Privacy Policy

How Seona collects, uses, and protects your personal information, especially your health information, and the rights you have. Seona is operated by Icon Pharmacy Ltd, a pharmacy registered with the General Pharmaceutical Council.

Last updated: 18 September 2026

1. Who we are

Icon Pharmacy Ltd is the data controller for the information described in this policy.

Registered pharmacy: Icon Pharmacy, 155 Manford Way, Chigwell, Essex IG7 4DN
Company registration: 12087145 (England and Wales)
GPhC registration: 1031045
ICO registration: ZB562076
Data-protection contact: Vaibhav Shah, info@seona.health

2. The information we collect

Identity and contact details: your name, date of birth, address, email, and phone number.
Account information: your login details and the records of your interactions with the service.
Health information: your answers to our clinical questionnaire, your medical history, information obtained (with your consent) from your NHS record, and details of any treatment prescribed and supplied. This is special-category data and is given the highest level of protection.
Identity-verification information: the document and facial-image data used to confirm your identity, processed through our identity-verification provider. Facial-image data is biometric special-category data.
Payment information: processed securely through our payment provider; we do not store your full card details.
Communications: messages between you and our pharmacy team, and your contact preferences.
Technical and usage information: limited analytics about how you use our website, collected only with your consent (see our Cookie Policy).

Providing this information is necessary for us to provide treatment. If you choose not to give it, we may not be able to offer the service safely or lawfully.

3. Where we get your information

Most of it comes directly from you. With your explicit consent, we may also obtain relevant medical history from your NHS record to verify the information you give us, an essential safety step before any medicine is prescribed. Identity-verification data is generated when you complete that step.

4. How and why we use your information

Purpose	Lawful basis
Assessing your eligibility, prescribing, dispensing, and delivering treatment	Performance of our contract with you; and, for health data, the provision of health care (see section 5)
Verifying your identity and your medical history	Our legal and regulatory obligations as a pharmacy; explicit consent for biometric and NHS-record data
Keeping clinical and pharmacy records	Our legal obligations as a registered pharmacy
Taking payment	Performance of our contract with you
Patient safety, fraud prevention, and securing our service	Our legitimate interests, and our legal obligations
Improving our website and service (analytics)	Your consent
Sending you marketing, if you have opted in	Your consent

Where we rely on our legal obligations, these include our duties as a registered pharmacy under the Human Medicines Regulations 2012 and the standards and requirements of the General Pharmaceutical Council.

5. Your health and biometric information

Your health and biometric information is special-category data, which the law protects more strictly. We process it on the basis of:

The provision of health and social care: processing necessary for you to receive clinical assessment and treatment, carried out by or under the responsibility of a registered pharmacist; and
Your explicit consent, which you give before we begin, and which you can withdraw at any time (though we may need to keep certain clinical records to meet our legal obligations even after you withdraw).

Your biometric identity-verification data is processed only to confirm your identity, on the basis of your explicit consent.

6. Who we share your information with

We share your information only where necessary to provide the service, and only with providers and partners who handle it under appropriate data protection terms. We never sell your information. The providers we use are:

Supabase: our secure database, where your core records are held (UK region).
Titanverse: our clinical and prescribing records system (UK).
Stripe: payment processing and identity verification.
Amazon Web Services: sending our service and account emails, from a UK (London) region. It keeps no copy of the messages it sends.
Customer.io: sending our marketing emails, only where you have opted in to receive them, and holding the contact record that lets us manage those preferences.
AfterShip: tracking your delivery once it has been dispatched. It receives the tracking number, the courier, our order reference, the delivery postcode and, where we use it to send you delivery updates, your email address. It never receives your name or any health information.
Cloudflare: protecting our sign-in and forms from automated abuse. It processes the security check you complete and your device’s IP address, nothing else.
Google Analytics: understanding website use (only with your consent).
Vercel: hosting our website and service.
Our delivery courier (Royal Mail or DPD): to dispatch your treatment.

We may also share information with your GP (with your consent, as part of our GP-notification policy), and with regulators, law enforcement, or others where we are legally required to.

7. International transfers

Your core patient records are held in the UK: in our database (Supabase) and our clinical records system (Titanverse), both UK-resident. Some of the providers above process limited data outside the UK (Stripe, Google Analytics, Customer.io, Vercel, Cloudflare, and AfterShip) in the United States, the European Economic Area, or elsewhere. Where data is transferred outside the UK, it is protected by the safeguards that UK data protection law recognises: for the EEA, the UK’s adequacy regulations; for the United States, the UK Extension to the EU-US Data Privacy Framework (where the provider is certified) or, otherwise, the UK International Data Transfer Addendum to the standard contractual clauses. We only use providers that offer these safeguards. You can ask us at any time for more information about them, or for a copy of the relevant safeguard.

8. How long we keep your information

We keep different records for different periods, set by law and by healthcare record-keeping standards. When a retention period ends, we securely delete or anonymise the information.

Prescription records: the record that authorises the supply of your medicine must be kept for at least 2 years under the Human Medicines Regulations 2012. That is a minimum, not a deadline for deleting it, and we keep it for longer because it forms part of your clinical record. The clinical detail behind the decision is removed after 8 years and the medicine and delivery details after 11 years, as below. We keep a short permanent note that a named prescriber authorised a supply for you, on what date and at what dose, so that we can show years later that a prescription-only medicine was properly authorised.
Clinical records: your consultation, medical history, and treatment records are kept for 8 years after your last interaction with the service, in line with NHS healthcare record-keeping standards.
Records identifying the specific medicine supplied (including batch and dispatch details): kept for 11 years, to cover the product-liability period under the Consumer Protection Act 1987.
Payment and transaction records: kept for 6 years, to meet tax and accounting requirements.
Identity-verification outcome: kept with your clinical record; the underlying facial-image data is held by our verification provider only as long as needed to complete the check, then deleted.
Account information: for as long as you have an account, and a limited period after it closes.
Marketing preferences: until you withdraw consent or unsubscribe.
Sleep-tips mailing list: if you ask us for sleep tips, we keep your email address, the date you confirmed it, and a record of which tips we have sent you, for as long as you stay subscribed. If you unsubscribe we stop sending straight away and keep only enough to be sure we do not email you again by mistake. Any questionnaire answers you gave before you asked for tips are kept under the clinical period above, and unsubscribing does not change that.
Website analytics: up to 14 months.

9. Your rights

You have the right to: access the information we hold about you; have inaccurate information corrected; ask us to delete information (though we may need to keep clinical records to meet legal obligations); restrict or object to certain processing; receive your information in a portable format; and withdraw consent at any time. To exercise any of these, contact info@seona.health. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk.

10. Decisions about your care

No prescription is ever issued by an automated system. Every decision to prescribe, to decline, or to ask you for more information is made by a pharmacist independent prescriber registered with the General Pharmaceutical Council.

There is one decision we do make automatically. When you complete our questionnaire, an automated eligibility check reads your answers before a prescriber does. It can decide that we cannot safely offer you treatment, and where it does, the consultation ends there and no prescriber reviews it. We tell you on screen when that has happened and why.

We do this because some answers rule treatment out on safety grounds whatever else you have told us, and because it would be wrong to take payment for a consultation that cannot go ahead. We rely on your explicit consent, which you give before you begin, and on the check being necessary before we can enter into a contract with you.

You can ask a person to look again. If the automated check finds you are not eligible, you can ask a member of our clinical team to review it, tell us anything you think it has missed, and challenge the outcome. There is a link to do that on the screen that gives you the decision, and you can email us at info@seona.health at any time. A person reads every request.

The automated check never decides in your favour on its own. A result suggesting treatment may be suitable is always passed to a prescriber, who makes the actual decision.

11. Marketing and your choices

We will only send you marketing if you have opted in, and you can unsubscribe at any time using the link in any message or by contacting us. Your consent to marketing is separate from, and never a condition of, using the service. We do not share your health information with advertising platforms, and we do not use advertising or tracking cookies on our site (see our Cookie Policy).

12. Cookies

We use a small number of cookies, and ask for your consent before setting any that are not essential. Our banner groups them into four categories: strictly necessary (always on, for sign-in, security, payment and remembering your choice), functional, analytics (Google Analytics and Plausible), and marketing. You can accept all, reject everything except the strictly necessary cookies, or choose category by category, and change your mind at any time from the Cookie settings link in the footer. We remember your choice in a first-party cookie called seona_consent. We do not use advertising or tracking cookies. Full details are in our Cookie Policy.

13. How we protect your information

We use appropriate technical and organisational measures to keep your information secure, and we keep these under review.

14. Children

Our service is for adults aged 18 and over. We do not knowingly provide the service to, or collect information from, anyone under 18.

15. Changes to this policy

We may update this policy from time to time. The current version always appears here, with the date it was last updated.

16. How to contact us

For any privacy question, or to exercise your rights, contact info@seona.health. If you are unhappy with how we have handled your information, you can complain to us (see our Complaints and feedback page) or to the ICO at ico.org.uk.