RELEAF.CO.UK PRIVACY POLICY
Last updated 04/03/2026
Releaf Dispensary Ltd ("we" or "us") is committed to protecting and respecting your privacy.
This policy (together with our website terms of use and any other documents referred to on it) sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us, who we share your personal data with and what your rights are. Please read the following carefully to understand our practices regarding your personal data and how we will treat it. This privacy policy applies to prospective, existing and former customers and any individuals who visit our website.
Our website uses cookies. Please read our cookie policy carefully as it contains important information about how we use cookies on our website.
NHS Login
When accessing our service via NHS login, the identity verification process is managed by NHS England. NHS England acts as the data controller for this process, and Releaf serves as a data processor, following instructions from NHS England for verifying your identity. For more information about NHS login’s privacy practices, please refer to the NHS login Privacy Notice.
Who We Are
For the purpose of the Data Protection Act 2018, the UK General Data Protection Regulation or any other applicable legislation, the data controller is Releaf Dispensary Ltd, a company registered in England and Wales with company number 14097825 and our registered office is at 1 King's Avenue, London, N21 3NA. We are also registered with the ICO.
If you have any questions about this privacy policy, please contact dataprotection@releaf.co.uk .
Please note that links from our website may take you to external websites, such as LinkedIn, Facebook and Instagram which are not covered by this policy. We recommend that you check the privacy policies on those websites yourself to find out how they may use your personal data. External websites that our website links you to may also use cookies, over which we have no control. These websites should each have their own cookie policy in place which can provide you with further information that explains how they will use cookies.
We are responsible for the content, function or information collection policies of these external websites.
Information We Collect About You
Personal information or personal data means any information about or relating to an individual from which that person can be identified or is identifiable and is generally referred to throughout this Privacy Policy as “personal data”. It does not include data where you can no longer be identified (anonymised data).
We will collect and process the following data about you:
Information you give us when you fill in a form on our website (www.releaf.co.uk) or contact us via phone or email. We will collect, store and use your full name, postal address, email address and phone number, financial and credit card information, personal description and/or photograph.
Information you give us when you register to use our website or subscribe to our service. We will collect, store and use your full name, email address, account login credentials, and subscription preferences.
Information you give us when you sign up to receive news, offers and details of our new product launches from us. We will collect, store and use your full name and email address.
Information you give us when you purchase something from us. We will collect, store and use your full name, postal address (for billing and delivery), email address, phone number, financial and credit card information, and details of the products or services purchased.
Information you give us when you participate in discussion boards or other social media functions on our website. We will collect, store and use your chosen username or display name, and the content of your posts, comments, or messages.
Information you give us when you enter a competition, promotion or survey. The types of personal data we will collect, store and use in this case will vary depending on the specific competition, promotion or survey but may include your full name, postal address, email address, phone number and any other information about you that you provide in response to our competition, promotion or survey.
Information you give us when you contact us to report a problem with our website or with your order. We will collect, store and use your full name, email address, phone number, details of your order or issue, and any communication history relating to the reported problem.
Information we collect about you when you provide feedback to us. We will collect, store and use your age, location and demographic data.
Information we collect about you when you visit our website. With regard to each of your visits to our site, we will automatically collect, store and use the following personal data:
technical information, including the internet protocol (IP) address which is used to connect your computer to the internet, your log-in information, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform; and
information about your visit, including the full Uniform Resource Locators (URL), clickstream to, through and from our site (including date and time), products you viewed or searched for, page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), methods used to browse away from the page, and any phone number used to call our customer service number.
some of the personal data we collect is obtained through cookies. We use both essential and non-essential cookies on our website. Please see our cookie policy for more information.
Other personal data. We may collect, store and use your personal data for the purposes of bringing or defending any legal proceedings or meeting any legal or compliance obligations we have. This may include the collection and use of your signature to settle any delivery disputes.
Information we receive from other sources
Most of the information we collect, store and use about you comes directly from you. However, there may be times when we receive information about you from other sources.
We may receive information about you from other companies within our group, such as our pharmacy company, if you visit their websites or if they provide services to you. Any information about you that we receive from other companies within our group is limited and only for the specific purposes set out in their privacy notices.
We may receive information about you from selected third parties who we work with, such as credit reference agencies. We will use this information to verify your identity and check whether a payment plan for our services would be suitable for you.
We will submit a request to NHS England’s Personal Demographic Service (PDS) to receive your NHS number from them. The request will include your name, address and date of birth. We do this to ensure that the NHS number we hold for you is correct and to ensure consistent identification across all health and care services that you receive. By doing this, it should help improve the quality of care provided to you.
When you sign up for our services and provide the details of your GP surgery, we will confirm that you are registered with that GP surgery. We use a third party supplier to carry out this check on our behalf and will provide your name, date of birth, address, postcode and your GP surgery details. We only receive a yes/no confirmation of your registration with that GP surgery and will not receive any other information about you as part of the check. This helps us ensure that the correct GP surgery is associated with your medical care.
If you provide your consent to your GP surgery, we may receive copies of your GP records which will contain your medical information, as well as any other personal information held on them. We will use this to ensure that we are providing you with appropriate care.
Special Category Data you give to us
Where you fill in a form on our website, contact us by phone, email, video or otherwise, purchase something from us or complete our screening information as part of your consultation with us, we may collect, store and use your special category data. Special category data is more sensitive personal data.
When you do any of the things listed above, we will collect, store and use the following special category data: your genetic information, your ethnicity data, your health data, your biometric data and information about your sex life and/or sexual orientation.
Recording of Consultations
If you attend a consultation with us, we may record the session (audio or video) for training purposes. Any recording would include your personal data such as your name, your contact details, your date of birth, the image of you, your voice, medical history and discussions about your treatment.
We use recordings of consultations to:
Train our staff to ensure the quality of patient care and support across our services.
How we will use your personal data and what is our legal basis for using it
We have set out below how we use your personal data. In addition, we have set out our legal bases to use your personal data as we need to tell you these under data protection law.
We will use your personal data to enable us to provide the best possible products and services to you. We will also use your personal data:
to administer your order (including dealing with any queries, issues, returns or payment relating to it) and deliver your products or provide our services to you;
to set up and administer your account or subscription;
to keep details of your orders;
to provide and manage your access to our website;
to personalise and tailor your experience on our website;
to respond to communications from you;
to send you email newsletters and alerts that you have subscribed to (you may unsubscribe or opt-out at any time by clicking the ‘unsubscribe’ at the bottom of each email correspondence);
to analyse your use of our website and gather feedback to enable us to continually improve our website and your user experience;
to enter into a contract with you and administer that contract;
to carry out our obligations arising from any contracts entered into between you and us and to provide you with the information, products and services that you request from us;
to provide you with information about other goods and services that we offer that are similar to those that you have already purchased or enquired about;
to provide you, or permit selected third parties to provide you, with information about goods or services we feel may interest you;
to notify you about changes to our service;
to ensure, using internal data analytics and other related marketing methods, that content from our site is presented in the most effective manner for you and for your computer;
to administer our site and for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes;
to improve our site to ensure that content is presented in the most effective manner for you and for your computer;
to understand the behaviour of our community members e.g. why you have created an online account but not booked a service;
to adapt our platform and services to better meet user needs and improve overall experience;
to allow you to participate in interactive features of our service, when you choose to do so;
as part of our efforts to keep our site safe and secure;
to measure or understand the effectiveness of advertising we serve to you and others, and to deliver relevant advertising to you; and
to make suggestions and recommendations to you and other users of our site about goods or services that may interest you or them.
When we collect information about you from our website using essential cookies, we will use your personal data on the basis that it is in our legitimate interests to do so. We consider it is our legitimate interest for our website to be able to run properly.
When we collect information about you from our website using non-essential cookies, we will use your personal data on the legal basis that you have given us your consent. You can, of course, withdraw your consent at any time by deleting our cookies or by managing your browser’s cookie preferences. For further details on how to manage your preferences please see aboutcookies.org or www.allaboutcookies.org.
Where you fill in a form on our website or contact us via phone or email, we will use your personal data on the basis that it is necessary for the performance of our contract with you or for taking preliminary steps for that contract. If you fill in a form or contact us for any other reason, we will use your personal data on the basis that it is in our legitimate interests to be able to respond to enquiries and manage our relationship with users of our website.
Where you register to use our website or subscribe to our service, we will use your personal data on the basis that it is necessary for the performance of our contract with you or for taking preliminary steps prior to entering into that contract with you.
Where you sign up to receive news, offers and details of our new product launches from us, we will use your personal data on the legal basis that you have given us your consent. You can, of course, opt out of receiving these at any time and an option to unsubscribe will be provided in each email should you decide that you don’t want to receive these anymore.
Where you purchase something from us, we will use your personal data on the basis that it is necessary for the performance of our contract with you or for taking preliminary steps prior to entering that contract with you.
Where you participate in discussion boards or other social media functions on our website, we will use your personal data on the basis that it is in our legitimate interests to be able to enable user interaction and engagement on our platform where you choose to participate or engage with these features.
Where you enter a competition or promotion, we will use your personal data to administer the promotion or competition and contact you if you have won on the basis that it is necessary for the performance of our contract with you. Where you respond to a survey, we will use your personal data to improve our services on the basis that it is in our legitimate interests to do so.
Where you contact us to report a problem with our website or your order, we will use your personal data on the legal basis that it is necessary for the performance of our contract with you where your query relates to a product or service that you have bought from us. If you are contacting us in relation to something different, then our legal basis is that it is in our legitimate interests to be able to deal with customer or potential customer queries.
Where you provide feedback to us, we will use your personal data on the legal basis that it is in our legitimate interests to do so. We consider it to be in our legitimate interests as a business to be able to understand and address the needs of our community members who have not signed up as patients and to ensure our services align with user expectations and needs.
Where we collect, store and use your personal data for the purposes of meeting any legal or compliance obligations that we have, we will do this on the legal basis that it is necessary for compliance with a legal obligation.
Where we collect, store and use your personal data for the purpose of bringing or defending legal proceedings, our legal basis will be that it is necessary for the performance of our contract with you (where it relates to a contract we have in place) or our legitimate interests. Where our legal basis is legitimate interests, we consider it to be in our legitimate interests as a business to be able to bring or defend legal proceedings where necessary.
Where we use your personal data to confirm your GP surgery registration, we do so on the basis that it is in our legitimate interests to be able to check that the details you have provided to us about your GP surgery are accurate.
Where we submit a request for, and use your NHS number to communicate with other health and care professionals involved in your care, we do so on the basis that it is in our legitimate interests to ensure that the information we hold about you is accurate and to be able to speak with other professionals involved in your care to coordinate and provide the best possible services to you.
Where we record our consultations with you for training purposes, we do so on the basis that it we have your explicit consent to do so. You may, of course, withdraw your consent at any time. Please see below for more details on how to do this.
Where we collect and use your personal data that you have provided to us when you give us feedback, we do so on the basis that it is in our legitimate interests to be able to understand and address the needs of our community members (those who have created an online account with us).
Do we use anonymised data?
Anonymised data is data from which you cannot be identified. This means that once anonymised, this data is no longer your personal data.
Conducting research to evaluate and improve treatments: If you are a patient, we may collect data from you on a voluntary basis. We call this PROMs data and may use it for research outputs or publication. Whilst this data is not anonymised when we receive it from you, we will securely anonymise it ourselves before we use it for any research or publication purposes. To provide you with more details on how we use this anonymised data, we may use anonymised responses to analyse the outcomes of our treatments. This is part of our commitment to delivering excellent patient care and advancing medical knowledge through research. Anonymised results may also be shared in peer-reviewed medical journals or presented to regulators like the Care Quality Commission (CQC) to demonstrate the effectiveness of our treatments.
Whenever you have given us your consent to use your personal data, you have the right to change your mind at any time and withdraw that consent. If you wish to do so, please contact dataprotection@releaf.co.uk. However, please note that this will not affect the lawfulness of any processing carried out before you withdraw your consent.
How will we use your Special Category Data and what is our legal basis for using it?
We will collect, store and use your special category data to carry out our obligations arising from any contracts which are entered into between you and us and to provide you with the information, products and services that you request from us.
When we are using your special category data to carry out our core clinical processing (including consultations, diagnosis, treatment, prescribing and clinical records) we do so on the basis that [e.g. it is necessary for the performance of our contract with you and on the additional condition that the processing is necessary for preventative or occupational medicine, medical diagnosis and the provision of health care or treatment.
When we are using your special category data for other activities such as voluntary research questionnaires, we do so on the basis of consent and on the additional condition that you have given us your explicit consent.
Will we change the way we use your personal data?
We will only use your personal data for the purposes we have set out in this privacy policy. We can only change the purposes we use your personal data for, by telling you where we need to use it for another reason and that reason is compatible with those purposes set out in this notice. If we need to use your personal data for any other purpose, we will notify you and we will explain the legal basis which allows us to use your personal data for this other purpose in a similar way to how we have done it in this policy.
What happens if you don’t provide the personal data we have asked for?
If you don’t provide the personal data we need when we ask for it, we may not be able to respond to you or enter into a contract with you. For example, if you do not give us your contact details, we may not be able to answer any queries that you have raised. If you have any concerns about whether you need to provide your personal data, please contact [insert email address].
How will we keep your personal data up to date?
It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during our relationship with you.
Automated decision making
We do not currently use your personal data to make decisions that will have a significant impact on you based solely on automated decision making (i.e. one without human intervention).
However, this may be something that we look to do in the future. If this is the case, we will update this privacy notice accordingly and provide information about how we will use automated decision making as part of our services.
Who do we share your information with?
We will only ever share your personal information with trusted third parties. We do not sell any personal data to any third party so that they can send you their marketing material or share your personal data with a third party for their own marketing purposes unless we have your consent to do this.
We will only share the personal data you give us with the following third parties and for the following reasons:
with third parties who help us provide our products and services to you such as prescribing or dispensing doctors and pharmacies: We may share your personal data with these third parties to enable you to receive the products you order from us.
with delivery companies: We use reputable third parties to deliver your order to you or to a pharmacy for collection.
with companies who process our card payments: We may share your personal data with the companies who process our card payments to ensure your purchase is completed securely.
with companies who send out our email marketing: We may share your personal data with trusted companies where you have requested us to send you email marketing.
with third party companies and organisations to confirm the accuracy of the information you have provided to us, such as the GP surgery check: We will share limited personal data with these third parties on a need-to-know basis.
With NHS England PDS: We will share limited personal data with NHS England PDS to retrieve your NHS number to ensure that we can coordinate your care with other health professionals involved.
with companies who provide support for our internal IT systems: We use reputable third parties to provide us with our IT systems and support for them. They may access your personal data to the extent that they need to in order to provide their services.
with companies who provide us with advertising services, or optimisation services for our website: We use reputable third parties to provide us with advertising services or improvement and optimisation services for our website. They may access your personal data to the extent that they need to in order to provide their services.
with credit reference agencies: We may share your personal data with reputable credit reference agencies for the purpose of assessing your credit score where this is a condition of us entering into a contract with you. They may use your personal data to the extent that they need to in order to provide their services.
with medical evidence gathering agencies. We use reputable third party agencies to help us obtain copies of your summary care records from your GP when you have given us your consent to do so. They may use your personal data to the extent that they need to in order to provide their services.
With a company that we merge with or transfer our business assets to: In the event that we sell all or part of our business or merge with another company, we may transfer personal data that we have collected as described in this notice, along with our other business assets, to the company that we are selling to or merging with.
With entities, organisations or individuals outside our company for legal reasons: We will share your personal data with entities, companies or individuals outside our company where this is strictly necessary to comply with any law, rule, regulation, legal procedure or governmental request that is applicable to us.
With entities, companies or individuals outside our company to obtain advice: We may share your personal data with external professional advisors such as lawyers or accountants in order to take advice and for the purposes of legal and tribunal proceedings or to enforce the terms of our agreements.
We only provide third parties with the information they need to know to perform their specific services or to carry out the function or purpose that they require it for. Where personal data is shared with a managed service provider or other third-party supplier, we work closely with them to ensure that your personal data is secure and protected at all times.
We have contracts in place with third parties which include appropriate obligations to ensure that your personal data is protected and to ensure that we are meeting our obligations under UK data protection law.
If you would like further information on the third parties we may share your personal data with and our legal basis for doing so, please contact dataprotection@releaf.co.uk.
How long do we keep your personal information?
We will only store your personal information for as long as we need it for the purposes for which it was collected and which we have explained in this privacy notice. We have outlined our retention periods below.
Where we provide you with any service (e.g. subscription service), we will retain any information that you provide to us at least for as long as we continue to provide that service to you i.e. for the duration of our contract with you. We may retain some of your personal data for longer periods where this is necessary and proportionate. For example, we will need to keep your clinical and patient records after we have completed our services for clinical governance, safeguarding and regulatory compliance. These records will be retained in line with our retention policies.
We will retain recordings of any consultations for a period of 8 years.
Personal data collected through the feedback form will be retained only for as long as necessary to analyse and apply insights to our service improvements, after which it will be securely deleted within 12 months.
In some circumstances, we will anonymise your personal data (so that you can no longer be identified from it) for analytical or statistical purposes, in which case we may use this information indefinitely without further notice to you.
Responses to voluntary questionnaires will be retained only for as long as necessary to complete the research analysis and satisfy regulatory reporting requirements. Once this purpose has been fulfilled, all data will be anonymised or securely deleted, in line with our retention policies.
If a dispute arises between us, we will keep your personal data for the purposes of responding to and dealing with the dispute. This may mean that we keep your personal data for longer than as set out above. Please contact dataprotection@releaf.co.uk if you would like any further information about our retention periods.
We will ensure that your personal data is securely deleted after the retention periods stated above have expired.
Data storage and how we protect your personal data
We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Policy.
We work hard to keep your information and personal data safe. We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. We use a combination of technical, administrative, and physical controls to maintain the security of your personal information and protect it.
The data that we collect from you will be transferred to, and stored at, a destination within the UK. We limit access to your personal data to those employees, agents or contractors and other third parties who have a business need to know and who are subject to a duty of confidentiality. All of our employees, agents and contractors understand the content of this Privacy Policy and are appropriately trained in data protection legal requirements.
All information that you provide to us is stored on our secure servers. Any payment transactions will be encrypted using SSL technology. We have put in place procedures to deal with any suspected personal data breach and/or data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.
Will we transfer your personal data outside the UK?
At the present time we store your personal data in the UK and will not transfer it outside of the UK.
Your rights
You have the right to make a complaint
You have the right to make a complaint to the Information Commissioner’s Office (ICO) if you are unhappy about the way your personal data is being used – please refer to the ICO website for further information about this (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO and so, if you are happy to do so, please contact at dataprotection@releaf.co.uk.
You have the right to be informed
We have a legal obligation to provide you with concise, transparent, intelligible and easily accessible information about your personal information and our use of it. We have written this policy to do just that, but if you have any questions or require more specific information, please get in touch with us at dataprotection@releaf.co.uk.
You have the right to access your personal data
You have the right to ask us what personal data we have about you. If we do, you have the right to have a copy of your personal data from us and to be informed of the following:
Why we use your personal data
What personal data we use
Who we share your personal data with
How long we keep your personal data for; and
Whether it has been used for any automated decision making.
In order to maintain the security of your information, we may have to verify your identity before we provide you with a copy of the information we hold. The first copy of your information that you request from us will be provided free of charge. If you require further copies, we may charge an administrative fee to cover our costs.
You have the right to correct any inaccurate or incomplete personal data
You have the right to ask us to change or complete any inaccurate or incomplete personal data we hold about you. If we choose not to do so, we will provide you with a written statement explaining why the request could not be met.
You have the right to be forgotten
You can ask us to delete your personal data where it is no longer necessary for us to hold or use it, you have withdrawn your consent and we have no other legal basis to keep your personal data, you have asked us to review and explain our legitimate interests to you and we don’t actually have a valid legitimate interest for keeping it, our use of your personal data is illegal, or we have to delete your personal data to comply with our legal obligations. Please be aware that we may have legal obligations to retain records for a certain period after our relationship with you ends. Where we are required by law to keep certain information, or if one of the reasons set out above does not apply, we will be unable to delete your personal data.
You have the right to have a copy of your data transferred to you or a third party in a compatible format
Also known as data portability, you have the right to ask us to provide you or a third party with a copy of the personal data you have provided to us in a structured, commonly used, machine-readable format, so it can be easily transferred. This right only applies if we are using your personal data on the basis of your consent or on the basis that it is necessary to perform a contract with you and the use of your personal data is carried out by automated means.
You have the right to object to direct marketing communications
You can tell us at any time that you would prefer that we do not use your information for direct marketing purposes. If you would not like to receive any direct marketing from us, please contact us at support@releaf.co.uk or use the stop or unsubscribe links provided in any of our marketing communications, and we will stop sending direct marketing to you as soon as possible, and in any event within at least 7 days.
You have the right to object to our legitimate interests
Sometimes, we use your personal information to achieve goals that will help us as well as you. This includes:
when we tell you about products or services that are similar to ones that you have already bought;
when we use your information to help us make our business better; or
when we contact you to interact, communicate or let you know about changes we are making
We aim to always ensure that your rights and information are properly protected. If you believe that the way we are using your data is not justified due to its impact on you or your rights, you have the right to object. Unless we have a compelling reason to continue, we must stop using your personal data for these purposes. In order to exercise your right to object to our use of your data for the purposes above, please contact us at dataprotection@releaf.co.uk.
You have the right to restrict how we use your personal data
You have the right to ask us to stop using your personal data where:
you have informed us that the information we hold about you is inaccurate, and we need to check if it is accurate or not;
you have asked us to review and explain our legitimate interests and we are in the process of checking whether we actually have a valid legitimate interest to do what we’re doing;
we are using your personal data in an unlawful way, but you would rather we stop using your personal data rather than delete; or
we no longer need to use your personal data, but you need us to keep it so that you can exercise any legal rights.
If you believe any of these situations apply, please contact us at dataprotection@releaf.co.uk.
Right to withdraw from research:
If you choose to participate in our voluntary questionnaires, you can withdraw your responses at any time by contacting dataprotection@releaf.co.uk. This will not affect your ongoing care or treatment.
Right to withdraw your consent
Where our use of your personal data is based on your consent, you have the right to withdraw your consent at any time by contacting dataprotection@releaf.co.uk.
If you want to access or correct your personal data, request your personal data to be deleted, object to, or restrict the processing of your personal data or request that we transfer a copy of your personal data to another party, please contact dataprotection@releaf.co.uk.
If you wish to opt-out of the use of your NHS number in the coordination of your care, you can contact us at support@releaf.co.uk. This will not prevent you from receiving care, but may limit some of the benefits of coordinated care across health and social services.
Changes to our privacy policy
We keep our privacy notice under regular review. Any changes that we make to our privacy policy in the future will be posted on this page on our website and, if the changes will have an effect on you or the way we use your personal data, we will bring them to your attention by email where appropriate, and where we have your contact details. Please check frequently to see any updates or changes to our privacy policy. This privacy policy was last updated in February 2026.
How can we help more.
If you have any questions that haven’t been covered within this Privacy Policy, or would like us to address any complaints, questions, comments or requests regarding this Privacy Policy, please contact us in the first instance using:
FAO Data Protection Officer
Releaf Dispensary Limited
136 Dukes Avenue, Muswell Hill, London, N10 2QB