Pharmacy Privacy Notice
COOP Pharmacy
Privacy Notice
Last updated: April 2026
Version 1.0
Contents
1 Important information about this privacy notice.
2 The sorts of personal information we hold about you.
3 How we collect your personal information.
4 How we use your personal information.
5 Sharing your personal information.
7 For how long we keep your personal information.
8 Keeping you informed about our products and services.
1 Important information about this privacy notice
Welcome to the COOP Pharmacy privacy notice ("Notice").
The Channel Islands Co-operative Society Limited and its subsidiaries make up the CI Coop group. These include The Channel Islands Co-operative Society Limited ("Society") and Edgar Holdings Limited (“EHL”), Jersey Pharmacy Services Limited (“JPSL”) and Lloyds (Chemists) Limited (“LCL”).
The Society is registered under the Co-operative and Community Benefit Societies Act 2014 with the Mutuals Public Register of the FCA and is governed by the Industrial and Provident Societies Act 1965 -1978 (Industrial and Provident Societies (Channel Islands) Order 1965-1978). CI Coop’s registered office is at Co-operative House, 57 Don Street, St Helier, Jersey, JE2 4TR.
Controller
For the purposes of the pharmacy services referred to in this Notice, the data controller is EHL, JPSL and LCL. The Society is the data controller in respect of membership and non-pharmacy services as set out in the group Privacy Notice.
EHL (registered number 48212) and JPSL (registered number 89296), have their registered offices at Co-operative House, 57 Don Street, St Helier, Jersey, JE2 4TR. EHL is registered with number 17596 and JPSL with number 58834 as data controllers with the Jersey Office of the Information Commissioner.
LCL (registered number CMP1125) has its registered office at Co-op Pharmacy Market, The Market Buildings, Market Square, Market Street, St Peter Port, GY1 1HE, Guernsey.
EHL, JPSL and LCL operate and trade in the Channel Islands under the business name 'COOP Pharmacy. References in this Notice to "we", "us", "our" and the "Company" are to EHL, JPSL and LCL as the respective data controller.
DPO
To assist us in managing our data protection obligations and ensuring our compliance with this Notice we have appointed a Data Protection Officer (“DPO”). If you have any questions in respect of this Notice and how we manage or process your personal information please contact the Data Protection Officer at Co-operative House, 57 Don Street, St Helier, Jersey, JE2 4TR or on 01534 879822 or by email to: dpo@channelislands.coop.
About this Notice
We understand that your privacy and the security of your personal information is extremely important. This Notice sets out why we collect your personal information, what we do with your personal information, how we keep it secure, how and where we collect it from, how long we keep it for, as well as what your rights are in relation to the personal information we hold about you.
References in this Notice to "you" or "your personal data" include personal data relating to individuals who interact with us directly, indirectly and may also include personal data relating to dependants, children, vulnerable persons, or other individuals whose information is provided to us by a parent, guardian, carer or authorised representative of that individual.
This Notice applies no matter how you interact with us as a Coop Pharmacy customer, either in person in one of our pharmacies, over the phone, by email, in writing, on-line, through our website, social media channels, taking part in our pharmacy programmes or entering any pharmacy competitions.
References to personal information also means personal data and vice versa.
Changes to this Notice and your duty to inform us of changes
From time to time we may change this Notice. You should check this Notice occasionally to make sure you understand how we handle your personal information. Substantive changes to the Notice will be published on our website.
It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.
Other privacy notices
Where we are required to do so, we will issue separate privacy notices covering your personal information, how we collect and use it, the basis for doing so, how we keep it secure, where we collect it from, how long we keep it and your rights. We have separate privacy notices for other aspects of the Society's activities and operations, including our general retail offering, Coop Mobile and pharmaceutical and funeral services.
2 The sorts of personal information we hold about you
Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).
We collect, store, transfer, and otherwise use personal information about you when you contact us, become a COOP Pharmacy customer (including instances where your personal data is on the EMIS system) or provide us with your information for another specific purpose. ('EMIS' refers to the Medical Information System, an electronic patient record and clinical appointments system, maintained by the Health departments in the Government of Jersey and Guernsey.)
We may collect, use, store and transfer different kinds of personal information about you which we have grouped together as follows:
- Identity Data includes first name, last name, former names or aliases, username or similar identifier, marital status, title, date of birth, place and country of birth, identification number (passport or national identity card), gender, share number, nationality, signature, URN, driving licence, TIN, and JY / SSN.
- Contact Data includes postal address(es) (eg billing and deliveries), email address and telephone number(s), including mobile.
- Financial Data includes bank account and payment card details, related to your transaction data.
- Transaction Data includes details about your purchases and payments to and from you relating to goods or services purchased from our businesses (including prior to becoming a member, where identifiable) and/or the administration of your membership account. Where we have your permission, details of your categories of website and apps that you have visited so that you can be served advertising (see our cookie policy for further details).
- Medical Data includes information about your medical circumstances that allows us to provide you with the medication or service you require. Some of this information will be special category data and only processed and / or utilised to protect your vital interests. Further it includes details of general practitioner, social security number, and those who may have authority to act on your behalf.
- Sensitive Data includes information about adoption and safeguarding records including investigations.
- Marketing and Communications Data includes your preferences in receiving marketing from us and our third parties and your communication preferences, , where marketing is related only to Pharmacy retail products not prescribed services.
- Images includes CCTV when visiting our stores or if you provide an image upon joining or updating your membership information at one of our member counters.
Aggregated data
We also collect, use and share Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data may be derived from your personal data but is not considered personal data in law as this data does not directly or indirectly reveal your identity.
For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this Notice.
Special category data
Special Category data is any information relating to your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, genetic and biometric data, and criminal record or alleged criminal activity.
On occasions when we collect what is called Special Category data, we will always have either a clear legal basis to process this or your explicit consent.
If we rely on your explicit consent, you can withdraw this at any time by contacting our DPO on the details set out below.
If you fail to provide personal information
Where we need to collect personal data by law, or under the terms of a contract we have with you and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you. We will notify you if this is the case at the time.
3 How we collect your personal information
We use different methods to collect personal information about you, including through:
Direct interactions. You may give us your Identity, Contact, Transaction and Financial Data by buying our goods and services, filling in forms or by corresponding with us by post, phone, email or otherwise. This includes personal data you provide when you:
· purchase COOP Pharmacy services;
· ;
- request marketing to be sent to you;
- enter a competition, promotion or survey; or
- give us some feedback.
Automated technologies or interactions. As you interact with our website, we may automatically collect Technical Data about your equipment, browsing actions and patterns. We collect this personal data by using cookies, server logs and other similar technologies. Please see our cookie policy for further details.
Third parties or publicly available sources. We may receive personal data about you from various third parties and public sources as set out below:
· Medical and / or General Practitioners
· States of Jersey and States of Guernsey health providers (including all your personal data on the Jersey EMIS healthcare platform or other similar systems that are used and operated with the Jersey and or Guernsey healthcare systems)
· Care Home providers or similar where you may be under their care
· Other Health service providers and institutions that services may be provided to including primary care and secondary care organisations, clinics, the prison services, charities, non-profit organisations etc., within the health care system.
Withdrawing your consent
In the limited circumstances where you may have provided your consent to the collection, processing and transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time.
To withdraw your consent, unless another option is made available by us please contact our DPO at DPO@channelislands.coop.
Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.
4 How we use your personal information
We will only use your personal information when the law allows us to, this is called a legal basis (highlighted in bold) for processing your information (data).
Most commonly, we will use your personal information in the following circumstances:
- Where we need to comply with a legal obligation.
- Where you have entered into a contract with us to provide you with a service (eg your contract with us for COOP Pharmacy services).
- Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests. An example of this is the assistance we may provide to the emergency services, debt collection, credit referencing or the prevention of fraud.
We may also use your personal information in the following situations, which are likely to be rare:
Where you have given, you consent to contact you for a specific purpose.
- In an emergency (eg in dealing with the emergency services) and it is in your vital interest that we share your information, when we have it recorded.
Generally we do not rely on consent as a legal basis for processing your personal information other than in relation to sending third party direct marketing communications to you via email or text message.
Opting out
You have the right to withdraw consent to marketing at any time by contacting us either using the details in section 10 below or by emailing hello@channelislands.coop, or updating your preferences through your Member Portal or by choosing to opt-out via the links on any of our communications with you.
Purposes for which we use your personal information
We have set out below, in a table format, a description of all the ways we plan to use your personal data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate. Note that we may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data.
|
Purpose/Activity |
Type of data |
Lawful basis for processing including basis of legitimate interest |
|
When you receive COOP Pharmacy services as a customer |
(a) Identity (b) Contact |
Performance of our contract |
|
To obtain prescriptions (including repeat), vaccinations, immunisations, medications and de-prescribe in certain circumstances |
(a) Identity (b) Contact (c) Financial (d) Transaction |
(a) Performance of our contract (b) Our legitimate interests (eg recovery of debts due)
|
|
Other administrative matters relating to your COOP Pharmacy account |
(a) Identity (b) Contact (c) Financial (d) Transaction |
(a) Performance of our contract (b) Legal obligation (c) Legitimate interests
|
|
To manage our relationship with you which will include: (a) Notifying you about changes to our terms or privacy policy (b) Asking you to leave a review or take a survey |
(a) Identity (b) Contact (c) Profile (d) Marketing and Communications |
(a) Performance of our contract (b) Legal obligation (c) Our legitimate interests (to keep our records updated and to study how customers use our products/services) |
|
To participate in corporate transactions, such as restructuring, mergers or acquisitions of the CI Coop Group that relate to COOP Pharmacy |
(a) Identity (b) Contact (c) Transaction (d) Usage |
Our legitimate interests (to engage with potential transacting parties from time to time. This might include passing personal data to a potential buyer after completion of a legitimate interests impact assessment). |
|
To support with an emergency response, to include engaging with non-statutory emergency services where necessary to protect your vital interests. |
(a) Identity (b) Contact (c) Usage |
The protection of vital interests, which is used in rare and urgent circumstances where there is a risk to life. |
|
To share limited and relevant personal data to the Jersey Cyber Security Centre (JCSC). |
(a) Identity (b) Contact (c) Usage |
Our legitimate interest in maintaining secure and resilient systems and protecting customers from cyber threats. |
|
To support or otherwise cooperate with Government of Jersey departments and regulators during a major incident |
(a) Contact
|
The protection of vital interests, which is used in rare and urgent circumstances where there is a risk to life. |
|
To enable you to partake in a prize draw, competition or complete a survey |
(a) Identity (b) Contact (c) Profile (d) Usage (e) Marketing and Communications |
(a) Performance of our contract (b) Our legitimate interests (to study how members/customers use our products/services, to develop them and grow our business) |
|
To provide you with information relating to our community activities and opportunities for participation |
(a) Identity (b) Contact (c) Profile (d) Usage (e) Marketing and Communications |
Our legitimate interests (to encourage customers to participate in our local communities to develop and grow our business) |
|
To administer and protect our business (including monitoring and recording communications, troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data) |
(a) Identity (b) Contact (c) Technical |
(a) Our legitimate interests (for running our business, quality assurance, training, provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganisation or group restructuring exercise) (b) Legal obligation |
|
To deliver relevant website content and advertisements to you and measure or understand the effectiveness of the advertising we serve to you, where marketing is related only to Pharmacy retail products not prescribed services |
(a) Identity (b) Contact (c) Profile (d) Usage (e) Marketing and Communications (f) Technical |
Our legitimate interests (to study how customers use our products/services, to develop them, to grow our business and to inform our marketing strategy) |
|
To use data analytics to improve our website, products/services, marketing, member/customer relationships and experiences |
(a) Technical (b) Usage (c) Financial (d) Transaction |
Our legitimate interests (to define types of customers for our products and services, to keep our website updated and relevant, to develop our business and to inform our marketing strategy) |
|
To make suggestions and recommendations to you about goods or services that may be of interest to you |
(a) Identity (b) Contact (c) Technical (d) Usage (e) Profile (f) Marketing and Communications |
Our legitimate interests (to develop our products/services and grow our business) |
|
To use CCTV across our stores, fuel courts, public areas, and car parks, where applicable for the protection and security of our colleagues, customers, suppliers and the business |
(a) Identity (b) Profile |
(a) Legitimate Interest and (b) Legal Obligation
|
Third-party marketing
We may share your personal data with other legal entities within the CI Coop group for the purpose of marketing goods, services and products available to you as a member.
You have the right to withdraw consent to marketing at any time by contacting us either using the details in section 10 below or by emailing hello@channelislands.coop, or updating your preferences through your Member Portal or by choosing to opt-out via the links on any of our communications with you.
We will get your express opt-in consent before we share your personal data with any company outside CI Coop group for marketing purposes.
Cookies
Please see our cookie policy.
Change of purposes
We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.
If we need to use your personal information for an unrelated purpose, we will notify you directly or through update to this Notice, and we will explain the legal basis for using your personal data in this manner.
5 Sharing your personal information
We will only transfer your information to third parties when it is safe to do so, when it is necessary to do so, and your information is protected in the same way that we protect it.
Where the third party is our processor, we require them to agree to process the shared information based on our instructions and requirements consistent with this Notice. We do not allow them to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions. If they are a controller of that information alongside us they will be required to comply with all of their obligations to you as a data controller under applicable data protection laws.
We require all third parties to respect the security of your personal data and to treat it in accordance with the law.
We do not pass on information gained from your engagement with us without a clear legal basis for doing so.
We may share your personal information for the purposes set out in section 4 above with Internal Third Parties and External Third Parties.
Internal Third Parties
Internal Third Parties include other legal entities or persons in CI Coop group.
External Third Parties
We may share your personal information to organisations outside of the CI Coop group pursuant to processing bases such as the performance of our contract, in order to comply with legal obligations, your vital interests, and your consent.
- External Third Parties including the following:
- The emergency services in Jersey and Guernsey (eg Police, Ambulance Service, Fire and Rescue Service, Coastguard)
- Members of the non-statutory emergency services (eg the RNLI Coastguard charity, St John's Ambulance)
- The Chief Pharmacist in Jersey or Guernsey
- Regulators (eg Guernsey Financial Services Commission, Jersey Financial Services Commission, JCRA, GC&RA, Financial Intelligence Unit, JCSC)
- Professional service providers:
- Onboarding to become a member of CI Coop (Vaiie)
- Retail vouchering (VME Coop) in relation to retail pharmacy products and services only
- Third parties to whom we may choose to sell, transfer, or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this Notice. In these circumstance, your personal data available will be limited to what is necessary for the purpose.
International transfers
The personal data that we collect from you may be transferred to, and stored at, a destination outside Jersey, Guernsey, the UK and the European Economic Area ("EEA"). The EEA consists of countries in the European Union, Switzerland, Iceland, Liechtenstein and Norway. They are considered to have equivalent laws when it comes to data protection and privacy. The laws of the Bailiwicks of Jersey and Guernsey and the UK have been deemed “adequate” for the purposes of EU data protection standards.
Your personal data may also be processed by External Third Parties operating outside the UK or EEA.
If we do this, we ensure that your privacy rights are respected in line with this Notice and the same protection is given to your personal information as is required by applicable data protection laws, including that we will only transfer personal data where we can rely on an approved data transfer mechanism, such as an adequacy decision or by including the appropriate Standard Contractual Clauses in our contracts with these companies. OLL and its group typically rely on the Standard Contractual Clauses via the Jersey Office of the Information Commissioner's Office data transfer addendum. For further information in connection with your personal data please contact us using the details at section 10 below.
6 CCTV
We use CCTV across our stores, fuel courts, public areas, and car parks, where applicable for the protection and security of our colleagues, customers, suppliers and the business. This includes for the investigating of accidents, incidents, prevention and detection of crime and for internal investigations, including breaches of our internal policies and fulfilling any requirement of the Health and Safety at Work (Jersey) Law, 1989.
The legal basis for us to use the CCTV recordings is Legitimate Interest and Legal Obligation.
Cameras are positioned to cover, where possible, our property only, although in some circumstances the camera may record a public footpath or a public road and capture members of the public and vehicles who are not our customers.
We reserve the right to use the images, including by way of Police disclosure for evidence in the prosecution of offenders) and in any disciplinary proceedings brought against CI Coop Group personnel. Occasionally we may share CCTV with public or regulatory authorities or in response to requests from individuals seeking to protect their rights, the rights of others or helping to prevent crime and nuisance. We will only share CCTV if we consider a request to be appropriate.
7 For how long we keep your personal information
We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.
To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
Details of retention periods for different aspects of your personal data are available in our retention policy which you can request from us by contacting us at the details set out in section 10.
In some circumstances you can ask us to delete your data. See section 9 Your rights to understand how you can do this.
8 Keeping you informed about our products and services
We would like to tell you about the great offers, ideas, products and services of COOP Pharmacy from time to time that we think you might be interested in. Where we have consent or it is in our legitimate interests to do so, we may do this through the post, by email, text message, phone, through online advertising or by any other electronic means.
We won't send you marketing messages if you tell us not to or if we do not have your consent to do so, but if you receive a service from us we will still need to send you occasional service-related messages and may still send you surveys (you can always opt out of these via the survey email itself). If you wish to amend your marketing preferences, you can do so at any time.
Please note that it can take a little while for all marketing to stop once you either withdraw your consent or tell us you’d like to opt out of marketing. This is because some marketing may have been identified as relevant to your interests and may already be in transit, it cannot therefore be immediately stopped.
9 Your rights
Under certain circumstances, by law you have the right to:
- Request access to your personal information (commonly known as a "data subject access request"). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
- Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
- Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
- Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes.
- Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
- Request the transfer of your personal information to another party.
If you want to review, verify, correct or request erasure of your personal information, object to the processing or request that we transfer a copy of your personal information to another party, please contact our DPO at DPO@channelislands.coop or on the details at section 10 of this Notice.
No fee is usually required
You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.
Requesting your personal information
You may request your personal information at any time. For Data Subject Access Requests (“DSARs”), please contact our DPO at DPO@channelislands.coop or on the details set out in section 10 below.
What we may need from you
We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights).
This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.
How long do we have to respond to your request?
We will respond to your request within 4 weeks of satisfactory verification of your identity.
Right to make a complaint
We would like the chance to resolve any complaints you have about the way we process your information; however, you do have the right to complain to the Jersey Office of the Information Commissioner or the Office of the Data Protection Authority in Guernsey about how we have used your personal information at any time.
They can be contacted at:
Office of the Information Commissioner – Jersey
2nd Floor, 5 Castle St, St Helier, Jersey JE2 3BT
Telephone +44 (0) 1534 716530 or Email: enquiries@jerseyoic.org
Office of the Data Protection Authority – Guernsey
Block A, Lefebvre Court, Lefebvre Street, St. Peter Port, Guernsey, GY1 2JP.
Telephone +44 (0) 1481 742074 or Email: info@odpa.gg
Upon receipt of a Complaint about one of the products or services we offer it may be required that we share your data and the subject of the complaint with a supplier or producer of the product or service you have complained about. This is part of the investigation into your complaint, and we will aim that your data will be protected in accordance with this Notice.
If you do not want your data shared with a supplier or producer of the product or service you want to complain about, please inform the member of staff taking your Complaint, or contact our DPO by email at DPO@channelislands.coop or on the details set out in section 10 below, at the time of your complaint/access request.
10 Contact us
We can be contacted at:
The Data Protection Officer
In writing to - Co-operative House, 57 Don Street, St Helier, Jersey, JE2 4TR
By Telephone - 01534 879822
By email to - dpo@channelislands.coop.
