Privacy Policy

Last updated: 8 October 2026

This notice explains what we do with your personal information when you use this website, book an appointment with us, or use one of our pharmacy or clinic services.

Who we are

Broom Pharmacy is a trading name of Brogan BP Ltd. We are the “data controller” for the information described in this notice, which means we decide why and how your information is used and we are responsible for looking after it.

Pharmacy: Broom Pharmacy, 271 Mearns Road, Newton Mearns, Glasgow, G77 5LU
Registered company: Brogan BP Ltd, company number SC732655, registered office C/O Robb Ferguson, Regent Court, 70 West Regent Street, Glasgow, G2 2QZ
Email: info@broompharmacy.co.uk
Telephone: 0141 639 8269
ICO registration number: ZB373109
GPhC pharmacy registration number: 1042425

If you have a question about your information, or want to exercise any of the rights set out below, please contact us at info@broompharmacy.co.uk and mark it for the attention of our data protection contact.

We are registered with the General Pharmaceutical Council and are bound by its standards, including the duty of confidentiality owed to patients.

The information we collect

When you book an appointment

Our online booking system asks you for:

Your name
Your email address
Your mobile telephone number
Your date of birth
The service you are booking and your chosen date and time
How long you have had your symptoms
Any other information you choose to tell us in the free-text box

Some of this is information about your health. Under data protection law this is “special category data” and is given extra protection. We explain below how we are allowed to use it.

When you contact us

If you email us, call us, or fill in a form on this site, we keep a record of that contact and whatever you tell us in it.

When you use this website

Our website and the services embedded in it may collect your IP address, device and browser type, the pages you visit and how you arrived at the site. Most of this comes from cookies and similar technologies. We only use non-essential cookies if you agree to them. See our Cookie Policy for the detail.

Why we use your information, and our legal basis for it

Data protection law requires us to have a lawful basis for everything we do with your information. Where health information is involved, we also need a second, stricter condition. This table sets out both.

What we do	Information used	Our lawful basis (UK GDPR Article 6)	Health data condition (Article 9)
Take and manage your appointment booking, and send you confirmation, reminder and cancellation emails	Name, email, phone, date of birth, appointment details	Article 6(1)(b) — necessary to perform our agreement with you	Not applicable unless the service itself reveals health information, in which case Article 9(2)(h) applies
Provide pharmacy, prescribing and clinic services to you, including assessing your symptoms and making a clinical decision	All of the above, plus your symptoms, their duration and anything else you tell us	Article 6(1)(b) — necessary to perform our agreement with you	Article 9(2)(h) — provision of health care and treatment, and the management of health care services, by or under the responsibility of a health professional bound by a duty of confidentiality. In UK law this is supported by Schedule 1, Part 1, paragraph 2 of the Data Protection Act 2018
Keep clinical and pharmacy records, including records of medicines supplied	Your clinical record	Article 6(1)(c) — necessary to comply with our legal obligations	Article 9(2)(h), as above
Answer your enquiries and handle complaints	Your contact details and whatever your enquiry concerns	Article 6(1)(f) — our legitimate interest in running the pharmacy and responding to the people who contact us	Article 9(2)(h) where health information is involved, or Article 9(2)(f) where it relates to a legal claim
Run, secure and maintain this website	Technical data such as your IP address	Article 6(1)(f) — our legitimate interest in keeping the site working and protecting it from misuse	Not applicable
Measure how the website is used so we can improve it	Analytics data (see our Cookie Policy)	Article 6(1)(a) — your consent, given through our cookie banner	Not applicable

Where we rely on your consent, you can withdraw it at any time. Withdrawing consent does not affect anything we did with your information before you withdrew it.

Where we rely on legitimate interests, we have considered whether our interest is outweighed by the effect on you. You can object to this — see “Your rights” below.

Who we share your information with

We do not sell your information, and we never share it for anyone else’s marketing.

We use the following organisations to help us run the pharmacy and this website. Each of them only acts on our instructions:

Who	What they do for us	Where they process data
Hostinger International Ltd	Hosts this website and the database holding your booking	United Kingdom
Google Ireland Ltd and Google LLC	Google Calendar, which holds your appointment details so our team can see the day’s diary: the time and service booked, your name and contact details, date of birth, address, GP surgery and the answers you give in the booking form. Also Google Analytics, Google Tag Manager and Google Search Console for website measurement, Google reCAPTCHA to protect our contact form from spam, and Google Maps to show where we are	Ireland and the United States
SMTP2GO Ltd	Delivers the emails we send you, such as booking confirmations	European Union
NHS Greater Glasgow and Clyde	NHS services, where the service you use is an NHS one	United Kingdom

The booking system itself runs on our own website and stores your booking in our own database. It does not send your booking to a third party.

We will also share information where we have to, for example:

With your GP or another healthcare professional, where this is necessary for your care and you would expect it
With NHS bodies, where you are using an NHS service
With regulators such as the General Pharmaceutical Council, or with the police or a court, where the law requires it
Where there is a serious risk of harm to you or to someone else

Sending information outside the UK

Our website, its database and our NHS records are held in the United Kingdom.

Google processes some data in the United States. Where that happens, the transfer is protected by the UK International Data Transfer Addendum to the European Commission’s standard contractual clauses, which is a safeguard approved under UK data protection law. You can ask us for a copy of the safeguards we rely on.

How long we keep your information

Record	How long we keep it
Clinical and consultation records for adults	8 years after your last contact with us
Clinical records for children and young people	Until their 25th birthday, or 8 years after their last contact with us if that is later
Private prescription and medicines supply records	Two years, as required by the Human Medicines Regulations 2012
Controlled drugs register	Two years from the date of the last entry
Appointment booking records where you did not attend, or where the service was not clinical	12 months
General enquiries and correspondence	2 years
Website analytics	14 months

When a retention period ends we securely delete or destroy the record.

How we keep your information safe

Our website uses an encrypted connection (HTTPS). Access to the booking system and to clinical records is restricted to members of our team who need it, and is protected by individual accounts and passwords. Our staff are trained on confidentiality and are bound by professional standards. We review these measures regularly.

Your rights

You have the right to:

Ask for a copy of the information we hold about you
Ask us to correct anything that is wrong or incomplete
Ask us to delete information, though we cannot delete clinical records we are required to keep
Ask us to restrict what we do with your information while a concern is resolved
Object to us using your information where we rely on legitimate interests
Ask us to transfer information you gave us to another organisation, where this applies
Withdraw your consent at any time, where we rely on consent

To exercise any of these, contact us using the details at the top of this notice. We will respond within one month. There is normally no charge.

Automated decision-making

We do not make any decision about you using automated processing alone, and we do not carry out profiling.

Children

Our online booking system is intended for people aged 16 and over. If you are under 16, please book by telephone or come into the pharmacy, so we can make sure the service is right for you and involve a parent or carer where that is appropriate.

If you are unhappy

Please tell us first, using the contact details above, and we will try to put it right.

You also have the right to complain to the Information Commissioner’s Office:

Website: ico.org.uk/make-a-complaint
Helpline: 0303 123 1113
Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Changes to this notice

If we change how we use your information we will update this page and change the date at the top. Where the change is significant we will tell you directly.