Legal and privacy
Privacy Policy
Last updated: 4 October 2026
This policy explains how Karken Healthcare Ltd collects, uses and protects personal information in connection with Karken MyMeds, our prescription collection and delivery service, and the rights you have over your information.
1.Who we are
Karken MyMeds is a service of Karken Healthcare Ltd, a company registered in England and Wales (company number 17112427). Our registered office is Hardwick House, No. 2 Agricultural Hall Plain, Norwich, Norfolk, NR1 3FS, United Kingdom.
Karken Healthcare Ltd is registered with the Information Commissioner's Office (ICO) under registration number ZC113605.
In this policy, “Karken”, “we”, “us” and “our” mean Karken Healthcare Ltd.
For privacy questions, email help@karkenmymeds.co.uk or call 01603 515443.
2.Scope of this policy
This policy applies to personal information we handle through Karken MyMeds, including:
- our website, collection request form, instant quote and delivery tracking;
- pharmacy and patient accounts and portals;
- collections and deliveries we carry out, and optional non-clinical check-in services;
- enquiries, support requests and other communications with us.
It covers people who request collections, the people deliveries are for, contacts at pharmacies and other organisations, account users, and anyone who contacts us.
Karken MyMeds provides logistics and non-clinical services. We do not prescribe, dispense or administer medicines, provide clinical monitoring or give clinical advice.
Where we handle information on behalf of an organisation (see section 7), that organisation's own privacy information also applies. Other websites we link to, including those of our service providers, have their own privacy information.
3.Information we collect
Collection and delivery information
- the requester's name, email address and telephone number;
- collection point details, such as the pharmacy's name and address;
- the recipient's name, address, postcode and, where supplied, telephone number;
- delivery instructions;
- the delivery reference, delivery type and delivery status, with the times of status updates.
Account and organisation information
- names and contact details of account users and organisation contacts;
- business or organisation name and address;
- login email address and account identifiers (passwords are handled by our login provider and are not visible to our staff);
- organisation, site, membership and role information, and account status, such as whether an account is pending or approved.
Patient portal information
For people with a patient account, we may hold first name, surname and date of birth, together with order history, medication names, dosages, quantities and refill requests. This is health information (see section 6). Most collection and delivery requests do not require it.
Support and communications
Your name, contact details and the content of messages you send us, including support requests sent from the portal.
Invoices and payments
Invoice numbers, amounts, payment status and billing contact details. Where Stripe checkout is used, card details are entered with and processed by Stripe. We do not receive or store full card details.
Technical and security information
- login and session information;
- security and audit records of certain actions, such as changes to account or delivery status;
- IP addresses, used briefly to limit repeated form submissions and postcode checks, and to prevent misuse;
- technical request information, such as IP address, browser details and times, processed by our hosting and infrastructure providers.
4.Where we get information from
We may receive personal information:
- directly from you;
- from a pharmacy;
- from a care or support provider;
- from a housing organisation;
- from another organisation arranging our services;
- from an authorised representative, such as a family member or carer;
- through your account and support interactions with us;
- from the operation of the service, such as delivery status updates recorded by our drivers and staff.
If you give us information about someone else, such as the person a delivery is for, you must be entitled to share it and should make sure they know how it will be used, for example by pointing them to this policy. Our collection request form asks you to confirm that you are the recipient, or that you are authorised to arrange the delivery and to give us the recipient's details.
Where we act as controller and receive personal information about you from someone other than you, we will provide privacy information as required by applicable data-protection law.
5.How and why we use personal information
We use personal information only where UK data-protection law allows it. The table shows our main purposes and the lawful basis we typically rely on. The basis that applies can depend on the circumstances, including who arranged the service.
Arranging and carrying out prescription collections and deliveries
Information involved: Requester, collection point and recipient details, delivery instructions, delivery type, reference and status
Typical lawful basis: Contract, where you have asked us to provide the service. Legitimate interests, where an organisation or another person arranges the delivery: our interest, and theirs, in the requested delivery being completed.
Checking postcodes entered in our booking and registration forms
Information involved: The postcode typed into the form, such as a collection, delivery or pharmacy postcode
Typical lawful basis: Legitimate interests in accurate collections and deliveries, and in helping people enter addresses correctly. Where you are asking us to provide a service to you, it also helps us perform our contract with you.
Confirming requests, providing delivery references and recording delivery status
Information involved: Contact details, delivery reference, status updates and their times
Typical lawful basis: Contract, or legitimate interests in running an accountable delivery service and giving customers accurate status information.
Contacting you, or a recipient, about a collection or delivery when needed
Information involved: Names, telephone numbers, email addresses and relevant delivery details
Typical lawful basis: Contract, or legitimate interests in completing deliveries and resolving problems with them.
Registering, approving and managing pharmacy and other customer accounts
Information involved: Contact names, business details, login email, account status and role
Typical lawful basis: Contract with the customer. Legitimate interests in managing business relationships, for the individual contacts who act for an organisation.
Providing the patient portal, including order history and refill requests
Information involved: Name, date of birth, medication name, dosage, quantity and order history
Typical lawful basis: Contract, together with an applicable condition for health information (see section 6).
Arranging optional non-clinical check-in services
Information involved: Contact details and the arrangements agreed for the service
Typical lawful basis: Contract, or legitimate interests where the service is arranged by an organisation.
Answering enquiries and support requests
Information involved: Name, contact details and the content of your message
Typical lawful basis: Legitimate interests in responding to people who contact us, or contract where the enquiry relates to a service we provide to you.
Invoicing, taking payments and keeping accounts
Information involved: Invoice number, amounts, payment status and billing contact details
Typical lawful basis: Contract. Legal obligation, where the law requires us to keep accounting and tax records.
Keeping the service secure and preventing misuse
Information involved: Login and session information, security and audit records, IP address for rate limiting
Typical lawful basis: Legitimate interests in protecting our service, our customers and the people whose information we handle.
Handling complaints, and establishing, exercising or defending legal claims
Information involved: Information relevant to the complaint or claim
Typical lawful basis: Legitimate interests in resolving complaints and protecting our legal position.
Responding to lawful requests from regulators, courts or public authorities
Information involved: Only the information the request requires
Typical lawful basis: Legal obligation, where we are legally required to comply.
Where we rely on legitimate interests, we have considered whether our interests are outweighed by your interests, rights and freedoms. You have the right to object to this processing (see section 14).
We do not currently send marketing emails. If we do in future, we will only do so where the law allows, and you will be able to opt out at any time.
6.Health and other sensitive information
Some information held in connection with our existing patient and refill services, such as medication names and dosages, may constitute health information and therefore special-category personal data, which needs extra protection under UK data-protection law.
We only process this information where the processing is necessary for the relevant purpose and where the requirements of UK data-protection law for special-category information are met. This includes identifying an appropriate lawful basis under Article 6 of the UK GDPR and an applicable condition under Article 9 of the UK GDPR, together with any applicable requirements of the Data Protection Act 2018.
Where we process this information solely on the documented instructions of a business customer acting as controller, that customer is responsible for establishing the lawful basis and special-category condition for its processing. We process the information in accordance with our contractual and legal obligations as processor.
We seek to minimise the health information we process. Most deliveries only need a name, address and delivery details. Please do not include unnecessary medical or clinical information in general delivery instructions, support messages or public forms.
Access to health information is restricted. For example, our drivers see only the details they need to make a delivery, not medication or clinical information.
7.When we act as controller or processor
A controller decides how and why personal information is used. A processor handles personal information on a controller's documented instructions. Our position depends on the service arrangement and the purpose of the processing.
We are usually a controller for
- website enquiries, quotes and support;
- private individuals who arrange deliveries with us directly;
- our customer and account administration, including pharmacy accounts and organisation contacts;
- billing and accounting;
- security and misuse prevention;
- complaints, legal records and legal claims.
We may be a processor when
we collect and deliver prescriptions, or provide check-in services, for a pharmacy, care provider, housing organisation or other business customer, following their documented instructions about their patients, residents or clients.
Where we act as a processor, the organisation is the controller and is responsible for telling you how your information is used. You may wish to contact that organisation directly. If you contact us, we will help or pass your request on as appropriate.
8.Who we share information with
We use service providers to run Karken MyMeds. They may only use personal information to provide their services to us.
| Provider | What they do for us |
|---|---|
| Supabase | Database and account-login infrastructure. It stores account, order and delivery information for us. |
| Vercel | Hosting for our website and application. It processes the technical information involved in delivering web pages and requests. |
| Resend | Sending service emails, such as collection request confirmations and support messages to our team. |
| Stripe | Payment processing where Stripe checkout is used. Stripe receives the invoice number, amount and billing contact email, and handles card details directly. |
| Google Maps | When a driver chooses to navigate to a delivery, the delivery address and postcode are opened in Google Maps on the driver’s device. |
We also use email and IT service providers that support our business.
Postcode checks. When you type a full postcode into one of our booking or registration forms, our server checks it with Postcodes.io, a free public postcode service maintained by Ideal Postcodes. This happens when you leave the postcode box, select “Check postcode” or press Enter in the postcode box. We send the postcode only. We do not send your name, the rest of the address, your contact details, any health information or your IP address, because the check is made by our server, not by your device. Postcodes.io tells us whether the postcode exists, its standard format and the area it is in. It does not provide or check your full address, and we do not receive or store any map location. The check is optional: if it is unavailable, you can still continue. Postcodes.io runs its service under its own terms and privacy arrangements, which may include keeping technical records of the requests it receives.
Where necessary, we may also share information with:
- pharmacies, to arrange the collection of prescriptions;
- our delivery personnel, who receive only the details needed to make a delivery;
- the organisation that arranged a delivery, about that delivery's progress;
- authorised representatives, where appropriate;
- professional advisers, such as lawyers and accountants;
- insurers, where appropriate;
- regulators, public authorities or law enforcement, where the law requires it.
Delivery tracking. Anyone who has a delivery reference can see that delivery's status and status times on our tracking page. The tracking page does not show names, addresses or other personal details. Please share delivery references only with people who need them.
We do not sell personal information.
9.International transfers
Some of our service providers may process personal information outside the UK. Where a transfer of personal information is a restricted transfer under UK data-protection law, we will make sure the safeguards the law requires are in place.
You can contact us for more information about international transfers.
10.How long we keep information
We keep personal information only for as long as we need it for the purposes it was collected for. The periods below are maximum or normal periods. They are not a promise that every record is kept for the full period.
- We may delete or anonymise information earlier when it is no longer needed.
- We may keep specific records for longer where the law requires it, or where they are needed for an active complaint, dispute, investigation or legal claim.
- Sensitive health and medication information is not automatically kept for 6 years.
| Type of record | How long we keep it |
|---|---|
| Collection and delivery records | Up to 6 years after completion, where needed for contractual, accounting, dispute or legal-claims purposes. |
| Failed or cancelled requests | Up to 6 years where needed as part of the service record, with unnecessary personal information minimised sooner where practical. |
| Delivery status history | Up to 6 years where needed as evidence of the service provided; otherwise deleted or anonymised earlier. |
| Invoices and accounting records | 6 years, or longer where the law requires it. |
| Organisation and customer accounts | For the active relationship, and up to 6 years afterwards where needed for contractual, accounting or legal purposes. |
| Login sessions | Until you sign out, or until your sign-in session is no longer valid. The sign-in cookie that holds the session has a maximum lifetime of 400 days; this is a technical limit, not how long you stay signed in. See our Cookie Policy. |
| Postcode checks | We do not keep a record of the postcode checks you make. To keep the check fast, our server may reuse the answer for a postcode for up to 24 hours, with no link to you. A postcode you submit with a request or registration is kept as part of that record, as described above. |
| IP addresses used to limit repeated requests | Only for the short period needed for that security purpose: held temporarily in our server’s memory and used for at most 24 hours. They are not stored in our database. Our hosting provider’s technical logs are kept under its own retention periods. |
| Private-client and patient accounts | For as long as the account is active. Afterwards, only information we need for legal, accounting or service-record purposes is kept. |
| Health and medication information | Only for as long as necessary for the particular purpose and service arrangement, taking account of its sensitive nature and any legal or contractual requirements. We do not apply a fixed 6-year period to it. |
| Support and customer-service correspondence | Normally 3 years after the enquiry closes, unless linked to a transaction, complaint or legal matter that requires longer. |
| Complaint records | Up to 6 years after the complaint closes, where reasonably needed for record-keeping or legal claims. |
| Security and audit logs | Normally 12 months. Specific records may be kept longer to investigate or evidence a security incident. |
11.Cookies and similar technologies
When you sign in, our login system sets essential cookies to keep you signed in securely. We do not use analytics or advertising cookies, and we do not use tracking pixels on our website. Karken staff using the administration portal also have two menu preferences remembered in their browser's local storage; these only remember how the staff menu is arranged.
If you pay through Stripe checkout, you are taken to Stripe's own pages, which set their own cookies. For more detail, see our Cookie Policy.
12.Security
We use appropriate technical and organisational measures to protect personal information, including:
- sign-in authentication and role-based access controls;
- restricting operational information to the people who need it, for example limiting drivers to delivery details;
- collecting only the information we need;
- technical measures designed to protect information when it is transmitted;
- records of certain account and delivery actions.
No method of transmitting or storing information is completely secure, but we work to protect the information we hold and review our measures as the service develops.
13.Children
Karken MyMeds is intended for people aged 18 or over. It is not a service for children.
Where a delivery or service concerns someone under 18, the request must be made or managed by an appropriate parent, guardian, responsible person or responsible organisation.
14.Your data-protection rights
Under UK data-protection law you have rights over your personal information. Which rights apply depends on the circumstances and the lawful basis for the processing.
- Access: to ask for a copy of your personal information.
- Rectification: to ask us to correct inaccurate or incomplete information.
- Erasure: to ask us to delete your information in certain circumstances.
- Restriction: to ask us to limit how we use your information in certain circumstances.
- Portability: to receive information you gave us in a portable format, or have it sent to another organisation, where processing is based on contract or consent and carried out by automated means.
- Withdrawing consent: where we rely on your consent, to withdraw it at any time. This does not affect processing already carried out.
- Automated decisions: rights relating to decisions made solely by automated means that have legal or similarly significant effects (see section 15).
Your right to object
Where we use your information on the basis of legitimate interests, you can object to that use at any time on grounds relating to your particular situation. You can also object at any time to your information being used for direct marketing.
To make a request, email help@karkenmymeds.co.uk. We may need to confirm your identity first. There is normally no charge. We will respond within the time limits set by UK data-protection law: normally one month, which can be extended in some circumstances.
Where we act as a processor for an organisation, we will help that organisation respond to your request.
15.Automated decision-making
Karken MyMeds does not make decisions about you based solely on automated processing that have legal or similarly significant effects.
Some routine steps are automated, such as calculating a quote from a postcode or temporarily limiting repeated form submissions to protect the service, but these do not have such effects. Decisions such as whether to approve a pharmacy account are made by people. The postcode check in our forms is advisory only: it never stops you submitting a request.
16.Contacting us about privacy
You can also write to us at Karken Healthcare Ltd, Hardwick House, No. 2 Agricultural Hall Plain, Norwich, Norfolk, NR1 3FS, United Kingdom.
17.Complaints
If you have a concern about how we handle your personal information, please contact us first using the details above so that we can try to put things right.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK data-protection regulator, at any time: ico.org.uk/make-a-complaint (opens in a new tab) or by telephone on 0303 123 1113.
18.Changes to this policy
We may update this policy when our services, legal requirements or the way we handle personal information change. The date at the top shows when it was last updated. Where appropriate, we will bring significant changes to your attention.
Last updated: 4 October 2026