for more information than reasonably necessary for verification.
3. Rights requests
Depending on the circumstances, individuals may have rights of access, correction, erasure, restriction, objection, data portability and rights relating to certain automated decisions. Some rights are subject to legal conditions and exemptions.
4. Response times
We will handle rights requests without undue delay and normally within one month of receipt once we have sufficient information to identify the request and verify identity where necessary. Where the law permits an extension for a complex request or multiple requests, we will explain this and the expected timetable.
We aim to acknowledge complaints promptly and keep the complainant informed where an investigation is continuing.
5. Fees
We do not normally charge a fee for exercising data-protection rights. Where the law permits a reasonable fee because a request is manifestly unfounded or excessive, or for further copies, we will explain this before proceeding.
6. Data breaches and security concerns
If your concern relates to suspected unauthorised access, disclosure, loss or misuse of personal information, please mark the message “URGENT – DATA SECURITY” and provide enough information for us to assess the issue without including unnecessary sensitive data.
7. Complaints involving a customer pharmacy
Where a concern relates to personal information controlled independently by a participating pharmacy, we may direct the individual to that pharmacy where appropriate. The Big Health Community does not ordinarily act as a processor of patient records for participating pharmacies.
8. Our investigation
We may review account records, security logs, relevant correspondence, supplier information and internal records; consult professional advisers; preserve evidence; and contact relevant service providers where reasonably necessary to investigate a concern.
9. Outcome
We will explain the outcome of the complaint or rights request, any action taken and, where applicable, why a request has been refused or restricted and the available route to challenge that decision.
10. Information Commissioner’s Office
You have the right to complain to the Information Commissioner’s Office (ICO). You do not have to contact us first, although giving us the opportunity to investigate may allow the matter to be resolved more quickly.
11. No retaliation
We will not disadvantage a person merely because they have made a genuine data-protection complaint or exercised a legal data-protection right.
12. Record keeping
We may retain proportionate records of complaints, rights requests, identity-verification steps, decisions and correspondence for accountability, security, legal-claims and audit purposes.