Cookie Policy
Cookies Policy
Virtual Pharmacist Ltd
ICO Registration: ZB127110
Purpose
This policy sets out how Virtual Pharmacist Ltd uses cookies and similar tracking technologies on its website (URL: virtualpharmacist.co.uk). It explains what cookies are, which categories the company uses, how consent is obtained and recorded, and how individuals can change their preferences. The policy is designed to meet the requirements of the Privacy and Electronic Communications Regulations 2003 (PECR), the UK General Data Protection Regulation (UK GDPR), and the Data Protection Act 2018 (together, “Data Protection Legislation”). Compliance with these requirements is overseen by the Information Commissioner’s Office (ICO), and this policy reflects the ICO’s current guidance on cookies and consent.
Scope
This policy applies to all pages served under the Virtual Pharmacist Ltd website domain (virtualpharmacist.co.uk) and to any subdomains that set or read cookies on a visitor’s device. It covers all cookies and similar technologies (including local storage and session storage where used for equivalent purposes). The policy applies to all visitors to the website, including members of the public, GP practice staff, and prospective contractor pharmacists. Internal staff and contractors accessing operational systems via separate authenticated portals are governed by the Information Security Policy and the relevant Data Sharing Agreement, not by this document.
Roles and Responsibilities
- The Operations Director is the named Data Protection point of contact for Virtual Pharmacist Ltd (contact: [email protected]). The Operations Director approves this policy, ensures the cookie banner is implemented correctly, and authorises any change to the cookies in use.
- The Operations Director acts as the de facto Information Governance Lead and is responsible for maintaining the cookies register, reviewing it when any cookie is added or removed, and triggering an annual review of this policy.
- The website developer or hosting provider (internal or contracted) is responsible for implementing the consent management platform (CMP), configuring cookie categories correctly, and ensuring that non-essential cookies are not set before consent is given.
- The website developer or hosting provider must notify the Operations Director before adding any new cookie or third-party script to the website, so the cookies register and this policy can be updated before deployment.
- All employed staff who commission or manage website content or third-party integrations must check with the Operations Director before enabling any new analytics, advertising, or functional tool that would set cookies.
- The ICO is the supervisory authority. Virtual Pharmacist Ltd’s ICO registration number is ZB127110 (registered 25/08/2021, expires 24/08/2026).
Procedure
1. What cookies are
A cookie is a small text file that a website places on a visitor’s device (computer, tablet, or phone) when they visit a page. Cookies allow the website to recognise the device on a return visit, remember preferences, and collect information about how the site is used. Some cookies are deleted when the browser is closed (session cookies); others remain on the device for a set period (persistent cookies). Similar technologies, such as local storage, work in the same way for the purposes of this policy and are treated identically.
2. Categories of cookies used
Virtual Pharmacist Ltd uses four recognised categories of cookie. Only strictly necessary cookies are set without consent. All other categories require the visitor’s prior opt-in via the cookie banner.
- Strictly Necessary. These cookies are essential for the website to function. They include session management cookies, CSRF (cross-site request forgery) tokens, and load-balancer cookies. Without them, services the visitor has asked for cannot be provided. These cookies cannot be switched off.
- Performance (analytics). These cookies collect information about how visitors use the site, for example which pages are visited most often and whether error messages are received. All information collected is aggregated and anonymous. These cookies are only set with the visitor’s consent.
- Functional (preference). These cookies allow the website to remember choices the visitor makes, such as language or region, to provide a more personalised experience. These cookies are only set with the visitor’s consent.
- Targeting/Advertising. Virtual Pharmacist Ltd does not currently use targeting or advertising cookies and does not permit third parties to set them via this website. If this position changes, this policy will be updated before any such cookies are deployed, and explicit consent will be sought.
3. Specific cookies set
The table below lists the cookies currently in use. Where a specific cookie name depends on the platform or CMP configuration, a placeholder is shown. The Operations Director must confirm and complete these entries before the policy is published.
4. Consent mechanism
When a visitor first arrives on the website, a cookie banner is displayed before any non-essential cookies are set. The banner offers three options: Accept all, Reject optional, and Manage preferences. Selecting “Accept all” enables performance and functional cookies. Selecting “Reject optional” allows only strictly necessary cookies. Selecting “Manage preferences” opens a preference centre where the visitor can enable or disable each category individually.
Consent is recorded in a consent cookie (see the table above) so that the visitor’s choice is respected on subsequent visits. Consent is not inferred from scrolling, continued browsing, or any other passive action. The consent record is refreshed at the interval specified in the table, at which point the banner is shown again.
5. How to change cookie settings
A visitor can change their cookie preferences at any time by clicking the “Cookie settings” link in the website footer. This reopens the preference centre and allows any previous choice to be changed. Withdrawing consent for a category of cookie does not affect the lawfulness of any processing that took place before withdrawal.
Visitors can also control cookies through their browser settings. Most browsers allow cookies to be blocked or deleted. Blocking strictly necessary cookies may prevent parts of the website from working correctly. Browser-level instructions are available from the ICO’s website at ico.org.uk.
6. Third-party cookies and international transfers
Where performance or functional cookies are set by a third party (for example, Google LLC for analytics), that third party may process data outside the United Kingdom. Where such transfers occur, Virtual Pharmacist Ltd will ensure an appropriate transfer mechanism is in place, such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, in accordance with Chapter V of the UK GDPR. Details of the transfer mechanism in use will be confirmed in the cookies register held by the Operations Director.
7. Contact
Any queries about this policy or about the cookies used on the Virtual Pharmacist Ltd website should be directed to the Operations Director at [email protected]. Complaints about the use of cookies may also be made to the Information Commissioner’s Office at ico.org.uk or by post to: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
Equality
Virtual Pharmacist Ltd is committed to ensuring that this policy does not discriminate against any visitor on the basis of a protected characteristic under the Equality Act 2010. The cookie banner and preference centre are designed to be accessible to users with disabilities, including those using screen readers or keyboard-only navigation, in line with WCAG 2.1 AA standards. The policy is written in plain English so that it is understandable to all visitors regardless of background or prior knowledge of data protection law.
Training
All employed staff who manage the website, commission third-party integrations, or procure digital services must complete the annual Information Governance training module referenced in the VP Training Matrix. The website developer or hosting provider (where contracted) must be made aware of this policy and the requirement to seek approval before adding any new cookie or script. The Operations Director must be familiar with the ICO’s current guidance on cookies and PECR, and should review that guidance as part of the annual policy review cycle.
Monitoring
The Operations Director reviews the cookies register at least once a year and whenever a new cookie is added to or removed from the website. The cookie banner and consent mechanism are tested at each review to confirm that non-essential cookies are not set before consent is given. Any change to the analytics platform, CMP, or hosting provider triggers an immediate review of the relevant rows in the cookies register and, where necessary, an update to this policy before the change goes live. Audit records of consent (where stored by the CMP) are retained for a minimum of 12 months. Compliance with this policy is reported to the Operations Director as part of the annual Information Governance review.
Cookie banner content
The following copy and button labels must be used verbatim in the cookie consent banner on the Virtual Pharmacist Ltd website. The style follows the UK Government Service Manual approach: plain language, no pre-ticked boxes, and a clear choice between accepting and rejecting optional cookies before any non-essential cookie is set.
Banner heading: Cookies on virtualpharmacist.co.uk
Banner body text:
“We use essential cookies to make this site work. We’d also like to set optional cookies to help us improve it. We won’t set optional cookies unless you accept them.”
Buttons (displayed in this order, left to right):
- Accept all
- Reject optional
- Manage preferences
The “Manage preferences” option must open a preference centre that lists each non-essential cookie category (Performance, Functional) with an individual toggle, defaulting to off. The banner must not obscure the main content of the page in a way that prevents the visitor from reading the page before making a choice, but it must be clearly visible and must not disappear without a positive action from the visitor. A “Cookie settings” link in the website footer must reopen the preference centre at any time.