Privacy Policy
Last updated: [date]
This Privacy Policy explains how [Legal Entity Name](“we”, “us”, “our”), trading as Mogpharm, collects and processes personal data when you use the Mogpharm platform and website (the “Service”). We are committed to protecting your privacy and handling your data in line with the UK GDPR and the Data Protection Act 2018.
1. Who we are
The data controller for personal data processed through the website and for your account is [Legal Entity Name], [registered address]. For personal data your pharmacy uploads about its staff and operations, your pharmacy (or its parent organisation) is the controller and Mogpharm acts as a processor on its behalf — see our Data Processing Agreement. You can contact us about privacy at [privacy@mogpharm.com]. Our data protection contact is [DPO / contact name]. We are registered with the Information Commissioner’s Office (ICO) under reference [ICO number].
2. The data we collect
- Account & profile data: name, work email, role, and the pharmacy / organisation you belong to.
- Pharmacy operational data: inspections, SOPs and acknowledgements, incidents, controlled-drug records, compliance logs, training records and related evidence. This may include personal data about your staff and, where you choose to record it, limited information relating to patient-safety incidents.
- Usage & technical data: IP address, device and browser information, and audit logs of actions taken in the Service (for security and accountability).
- Communications:details you submit through our contact or “Book a demo” forms (name, email, pharmacy, message).
3. How we use your data and our lawful bases
- To provide, secure and support the Service — performance of a contract.
- To keep audit trails and prevent misuse — legitimate interests and, where applicable, legal obligation.
- To respond to enquiries and demo requests — legitimate interests / steps prior to a contract.
- To send service and, where you have opted in, marketing communications — legitimate interests or consent; you can opt out at any time.
4. Sub-processors and sharing
We do not sell your data. We share it only with service providers who help us run the Service, under contract and appropriate safeguards:
- Supabase — database, authentication and file storage.
- Vercel — application hosting and content delivery.
- Resend — transactional and notification email.
A current list of sub-processors is maintained in our Data Processing Agreement. We may also disclose data where required by law or to protect our rights.
5. Where your data is stored (international transfers)
Your database and files are hosted in the United Kingdom (London region). Some processing (for example, serving the application) may occur in other regions operated by our hosting provider; where personal data is transferred outside the UK, we rely on appropriate safeguards such as the UK International Data Transfer Agreement or Addendum. [Confirm the exact application/function region and update this section accordingly.]
6. How long we keep it
We keep personal data for as long as your account is active and as needed to provide the Service, then for the periods required to meet legal, regulatory and record-keeping obligations (for example, controlled-drug and governance records). When data is no longer needed it is deleted or anonymised. Specific retention periods are set out in the DPA.
7. How we protect your data
Access to tenant data is enforced at the database level by row-level security, so each pharmacy can only see its own records. Data is encrypted in transit (TLS) and at rest, access is role-based and least-privilege, and administrative actions are logged. We keep production, staging and demonstration environments separate.
8. Your rights
Subject to conditions in law, you have the right to access, rectify, erase, restrict, port and object to the processing of your personal data, and to withdraw consent. To exercise a right, contact [privacy@mogpharm.com]. If your data was uploaded by your pharmacy, we may direct your request to them as the controller. You can also complain to the ICO at ico.org.uk.
9. Cookies
We use strictly necessary cookies for authentication and security. We do not use advertising cookies. [A separate Cookie Policy will be published if we introduce analytics or non-essential cookies.]
10. Children
The Service is intended for pharmacy professionals and is not directed at children.
11. Changes to this policy
We may update this policy from time to time. Material changes will be notified through the Service or by email. The “last updated” date above shows the current version.
12. Contact
[Legal Entity Name], [registered address]. Email [privacy@mogpharm.com].