Privacy Policy

1. Who We Are

Solira is a trading name of QCP1 Ltd, a GPhC-registered distance selling pharmacy (GPhC No. 9013213). Registered address: Office 115 & 116, 3 Humber Road, Millennium Business Centre, London, NW2 6DW. Company No. 15503390. ICO registration: ZC052365.

Privacy queries: hello@withsolira.com

2. What Data We Collect

• Name, date of birth, address, email, phone number, NHS number (if provided)
• Health information from your consultation: medical history, current medications, allergies, BMI, weight, photographs you upload, and answers to clinical screening questions
• Identity verification data processed via Stripe Identity (we receive a pass/fail result; we do not store your ID document images)
• Payment data processed via Stripe. We do not store card details
• Technical data: IP address, browser type, usage data

3. Why We Collect It

We process your data to:

• Provide a clinical consultation and, where appropriate, dispense medication
• Communicate about your order and treatment, including follow-up safety check-ins
• Notify your GP with your consent
• Comply with GPhC, MHRA, CQC and other legal obligations
• Improve our website and services

Lawful basis for clinical care: Article 9(2)(h) UK GDPR, provision of healthcare and treatment.

Lawful basis for review invitations: Article 6(1)(f) UK GDPR, our legitimate interest in obtaining feedback on the service we provided to you. Review invitations are sent once only, contain no information about your condition, treatment or medication, and are never sent in exchange for anything.

4. Who We Share It With

• Your GP, with your consent
• BeWell (PGD provider) for clinical purposes only
• Stripe (payment processing & identity verification)
• Resend (transactional email)
• Trustpilot (review invitations only). We share your first name and email address so that Trustpilot can invite you to review our service. No health information, condition, treatment or medication detail is shared with Trustpilot at any point. Trustpilot processes this data as an independent controller under its own privacy policy.
• Supabase (secure data storage, EU region)
• Royal Mail or other licensed couriers (delivery only)

We do not sell your data or share it with advertisers.

5. How Long We Keep It

Clinical records: 10 years from the date of the last entry in your patient record. This includes consultation answers, prescriber decisions, PGD assessment notes, dispensing records, GP notification letters, identity verification outcomes, and any clinical correspondence. This retention period reflects GPhC professional standards and Records Management Code of Practice for the NHS.

For patients under 18 at the time of treatment, clinical records are retained until the patient's 25th birthday or 10 years after the last entry, whichever is longer.

Photographs you upload as part of safety verification are retained alongside the clinical record for the same 10-year period and are stored in a private, access-controlled bucket.

Non-clinical account data (login credentials, marketing preferences) is retained for 3 years after your last activity, then deleted. Payment records are retained for 7 years to meet HMRC requirements.

After the retention period expires, records are securely deleted or anonymised. You may request earlier deletion of non-clinical data at any time, but clinical records subject to the 10-year rule cannot be deleted on request as we are legally required to retain them.

6. Your Rights

Under UK GDPR you have the right to: access, correct, delete (subject to clinical retention rules above), restrict, object to, or port your personal data, and to withdraw consent at any time.

Email hello@withsolira.com to exercise these rights. You may also complain to the ICO at ico.org.uk.

7. Cookies

We use essential cookies to operate the site and optional analytics cookies. See our Cookies Policy for full details.

8. Changes

Updates are published at withsolira.com/privacy.