Preliminary Information 

At the PMCPA we take your data privacy seriously and are committed to protecting the privacy and security of your personal data.

This privacy notice describes how we process your personal data during and after a complaint has been submitted in accordance with the Data Protection Act 2018 and any other applicable law and regulation (hereinafter collectively referred to as “Data Protection Laws”).

This privacy notice covers all PMCPA employees plus interns, secondees, contractors, consultants, casual and agency workers, subcontractors that need to have access to any personal data following a complaint submitted via the form on our website, by email to complaints@pmcpa.org.uk or sent to the Director of the Prescription Medicines Code of Practice Authority, 2nd Floor Goldings House, Hay’s Galleria, 2 Hay’s Lane, London, SE1 2HB.

It is important that you read and retain this policy, together with any other privacy notice that we may provide on specific occasions when we are processing personal data, so that you are aware of how and why we are using such information and what your rights are.

Please note that data protection refers to the protection of personal data only. This Policy does not apply to protection of confidential business related information and is in addition to the main PMCPA Privacy Policy available here.

‘Personal Data’ means any information identifying an individual or information relating to an individual that can identify (directly or indirectly) from that data alone or in combination with other identifiers we possess or can reasonably access.

What personal data do we collect about you?

When you first contact us, we will record the information submitted to use as part of your complaint and any subsequent correspondence. This could include your name, address, location in which any shared folder link was accessed, telephone number, email address and other personal details in a file that we hold:

• on paper
• on our IT systems & applications
• all of the above

Why we collect this information

We will only process your personal information when we have a lawful reason or a legitimate interest for doing so. We are allowed to use your information for the purpose of handling your complaint according to the ABPI Code of Practice. The ABPI Code also protects information obtained for the purposes of processing your complaint. We will treat your data considerately and confidentially. We might need to share some data about your complaint with approved subcontractors in order to handle your complaint according to the ABPI Code in particular in connection with participation on the Code of Practice Panel. Please note our approved subcontractors have executed a confidentiality agreement containing terms that are at least as protective as the terms of this Policy. By making your complaint, you agree we can share information about you and your complaint with our subcontractors.

The PMCPA does not share your personal data to other parties including the respondent company unless it is considered necessary to enable the company to respond to the complaint and then it will only be shared with your prior permission.

If a case reaches the Appeal stage, parties can attend the appeal and present their case. All attending parties are in the same room with the Appeal Board. If you choose to attend an appeal your name or an agreed pseudonym will be disclosed to the company and the Appeal Board. Your name would then also be disclosed to the building security/software for attendance at the PMCPA Offices for an appeal for the purposes of in case of emergency such as fire. The Appeal Board hearing will be recorded and kept for up to 90 days. After this period, the record will be destroyed. 

How long will we keep your information

We will keep all information about you and your complaint. This data includes:

• Correspondence, Panel minutes and submissions in relation to complaints
• Where applicable PMCPA Audit Reports
• Due to the complexity of review, categorisation, and deletion of the PMCPA historical archive of electronic records (as the filing structure does not permit different document types to be separated from within a single electronic file), the PMCPA retains an archive of content created before November 2018. No new content (created after November 2018) is to be retained within the historical archive.

All documents created during day-to-day working are permanently deleted after nine (9) calendar years of being saved electronically within our document management system. For complaints submitted prior to March 2020 personal data may also be stored in a secure off-site hard copy archive for the same duration as our retention period (9 years).

Emails have a 2 year retention or if in hard copy (see above) or within our information management system are retained for 9 years.

Details of your complaint, your name and contact details will be retained in our Case management system indefinitely.

Your rights under Data Protection laws 

• Access to Personal Information – You have the right to obtain access to your personal information.
• Change Inaccurate Information – You have the right to ask us to correct inaccurate personal information and to update incomplete personal information.
• Request to Delete Your Information – You have a right to request that we delete your personal information. Please note that if you request us to delete your information insofar as our retention policy allows, this will affect our ability to engage with you.
• Request to Restrict the Processing of Your Information – You have a right to request that we restrict the processing of your personal information. Please note that if you request this it will affect our ability to engage with you.
• Request Your Personal Data in a Portable Format – You may have the right to ask us to provide your personal information in a portable format.
• Object to the Processing of your Personal Information – You have a right to object to the processing of your personal information, in which case we would need to demonstrate compelling and legitimate grounds for the processing. Please note that if you request us to delete your information insofar as our retention policy allows, this will affect our ability to engage with you.
• Withdraw Consent – Where we rely on your permission to process your personal information, you have a right to withdraw your consent at any Please note that if you request us to delete data to investigate and resolve your complaint, we may not be obliged to erase this information. This is because the right to erasure does not apply to data which we hold to fulfil the investigation.
• To Complain - You have the right to make a complaint at any time to the Information Commissioner’s Office, the UK regulatory authority responsible for data protection issues
• We will not sell your information or use it for commercial purposes.

If you wish to exercise any of the rights set out above or have any questions in relation to this Privacy policy, please contact via email: dpo@pmcpa.org.uk

Please note that we may need specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). We may also need to contact you to ask for further information in relation to your request.

We will aim to respond to your request within one (1) month.

Changes to our privacy policy

• We keep our privacy notice under regular review. This notice was last updated in July 2024

Complaints, comments and compliments

• If you wish to make a compliment, comment or complaint about how the PMCPA processes your data, then please contact the Data Protection Officer at dpo@pmcpa.org.uk
• If you are still unhappy with how we have handled your complaint, you may contact the Information Commissioner's Office. The Information Commissioner Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF Phone: 08456 30 60 60

Website: www.ico.org.uk

• If this privacy policy changes in any way, we will place an updated version on this page.

How to contact us

Please get in touch if you have any questions about our privacy policy or information we hold about you. Please email: dpo@pmcpa.org.uk