Privacy Policy

1. Who we are

MogPharm is operated by:

MogPharm Limited
Suite RA01
195-197 Wood Street
London
E17 3NU
United Kingdom

Company number: 15829054

For Personal Data that we collect and use for our own business purposes, including website enquiries, account administration, customer communications, billing and sales activity, MogPharm Limited is the Data Controller.

Where a pharmacy, pharmacy group or other organisation uses MogPharm to upload or manage Personal Data relating to its staff, patients, contractors or other individuals, that organisation will normally be the Data Controller, and MogPharm will process that information on its behalf as a Data Processor.

Further information about our role as a Processor is contained in our Data Processing Agreement.

Privacy enquiries can be sent to:

privacy@mogpharm.com

Our ICO registration number is:

ZC252931

If we appoint a formal Data Protection Officer in the future, their contact details will be published here. Until then, privacy enquiries should be directed to the email address above.

2. Personal Data we collect

The Personal Data that we process depends on how you interact with MogPharm and how your organisation uses the Service.

2.1 Account and profile information

When you create or use a MogPharm account, we may process:

• your name;
• work email address;
• work telephone number where provided;
• job title;
• professional role;
• pharmacy or organisation name;
• pharmacy branch;
• account permissions and user role;
• account authentication information; and
• information relating to your account status.

2.2 Pharmacy operational and compliance information

Where your organisation uses the MogPharm platform, the Service may process information associated with:

• Standard Operating Procedures (SOPs);
• policy acknowledgements;
• staff declarations;
• staff training and competency;
• compliance activities;
• inspection-readiness activities;
• tasks and corrective actions;
• audit trails;
• pharmacy date checking;
• medicine expiry and quarantine records;
• controlled-drug governance;
• Responsible Pharmacist records where applicable;
• near misses;
• incidents;
• patient-safety activities;
• complaints and governance records;
• pharmacy services and operational activity;
• supporting documents and evidence; and
• other records entered by authorised users.

This information may include Personal Data relating to pharmacy employees, locums, contractors, patients, witnesses or other individuals referenced within pharmacy records.

When MogPharm processes this information on behalf of a customer organisation, the customer is normally the Controller and MogPharm acts as its Processor.

2.3 Patient and Special Category Data

Certain MogPharm functions, particularly those relating to patient safety, incidents or pharmacy governance, may allow authorised users to enter information that constitutes Special Category Data, including health information.

Customers and users should only enter identifiable patient information where it is necessary, proportionate and permitted under their organisation’s policies and applicable law.

Where appropriate, pharmacy organisations should use anonymised or minimised information rather than directly identifiable patient information.

MogPharm does not require customers to upload more Personal Data than is reasonably necessary to use the relevant functionality.

2.4 Technical and usage information

When you use the Service, we may automatically collect technical information such as:

• IP address;
• browser type;
• device type;
• operating system;
• login information;
• session information;
• timestamps;
• pages or areas of the Service accessed;
• actions performed within the Service;
• error and diagnostic information; and
• security and audit logs.

We use this information primarily to operate, protect, troubleshoot and improve the Service and to maintain appropriate security and accountability.

2.5 Communications and enquiries

If you contact us, request information, submit a website form or book a demonstration, we may collect:

• your name;
• email address;
• telephone number where provided;
• pharmacy or organisation;
• job title;
• information contained in your message;
• meeting or demonstration details; and
• records of our communications with you.

2.6 Billing and commercial information

Where applicable, we may process:

• customer organisation details;
• billing contact information;
• subscription details;
• invoices;
• payment status;
• transaction references; and
• records relating to the customer’s commercial relationship with MogPharm.

Where payment processing is handled by a third-party payment provider, MogPharm may not directly receive or store full payment-card details.

3. How we obtain Personal Data

We may obtain Personal Data:

• directly from you;
• from your employer or organisation;
• when an administrator creates or manages your account;
• when you use the Service;
• when information is entered into MogPharm by authorised users;
• when you contact us;
• when you request or attend a demonstration;
• through our website;
• from service providers supporting the operation of MogPharm; or
• from publicly available professional or business information where appropriate.

4. How and why we use Personal Data

We process Personal Data only where we have an appropriate lawful basis.

Providing and administering the Service

We may use Personal Data to:

• create and administer accounts;
• authenticate users;
• provide access to the Service;
• maintain customer subscriptions;
• provide customer support;
• communicate about the Service; and
• administer our contractual relationship with customers.

Lawful basis: performance of a contract, steps taken prior to entering into a contract and/or our legitimate interests in operating our business.

Operating pharmacy compliance functionality

Where MogPharm processes operational or pharmacy Personal Data on behalf of a customer, we do so under the customer’s documented instructions.

The customer is responsible for determining the appropriate lawful basis for that processing.

Security and fraud prevention

We may process information to:

• protect accounts;
• monitor security;
• investigate suspicious activity;
• prevent misuse;
• maintain audit trails;
• diagnose technical problems; and
• protect MogPharm, our customers and users.

Lawful basis: our legitimate interests in securing and protecting the Service and, where applicable, compliance with legal obligations.

Customer support and communications

We may use your information to respond to:

• enquiries;
• support requests;
• complaints;
• demonstration requests; and
• other communications.

Lawful basis: legitimate interests and/or steps taken at your request before entering into a contract.

Improving the Service

We may use appropriately limited technical, operational and usage information to understand how the Service performs, diagnose problems and develop or improve MogPharm.

Where possible, we use aggregated or anonymised information for these purposes.

Lawful basis: our legitimate interests in maintaining and improving our products and services.

Legal and regulatory requirements

We may process information where necessary to:

• comply with applicable law;
• respond to lawful requests from authorities;
• establish, exercise or defend legal claims;
• maintain appropriate business records; and
• protect our legal rights.

Lawful basis: legal obligation and/or legitimate interests.

5. Marketing communications

We may contact existing or prospective business customers about MogPharm products, services, events or other relevant information where permitted by law.

Depending on the circumstances, we may rely on consent or our legitimate interests in promoting MogPharm to relevant business contacts.

Where required by applicable electronic-marketing rules, we will obtain consent before sending marketing communications.

You can stop receiving marketing communications at any time by:

• using the unsubscribe option provided in the communication; or
• contacting privacy@mogpharm.com.

Opting out of marketing will not prevent us from sending essential Service-related communications, including account, security, contractual or operational notices.

6. Automated decision-making and artificial intelligence

MogPharm may use automated functionality to support compliance workflows, reporting, reminders, prioritisation or other features within the Service.

Unless expressly stated otherwise, MogPharm does not make decisions about individuals solely through automated processing that produce legal effects or similarly significant effects within the meaning of UK data-protection law.

Where future functionality involves such processing, we will provide appropriate information and safeguards before that functionality is introduced.

7. How we share Personal Data

We do not sell Personal Data.

We may share Personal Data where necessary with trusted service providers that support the operation of MogPharm.

Our principal infrastructure providers currently include:

Supabase

Used for services including database infrastructure, authentication and file storage.

Vercel

Used for application hosting, server-side functionality and content delivery.

Resend

Used to send transactional, account and notification emails.

Where these providers process Customer Data on our behalf, they are required to operate under appropriate contractual and data-protection obligations.

More information about our principal Sub-processors is available in the MogPharm Data Processing Agreement.

We may also share Personal Data:

• with professional advisers such as lawyers, accountants or insurers where necessary;
• with regulators or public authorities where legally required;
• with law-enforcement bodies where required by law;
• to establish, exercise or defend legal claims;
• in connection with a corporate restructuring, investment, merger, acquisition or sale, subject to appropriate safeguards; or
• where you or the relevant Controller instructs or authorises us to do so.

8. International transfers

MogPharm intends for its primary production database to be hosted in the United Kingdom.

However, some service providers or their Sub-processors may process or access Personal Data from countries outside the United Kingdom.

Where Personal Data is subject to a restricted international transfer, we will use an appropriate transfer mechanism where required under UK Data Protection Laws.

Depending on the circumstances, safeguards may include:

• UK adequacy regulations;
• the UK International Data Transfer Agreement;
• the UK Addendum to the European Commission Standard Contractual Clauses;
• binding corporate rules; or
• another legally recognised transfer mechanism.

Where required, we will also carry out appropriate assessments relating to the protection of transferred Personal Data.

Further information regarding international processing may be available in our Data Processing Agreement or from privacy@mogpharm.com.

9. How long we keep Personal Data

We do not retain Personal Data for longer than reasonably necessary for the purposes for which it was collected, subject to applicable legal and regulatory requirements.

Retention periods may depend on:

• the type of information;
• the purpose for which it is processed;
• the duration of the customer’s subscription;
• customer instructions;
• legal or regulatory requirements;
• pharmacy governance requirements;
• potential legal claims; and
• security and business-continuity requirements.

Customer Data

Where MogPharm acts as a Processor, the customer is primarily responsible for determining appropriate retention periods for Personal Data stored through the Service.

Following termination of a customer’s subscription, Customer Data may be returned, exported or deleted in accordance with our Data Processing Agreement and contractual terms.

Information may remain temporarily within secure backup systems until the applicable backup cycle expires.

MogPharm’s own records

Where we act as Controller, we retain information only for as long as reasonably required for the relevant business, contractual, legal or security purpose.

When Personal Data is no longer required, it will be securely deleted or anonymised where appropriate.

10. How we protect Personal Data

MogPharm uses technical and organisational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, disclosure or access.

Depending on the relevant system and functionality, these measures may include:

• role-based access controls;
• least-privilege access principles;
• authentication controls;
• database access policies;
• tenant-level data segregation;
• row-level security where applicable;
• encryption of information in transit;
• encryption at rest through relevant infrastructure providers;
• restricted administrative access;
• security and administrative logging where implemented;
• controlled production access;
• separation of production, development, staging or demonstration environments where appropriate;
• backup and recovery arrangements; and
• procedures for responding to security incidents.

No internet-based system can be guaranteed to be completely secure. We therefore continually review security arrangements and seek to improve safeguards as the Service develops.

11. Account security

Users are responsible for maintaining the confidentiality of their login credentials.

You should:

• use secure credentials;
• not share login details with unauthorised persons;
• ensure that only authorised users access your organisation’s account; and
• inform your organisation or MogPharm promptly if you suspect unauthorised account access.

Customer administrators are responsible for appropriately assigning and removing access rights for users within their organisation.

12. Your data-protection rights

Depending on the circumstances and subject to applicable legal conditions and exemptions, you may have the right to:

• access Personal Data held about you;
• rectify inaccurate or incomplete Personal Data;
• request erasure of your Personal Data;
• request restriction of processing;
• object to certain processing;
• request data portability in applicable circumstances;
• withdraw consent where processing is based on consent; and
• object to certain types of direct marketing.

You may also have rights concerning automated decision-making where applicable.

To exercise your rights in relation to Personal Data for which MogPharm is the Controller, contact:

privacy@mogpharm.com

We may need to verify your identity before responding to a request.

Data controlled by your pharmacy or organisation

If the Personal Data concerned was entered into MogPharm by your pharmacy, employer or another customer organisation, that organisation will normally be the Controller.

In those circumstances, we may refer your request to the relevant organisation or assist that organisation in responding to you.

13. Complaints

If you have concerns about how we handle Personal Data, we encourage you to contact us first at:

privacy@mogpharm.com

You also have the right to complain to the UK’s independent data-protection regulator:

Information Commissioner’s Office (ICO)

Information about making a complaint is available at ico.org.uk.

14. Cookies and similar technologies

MogPharm may use cookies or similar technologies that are necessary to:

• authenticate users;
• maintain sessions;
• secure accounts;
• prevent fraud or misuse; and
• provide essential website or application functionality.

Strictly necessary cookies do not generally require consent.

If MogPharm introduces analytics, advertising or other non-essential cookies or similar technologies, we will provide appropriate information and consent controls where required.

Further information may be provided through a separate Cookie Policy.

15. Third-party links

Our website or Service may contain links to third-party websites or services.

MogPharm is not responsible for the privacy practices of third parties. We encourage users to review the privacy information provided by those organisations before submitting Personal Data to them.

16. Children

MogPharm is a professional business platform intended for pharmacies, pharmacy organisations and authorised healthcare personnel.

The Service is not directed at children, and children should not create MogPharm accounts.

This does not prevent pharmacy customers from processing information relating to patients who are children where doing so is lawful, necessary and appropriate in connection with their professional activities.

Where this occurs, MogPharm processes that information on behalf of the relevant pharmacy organisation.

17. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect:

• changes to the Service;
• changes to our processing activities;
• changes to service providers;
• legal or regulatory developments; or
• improvements to our privacy practices.

The date at the top of this Privacy Policy indicates when it was last updated.

Where a change is material, we may notify affected users through the Service, by email or through another appropriate communication channel.

18. Contact us

For questions about this Privacy Policy or how MogPharm handles Personal Data, contact:

MogPharm
MogPharm Limited
Suite RA01
195-197 Wood Street
London
E17 3NU
United Kingdom

Company number: 15829054
Privacy email: privacy@mogpharm.com
ICO registration number: ZC252931