Pharmacy2U under fire over data selling practices

The online pharmacy has been accused of selling patient information without consent, but has denied the allegations.

Pharmacy2U website

Pharmacy2U, an online pharmacy, has been accused of selling patient information to marketing firm Alchemy Direct Media. The company denies any wrongdoing.

As part of a wider investigation into data handling,
The Daily Mail
looked into data selling practices at Pharmacy2U and claims that the company has sold information about thousands of patients without proper consent being obtained. Data passed to Alchemy Direct Media, whose clients include Pfizer, reportedly include patients’ names, addresses, dates of birth and the dates of their last prescription.

Pharmacy2U, which dispenses NHS and private prescriptions and delivers them to patients’ homes, as well as providing an online doctor consultation service, says it has never sold information relating to patients’ medical conditions. Between November 2014 and December 2014, it trialled a “small-scale” project with Alchemy Direct Media, which it describes as a data handling company registered with the Information Commissioner’s Office (ICO).

“This project involved us selling limited information – some customers’ names and addresses only – for use in selected marketing activity. No medical information, emails or telephone numbers were sold,” says a spokesperson for Pharmacy2U. “In conducting this trial project, we acted in line with current data protection and ICO guidelines.”

According to the ICO, explicit consent must be given by customers for their data to be passed to a third party. “Opt-in boxes are the safest way for organisations to demonstrate consent and organisations should use clear and easy to understand language that is not hidden away in the small print,” explains an ICO spokesperson.

Pharmacy2U says: “We made it clear in our privacy policy that we may share data with selected third parties, and gave customers the option to easily opt out of this.”

The Daily Mail has passed the information from its investigations to the ICO, which is now looking into the matter.

Pharmacy2U is registered with the General Pharmaceutical Council (GPhC), the professional regulator for pharmacies and pharmacists, and the Care Quality Commission. The GPhC says it is aware of the concerns relating to Pharmacy2U and that it is investigating to find out if there has been a breach of any pharmacy or professional standards.

The Pharmaceutical Services Negotiating Committee (PSNC), which represents community pharmacy contractors to the NHS, was quick to point out that registered pharmacies are obliged to adhere to rules of patient confidentiality. “The allegations, if true, would represent an isolated case and they do not in any way reflect the practice of the vast majority of community pharmacies,” says PSNC chief executive Sue Sharpe.

Pharmacy2U says it has decided not to continue the trial with Alchemy Direct Media and that it will no longer share customer data for use in third party marketing. “All data that was held by Alchemy Direct Media (UK) Ltd has been destroyed by them and is no longer available for use,” it adds.

Last updated
The Pharmaceutical Journal, PJ, 18 April 2015, Vol 294, No 7858;294(7858):DOI:10.1211/PJ.2015.20068291

You may also be interested in