Privacy Notice

Last updated: July 2026

1. Who we are

TheraTrack ("we", "us", "our") is a digital workflow product for NHS and private aseptic pharmacy services, based in Plymouth, United Kingdom. For any question about this notice or how we handle personal data, contact us at info@theratrack.co.uk.

2. Scope of this notice

This notice covers two distinct things, which we treat separately:

• This website (enquiries, contact forms, and general browsing).
• The TheraTrack desktop application, used by pharmacy aseptic services to manage prescription intake, batch workflow, stock, scheduling, and quality records.

3. Who uses TheraTrack

TheraTrack is used by authorised staff at NHS trusts and other healthcare organisations delivering aseptic preparation services — for example operators, isolator operators, supervisors, release officers, trainers, and administrators ("Superusers"). Users sign in with an organisation, email, and password.

4. What personal data we process

Depending on how an organisation deploys and configures TheraTrack, the application may process:

Staff / user data

• Name, email, organisation, and role/permissions.
• Login and account status, and password hashes (passwords are salted and hashed — never stored in plain text).
• Electronic signatures, SOP acknowledgements, and training/competency records.
• Rota assignments and shift comments.
• Incident statements, CAPA actions and progress notes.
• Audit trail events, and evidence file upload/view/download timestamps.

Patient data

• Patient name, patient identifier / NHS number or local ID, and date of birth.
• Ward and appointment details.
• Prescription details: product/drug, dose, route, diluent, and final volume.
• Batch and preparation records, including the worksheet barcode tied to a batch.
• Release, quarantine, and incident/deviation status linked to a preparation.

Pharmacy / GMP / operational data

Batch and ingredient records, stock and barcode data, manufacturer and strength, expiry dates, storage conditions and temperature logs, environmental/cleanroom checks, release checklists, SOP files and versions, and audit exports.

Files

SOP PDFs, training evidence (PDF, image, or document files), and CAPA evidence files. Evidence files are generally not deleted once uploaded — they may be superseded, but are retained for audit integrity.

5. NHS API and PDS integration

TheraTrack has a configuration path for checking patient demographic data against the NHS Personal Demographics Service (PDS) where a deploying organisation has enabled and authorised this integration. TheraTrack does not itself grant access to NHS systems — access depends on NHS API onboarding, environment, credentials, an approved use case, and authorisation by the deploying organisation.

6. Why we use personal data

Patient and staff data within the application is processed to deliver safe, traceable aseptic preparation workflows: prescription triage, batch preparation, stock control, release governance, staff scheduling, and quality management (SOPs, training, incidents, and CAPA). Special category data (health information) is processed on the basis of healthcare provision and NHS legal obligations relevant to the deploying organisation — the precise lawful basis and Article 9 condition are determined by that organisation as controller.

Website enquiry data is processed on the basis of legitimate interests (responding to your enquiry) and, where applicable, consent (for example, marketing communications).

7. Who we share data with

Data entered into TheraTrack may be shared with, or accessible to:

• The healthcare organisation using TheraTrack, and its authorised staff based on role permissions.
• NHS APIs/services, where enabled and authorised by the deploying organisation.
• Hosting, database, and infrastructure providers that support the service, under appropriate data protection terms.
• TheraTrack support staff, only where a support arrangement permits limited access to a customer's environment for troubleshooting.
• Legal, regulatory, or audit bodies where required by law.

We do not sell personal data. A list of any subprocessors we use is available on request by emailing info@theratrack.co.uk.

8. International transfers

Personal data processed through TheraTrack is generally stored and processed within the United Kingdom. If a future deployment requires transferring data outside the UK, we will apply an appropriate UK GDPR safeguard, such as the UK's International Data Transfer Addendum, and update this notice accordingly.

9. How long we retain data

Retention is governed by the customer organisation's own records management policy, the NHS Records Management Code of Practice, contractual requirements, and GMP/audit obligations — not by a single retention period set by TheraTrack. Some records are intentionally retained and cannot be hard-deleted because they form part of an audit or GMP traceability record, for example SOP acknowledgements, training evidence, CAPA notes, incident statements, batch/worksheet audit trails, stock transactions, and release decisions. Audit records may be retained even after a user leaves the organisation.

Website enquiry data is retained only as long as needed to respond and follow up.

10. Security and audit logging

TheraTrack uses role-based access (standard User and Superuser views), salted/hashed password storage, and authenticated permission checks for file access. Many critical actions — scans, signatures, releases, evidence uploads, and worksheet print/session activity — are recorded in an audit trail with the acting user and timestamp. As an early-stage product, we have not yet completed independent assurance schemes such as ISO 27001, Cyber Essentials, the NHS Data Security and Protection Toolkit, an NHS clinical safety case, or independent penetration testing. We will update this notice as these are completed.

11. User permissions and role-based access

Access within TheraTrack is controlled by organisation and role. Standard users generally see their own records (for example, their incidents and training); Superusers have broader oversight consistent with administrative and quality-management responsibilities.

12. Your data protection rights

Under UK GDPR, individuals have rights to access, correction, deletion, restriction, portability, and objection, subject to the healthcare and audit-integrity constraints described above (for example, some GMP audit records cannot be deleted). For data processed within a healthcare organisation's TheraTrack deployment, requests should generally be directed to that organisation, as it is likely to be the data controller. For website enquiries, contact us directly.

13. How to raise a request, or complain

To exercise a data protection right or raise a concern, email info@theratrack.co.uk. You also have the right to complain to the Information Commissioner's Office (ICO).

14. Changes to this notice

We may update this notice from time to time to reflect changes in our practices, technology, or legal requirements. Material changes will be communicated to active pilot organisations directly.

15. Contact

Questions about this notice: info@theratrack.co.uk · Plymouth, United Kingdom.