| Document Reference: | POL-003 |
| Version: | 2.0 |
| Pharmacy: | SynovaMed (trading name of Nihaal Limited) |
| Registered Address: | 11 Blaby Road, South Wigston, Wigston, LE18 4PA |
| GPhC Pharmacy Reg. | 9012552 |
| Superintendent Pharmacist | Chirag Desai (GPhC: 2079415) |
| Effective Date | 19 April 2026 |
| Next Review Date: | April 2028 |
| Approved By: | Chirag Desai, Superintendent Pharmacist & Director |
1.
Purpose
This policy sets out how long SynovaMed retains personal data and clinical records, and the process for secure deletion. It is aligned with UK GDPR, the Data Protection Act 2018, the NHS Records Management Code of Practice 2021, and GPhC Standards for Registered Pharmacies.
2.
Principles
We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by law. All retention periods are justified against clinical need, legal duty, or regulatory requirement.
3.
| Record Type | Retention Period | Basis |
| Adult patient clinical records (prescriptions, consultations, clinical correspondence) | 10 years after last contact | NHS Records Management Code 2021 |
| Paediatric patient records (not applicable service is 18+) | Until 26th birthday, or 10 years after last contact (whichever later) | NHS Records Management Code 2021 |
| Deceased patient records | 10 years after date of death | NHS Records Management Code 2021 |
| Private prescription records (Rx forms) | 2 years from date of supply | Human Medicines Regulations 2012 |
| Controlled drug registers (if applicable) | 7 years from date of last entry | Misuse of Drugs Regulations 2001 |
| Financial records (invoices, payment evidence) | 6 years + current year | HMRC/Companies Act 2006 |
| Marketing consent records | Until consent withdrawn + 1 year | UK GDPR Article 7 |
| Website analytics (cookies) | Up to 26 months | ICO guidance on PECR |
| Staff/contractor records | 6 years after end of engagement | Employment law / ACAS |
| Complaint records | 10 years after complaint closure | NHS Records Management Code 2021 |
| Adverse drug reaction reports | 10 years | MHRA guidance |
| Prescribing audit records | 7 years | GPhC clinical governance expectation |
| CCTV footage (pharmacy premises) | 30 days | ICO CCTV Code of Practice |
| Identity verification records (photo ID, liveness) | 7 years after last transaction | Anti-fraud/regulatory |
4.
Storage and Security
All retained data is held:
- In UK or EEA-based data centres
- Encrypted at rest (AES-256) and in transit (TLS 1.2+)
- Access controlled via role-based permissions and multi-factor authentication
- Backed up daily with geographically separated disaster recovery
- Auditable every access is logged
5.
Deletion Process
When a retention period expires, records are securely deleted or anonymised using industry-standard methods. Paper records are cross-shredded and disposed of via a registered confidential waste contractor. Digital records are deleted from active systems and backups in the next backup cycle.
6.
Patient Rights
You have rights under UK GDPR to:
- Access the personal data we hold about you (Subject Access Request)
- Request correction of inaccurate data
- Request erasure in some circumstances (note: clinical records have statutory retention requirements and cannot be deleted early)
- Restrict processing in specific circumstances
- Object to processing based on legitimate interests
- Data portability for information you have provided
Contact info@synovamed.co.uk to exercise any of these rights. We will respond within one calendar month.
7.
Breach Procedure
Suspected data breaches are reported to the Superintendent Pharmacist within 24 hours. Where a breach is likely to result in a risk to the rights and freedoms of individuals, we notify the ICO within 72 hours of becoming aware. Affected individuals are notified where the breach is likely to result in high risk.
8.
Policy Review
Reviewed every 2 years by the Superintendent Pharmacist. Next review: April 2028.
SynovaMed (trading name of Nihaal Limited) | 11 Blaby Road, South Wigston, Wigston, LE18 4PA | GPhC: 9012552 | 07822 002914 | info@synovamed.co.uk Document Ref: POL-003 | Version 2.0 Effective: 19 April 2026 | Next Review: April 2028 Superintendent Pharmacist: Chirag Desai (GPhC: 2079415)