Privacy notice
Last updated 25 October 2026. This notice explains what information we collect when you use Vivia, why, who sees it and your rights.
Who we are
Vivia is run by Icon Pharmacy Ltd from Icon Pharmacy, 155 Manford Way, Chigwell, Essex, IG7 4DN. We are the controller of your information, registered with the Information Commissioner's Office (ICO) under number ZB562076.
Our data protection officer is Vaibhav Shah. Contact them at hello@vivia.health or write to the address above.
What we collect
- From the form: your first name, date of birth, mobile number, email address, postcode, what you need, and either when you had unprotected sex or when you'd like a call.
- On the call: your full name, address, GP practice, and the health information we need to supply safely. This can include your contraception history, medicines, health conditions, blood pressure, height and weight, smoking, and whether you could be pregnant or are breastfeeding.
- What we supplied: the medicine, the date and the delivery details.
- Website use: how you use our website, through cookies, but only the ones you agree to.
We need this information to provide the service. If you'd rather not give it, we can't supply medicine.
Why we use it, and our lawful basis
| Why we use it | Lawful basis under UK GDPR |
|---|---|
| Your consultation, supply, delivery and follow-up, including emails before your call and when your next pill supply is due | Article 6(1)(e), a task in the public interest (providing NHS services), and Article 9(2)(h), providing health care |
| Keeping clinical records and claiming payment from the NHS | Article 6(1)(e) and Article 9(2)(h) |
| Sharing information to protect you or someone else from serious harm | Article 6(1)(e) and Article 9(2)(h), and the safeguarding conditions in the Data Protection Act 2018 |
| Inviting you to review us on Trustpilot | Your consent: Article 6(1)(a) and explicit consent under Article 9(2)(a) |
| Advertising and analytics cookies | Your consent |
We don't send marketing unless you've said yes. A person, not a computer, makes every decision about your care.
Who we share it with
We never sell your information.
| Who | What | Why |
|---|---|---|
| Your GP practice | The outcome of your consultation | Only if you agree, so your GP record is complete |
| NHS Business Services Authority | Details of your consultation and supply | To pay us for the NHS service and check our claims |
| NHS England | Anonymised data that doesn't identify you | For service evaluation and research |
| Royal Mail | Your name and address only | To deliver your parcel |
| Our suppliers | Only what each needs | They run our website form (Supabase), phone system (The VoIP Shop), email (Google Workspace) and clinical records (Cegedim Pharmacy Services), only on our instructions and under written contracts |
| Safeguarding teams, the police or a court | What the law requires or allows | Only if someone is at serious risk of harm, or the law requires it |
| Regulators, such as the GPhC and NHS | Records they ask to see | Inspections and investigations |
| Trustpilot | Your name and email | Only if you agree, so they can invite you to leave a review. Saying no won't affect your care |
Advertising cookies from Google and Meta only run if you agree to them. We never send your form answers or health information to Google or Meta.
Your form answers and clinical records are stored in the UK. Emails we send you go through Google Workspace, which may store them outside the UK. Google protects UK data under the UK Extension to the EU-US Data Privacy Framework and standard contractual clauses.
How long we keep it
| Information | How long |
|---|---|
| Clinical records of your consultations | At least 8 years, following the NHS Records Management Code of Practice |
| Records of NHS claims | 3 years, as the NHS service rules require |
| Forms that don't lead to a consultation | 3 months |
| Cookies | As set out in our cookie policy |
Your rights
You can ask us to:
- give you a copy of your information
- correct anything that's wrong
- delete or restrict your information, though we must keep health records for the periods above
- stop using your information for a purpose, which is your right to object
- withdraw any consent you've given, such as for Trustpilot or cookies, at any time
To make a request, contact our data protection officer at hello@vivia.health. We'll reply within one month.
Your NHS data
You can choose to opt out of the NHS using your data for planning and research. This doesn't affect your care. See nhs.uk/your-nhs-data-matters or use the NHS App.
Complaints about your data
If you're unhappy with how we've used your information, tell us at hello@vivia.health. We'll acknowledge your complaint within 30 days and keep you updated until it's resolved.
You can also complain to the Information Commissioner's Office at any time: ico.org.uk/make-a-complaint.
Changes to this notice
We'll update this notice when anything changes. The date at the top shows the latest version.