Privacy Policy

Solira is an online service of QuickCare Pharmacy, a pharmacy registered with the General Pharmaceutical Council (GPhC registration 9013213), owned by QCP1 Ltd (company number 15503390). Registered address: Office 115 & 116, 3 Humber Road, Millennium Business Centre, London, NW2 6DW. ICO registration: ZC052365.

QCP1 Ltd is the controller of your personal data. Our Superintendent Pharmacist, Jimah Alsaai MPharm (GPhC 2232652), is responsible for how we handle it.

Privacy queries: hello@withsolira.com

• Name, date of birth, address, email, phone number, NHS number (if provided)
• Health information from your consultation: medical history, current medications, allergies, BMI, weight, photographs you upload, and answers to clinical screening questions
• Identity verification: the pharmacist checks your photo ID, on your video call or from a photo you add. If you choose to add a photo of your ID, we keep it only until your pharmacist has decided on your order, then delete it. We keep the record that the check took place and its outcome
• Messages you send your pharmacist, and their replies
• Your answer when you tell us how your treatment is going, using the links in one of our reorder emails
• The answers to a consultation you start but do not finish, and the email address you give us to save your progress
• Orders from our supplement shop, including orders placed as a guest
• Payment data processed via Stripe. We do not store card details. If you choose to save a card when you pay, Stripe stores it, linked to your Solira account, and we never see the number
• Your contact choices: whether you ticked "Don't send me news or offers" (offered until 6 October 2026), and any emails you have unsubscribed from
• Technical data: IP address, browser type, anonymous counts of the pages and consultation steps visited, and, if you accept cookies, how you use our website (see section 5)
• Where you came from: the link that first brought you to our site, such as an email, a search result or an advert, recorded with your consultation or order

• To assess your consultation, supply and deliver your treatment, and check on you afterwards. Lawful basis: our contract with you, Article 6(1)(b) UK GDPR, and for health information, the provision of health care, Article 9(2)(h).
• To keep the records pharmacy law requires. Lawful basis: legal obligation, Article 6(1)(c), and Article 9(2)(h) for health information.
• To tell your GP about your treatment, with your consent.
• To send reorder reminders and check-ins during your treatment, and a reminder if you leave a consultation or checkout unfinished. Lawful basis: our legitimate interest in supporting your treatment, Article 6(1)(f), and Article 9(2)(h) for health information. You can say no when you give us your email address, and stop them at any time (see section 6).
• To send you occasional news about our products and services, such as our supplements, if you have ordered from us and have not said no. Lawful basis: our legitimate interest in telling our customers about our products, Article 6(1)(f). You can say no when you give us your email address, and at any time after (see section 6).
• To invite you to review our service. Lawful basis: our legitimate interest in obtaining feedback on the service we provided to you, Article 6(1)(f). Review invitations are sent at most once every three months, contain no information about your condition, treatment or medication, and are never sent in exchange for anything.
• To run our supplement shop. Lawful basis: our contract with you. If you are a current weight-management patient and signed in, the shop checks your treatment status to apply your patient price.
• To count visits to our pages and consultation steps anonymously, and to count paid orders, so we can improve the site. Lawful basis: our legitimate interest in improving our website, Article 6(1)(f). These counts are used only for statistics about the site, so they do not need your cookie consent, and you can switch the visit counts off at any time (see section 5).
• To see which of our emails, listings and adverts bring patients to us, from the link recorded with your consultation or order. Lawful basis: our legitimate interest in understanding what brings patients to us, Article 6(1)(f). It stays in our own records and is not shared with advertising companies. It is only saved on your device between visits if you accept cookies (see our Cookies Policy).
• To understand in more detail how our website is used. Lawful basis: consent, Article 6(1)(a), which you give or refuse on our cookie banner (see section 5).
• To keep our service secure and prevent fraud. Lawful basis: our legitimate interests, Article 6(1)(f).

People involved in your care

• Your GP, with your consent
• BeWell (our clinical services provider) for clinical purposes only

Services that run Solira for us

These companies provide the services Solira runs on:

• Supabase: stores your account, consultations and records, on servers in London
• Netlify: hosts our website
• Stripe: processes payments
• Resend: sends our emails
• Google Meet: hosts your video consultation
• Royal Mail: delivers your parcel, using your name, address, phone number and email address for delivery updates. Our Royal Mail order also lists what is in the parcel, including the name and strength of your medicine
• PostHog: website analytics, on servers in the EU (see section 5)
• Trustpilot: sends our review invitations, using your first name and email address. No health information, condition, treatment or medication detail is shared with Trustpilot at any point

Other organisations

• Trustpilot, if you choose to post a review: Trustpilot holds your review as an independent controller under its own privacy policy.
• Apple and Google, only if you choose Continue with Apple or Continue with Google: Apple or Google confirms your email address and name to Solira, its own privacy policy applies to that sign-in, and nothing is sent to either of them unless you tap that button.

We do not sell your data, and we do not share it with advertising companies. Our website has no advertising cookies or tags.

Anonymous visit counts. Unless you switch them off, we count visits to each page and, in a consultation, which service and which step it was, so we can see how the site is used and improve it. Each count carries a new random number used for that count only, and the hour rather than the exact time. Nothing is stored on your device, and no count can be linked to another count or to you. PostHog processes the counts for us on servers in the EU and does not keep your IP address. To switch them off, untick "Count my visits anonymously" on our cookie banner, which you can reopen with Cookie settings at the bottom of any page.

Paid orders. When a treatment order is paid, our server tells PostHog that one more order was paid. That count carries a random number, the time, and a one-way code made from the order so that the same payment is never counted twice. It carries no amount, no order reference, nothing about what was ordered and nothing that names you. It uses nothing on your device.

Only if you choose "Accept all". PostHog, on servers in the EU, sets analytics cookies that show us how our website is used: the kind of page you visit, such as a treatment page or a consultation page, but never which one or its title; the steps of a journey you complete, without your answers; your device and browser; the website and the campaign tags of a link that brought you; and the kind of page you first arrived on. Through these cookies, PostHog never receives a medicine, a dose, a condition, your answers, the reason a consultation was stopped, an account or order number, or anything you type. PostHog is not told who you are, it does not record your visit, and it does not keep your IP address. "Accept all" also keeps the note of the link that brought you on your device between visits (see section 3).

No advertising. We use no advertising cookies or tags. If the Meta or Google advertising cookies our site set before 5 October 2026 are still on your device, the site deletes them when you visit. Cookies those companies keep on their own websites can be cleared in your browser.

Our fonts are served from our own website. The Trustpilot review box loads from Trustpilot only on the pages that show reviews, when the box comes into view, so Trustpilot receives your IP address on those pages.

We always send the emails you need for your treatment: sign-in codes, order confirmations, approval, dispatch and tracking updates, and messages from your pharmacist.

We also send reorder reminders, check-ins during your treatment, reminders to finish an unfinished consultation or checkout, invitations to review us, and occasional news about products for our patients, such as our supplements.

You can say no to these when you give us your email address, using the unsubscribe link shown under the form when you create an account or order from our shop. You can also stop them at any time with the unsubscribe link in any of them, or at withsolira.com/email-preferences. Saying no stops all of the emails in this paragraph. The emails you need about your orders still come.

Our online consultation applies the eligibility criteria in the clinical protocols we work under. If your answers show that a treatment would not be safe or suitable for you, the form tells you straight away and that order cannot continue. No treatment is supplied without a pharmacist reviewing your consultation. If you think a check has stopped you wrongly, email hello@withsolira.com and a pharmacist will review it.

Our database is in London. Some of the services in section 4 process data in the European Economic Area or the United States. When your data leaves the UK, it is protected by UK adequacy regulations or by the safeguards the UK approves for international transfers, such as the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.

Clinical records: 10 years from the date of the last entry in your patient record. This includes consultation answers, prescriber decisions, clinical assessment notes, dispensing records, GP notification letters, identity verification outcomes, and any clinical correspondence. The law requires a pharmacy to keep records of prescription-only medicine supplies for at least 2 years, and NHS pharmacy guidance keeps adult patient records for 8 years. We keep ours for 10, so that we can answer any later question about your care.

For patients under 18 at the time of treatment, clinical records are retained until the patient's 25th birthday or 10 years after the last entry, whichever is longer.

Photographs you upload as part of safety verification are retained alongside the clinical record for the same 10-year period and are stored in a private, access-controlled bucket.

If you start a consultation but do not finish it, we keep your answers and the email address you gave us for 90 days, then delete them.

Non-clinical account data (login credentials, marketing preferences) is retained for 3 years after your last activity, then deleted. If you have told us not to send you marketing, we keep your email address on our do-not-email list for as long as we might otherwise email you, so that we keep to your choice. Payment records are retained for 7 years to meet HMRC requirements.

After the retention period expires, records are securely deleted or anonymised. You may request earlier deletion of non-clinical data at any time, but clinical records subject to the 10-year rule cannot be deleted on request, as we need them to keep a complete record of the care we have given you.

Under UK GDPR you have the right to: access, correct, delete (subject to clinical retention rules above), restrict, object to, or port your personal data, and to withdraw consent at any time. To change your cookie choice, or to switch off anonymous visit counts, use Cookie settings at the bottom of any page. To stop emails, see section 6.

Email hello@withsolira.com to exercise these rights.

If you are unhappy with how we have used your data, complain to us at hello@withsolira.com or by post. We acknowledge within 30 days and tell you the outcome. You can also complain to the Information Commission at ico.org.uk.

Our postal address is in section 1. The Information Commission took over from the Information Commissioner's Office on 30 September 2026 and is still known as the ICO.

We use essential cookies and similar storage to run the site. Analytics cookies are only used if you accept them, and we use no advertising cookies. Our anonymous visit counts use no cookies. Stripe's payment form loads on our payment step only, and there Stripe sets its own cookies, which it needs to keep your payment secure and to prevent fraud. See our Cookies Policy for full details.

Updates are published at withsolira.com/privacy.