Data processing
This page describes how MyStockWatch processes personal data when a pharmacy customer uses the Goods-In Scanner and the brand-manager platform. It is intended to set out the terms required by Article 28 of the UK GDPR for that processing.
1. Roles
MyStockWatch is a trading name of CPA Healthcare Training Ltd, registered in England and Wales, company number 13810197, registered office Fergusson House, 124 City Road, London EC1V 2NX.
- You (the customer) are the controller of your pharmacy data.
- MyStockWatch is the processor of that pharmacy data.
- MyStockWatch is the controller of account and billing data. That data is described in our Privacy Policy and is not processed under this page.
In this page, “pharmacy data” means the personal data you upload to, or generate in, the service in the course of checking deliveries, orders and invoices, and managing the people who use the service at your branches.
2. Pharmacy data we process
| Item | Detail |
|---|---|
| Subject matter | Providing the Goods-In Scanner and the brand-manager platform. |
| Nature and purpose | Reading pack scans, matching them to orders and invoices, flagging price and quantity discrepancies, tracking claims and credit notes, and administering branch user accounts, only as needed to provide the service you have asked for. |
| Types of personal data | Pack scans (barcodes, product names, batch, expiry, serial, and pack photographs if staff take them); orders and invoices; price discrepancies; delivery note or invoice numbers; staff names or initials; branch identifiers; and login details for the people you authorise. We do not intend to process patient information. |
| Categories of data subjects | Your staff, and, if such details are entered, people named on orders or invoices (for example a supplier contact). |
| Duration | For the life of your account, and then for the time needed to return or delete the data afterwards. |
3. Instructions
We will process pharmacy data only on your documented instructions, unless the law requires otherwise. Your instructions include this page, our Terms, and your use of the service itself. If the law requires other processing, we will tell you first unless the law prevents us. We will tell you promptly if we believe an instruction breaks UK data protection law.
You confirm that you have a lawful basis for the processing you ask us to carry out, and that you have given any notices required to the people concerned.
4. Confidentiality of personnel
We will make sure that everyone we authorise to process pharmacy data is bound by an appropriate duty of confidentiality.
5. Security
We will take the appropriate technical and organisational measures required by Article 32 of the UK GDPR to protect pharmacy data.
6. Sub-processors
You give general authorisation for us to use sub-processors who help us host and operate the service. We will engage them only under a written contract with data protection obligations equivalent to those on this page, and we remain responsible to you for their performance.
7. International transfers
We will not transfer pharmacy data outside the UK, or allow a sub-processor to do so, unless the transfer complies with UK data protection law. Examples are UK adequacy regulations or an International Data Transfer Agreement.
8. Assistance
Taking account of the nature of the processing and the information available to us, we will help you to:
- respond to requests from individuals exercising their data protection rights, and pass any request we receive to you promptly; and
- meet your obligations on security, personal data breach notification, data protection impact assessments and prior consultation with the ICO.
9. Personal data breaches
We will notify you without undue delay of becoming aware of a personal data breach affecting your pharmacy data, and we will give you the information you reasonably need to meet your obligations.
10. Return and deletion
At the end of the service, we will delete or return pharmacy data as you choose, and delete any existing copies, unless the law requires us to keep them.
11. Audit and information
We will make available to you the information reasonably needed to show we comply with this page.
12. Special category and patient data
The service is not designed to process patient information or other special category data. You must not enter that data into the service. If that ever needed to change, it would only be by written agreement and with additional safeguards.