Privacy

What we hold, and what we do not

A medication search says something private about your health, so the safest design is to collect as little as possible. This notice describes exactly what the service does today.

What we store

  • Your account: name, email address, and a password kept only as a scrypt hash.
  • Your search area, if you save one: a coarse point rounded to about a kilometre, plus a place label. We never ask for a full home address.
  • Saved searches: only the ones you explicitly save, visible only to you.
  • Requests you send: the pharmacy, item, quantity and status, so you can track them.
  • Membership: Stripe customer and subscription identifiers, subscription status, and billing period dates. Stripe holds the payment details; this service does not.

What we do not store

  • A history of searches you did not save. Searching is not logged against your account.
  • Precise device coordinates. A shared location is rounded before it is saved, and only if you save it.
  • Prescriptions, conditions, NHS or insurance numbers, or any other clinical record.
  • Card or bank details. Stripe collects and stores them on its secure checkout pages.

What a pharmacy sees

When you send a request, the pharmacy sees a short reference code, the medication, the quantity and any note you chose to add. They do not see your name, email address, location, or your other requests. Your address is never shared with a pharmacy or with another user.

Where sensitive values never appear

  • URLs: searches, place lookups and medication suggestions are sent as POST requests, so nothing you type appears in the address bar, browser history or a server access log.
  • Page titles and metadata: titles are generic, so a shared screen or a screenshot does not reveal what you looked for.
  • Analytics: there is no analytics, advertising or tracking in this build, and no third-party script loads in your browser.
  • Logs: application error logs record the type of failure only, never the values submitted.

The outside services we use

These outside services are involved:

  • Photon turns a place name into coordinates. The place text you type is sent to it; your medication is not, and your account is not identified. Results are cached locally so the same lookup is not repeated.
  • Overpass, from OpenStreetMap supplies the pharmacy listings for an area. It receives a coarse area, never a medication and never an account.
  • Stripe processes membership payments and manages billing. It receives your account email, name and the billing information you enter on Stripe's hosted pages, but never your medication searches or pharmacy requests.

Map tiles are the one exception: when you switch to the map view, your browser loads image tiles directly from OpenStreetMap, which means it sees your IP address and the area you are looking at. The list view does not load them.

Deleting everything

You can delete your account at any time from account settings. That removes your account, saved searches, saved area and every request you have sent, including any a pharmacy has not answered yet.

Before a public launch

This is a working build, not a launched service. A public launch would additionally need a data protection impact assessment, defined retention periods, an audit trail for pharmacy access, a named data controller and a breach procedure. These are listed in the project's production checklist.