Cookie Policy

Version 7 · Last updated 24 June 2026

# Cookie Policy

Apothecare Group Limited trading as Quick Meds

Last updated: 26th June 2026— Version 2.0

## 1. Introduction

This Cookie Policy explains how Apothecare Group Limited trading as Quick Meds ("we", "us", "our") uses cookies and similar technologies on our website, www.quickmeds.co.uk. It sets out what these technologies are, which ones we use, why we use them, and the choices available to you.

This policy should be read alongside our Privacy Policy, which explains in full how we handle your personal data. Where this Cookie Policy refers to specific providers, retention periods, or international transfers, those details are consistent with, and supplemented by, our Privacy Policy.

By using our website, and where required by giving your consent through our cookie consent mechanism, you agree to the use of cookies as described in this policy. You can change your preferences at any time (see Section 11).

## 2. Regulatory Context

As a UK-registered online pharmacy, we are regulated by the General Pharmaceutical Council (GPhC, registration number 9012521) and the Medicines and Healthcare products Regulatory Agency (MHRA). Apothecare Group Limited is registered with Companies House (number 11824371) and with the Information Commissioner's Office (ICO reference ZA536099).

Our use of cookies complies with the Privacy and Electronic Communications (EC Directive) Regulations 2003 (SI 2003/2426, as amended) (PECR) and, in respect of any personal data processed, the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

As an online pharmacy, we are especially conscious of the sensitivity of the data we hold. We do not allow any clinical, health, treatment, or consultation data to be collected by, or transmitted to, any analytics or advertising provider through cookies or any other tracking technology. This restriction is described further in Section 7.

## 3. What Are Cookies

Cookies are small text files placed on your device when you visit a website. They allow a website to recognise your device, remember your preferences and actions, and function efficiently. Similar technologies — such as pixels, tags, software development kits, and local storage — perform comparable functions, and references to "cookies" in this policy include these technologies.

Cookies may be:

- Session cookies, which are temporary and deleted when you close your browser; or persistent cookies, which remain on your device for a set period or until you delete them.

- First-party cookies, set by us directly; or third-party cookies, set by an external provider.

## 4. Legal Basis for Using Cookies

Strictly necessary cookies are exempt from the consent requirement under PECR because they are essential to provide the service you have requested. Where any personal data is processed through them, our lawful basis under the UK GDPR is performance of a contract (Article 6(1)(b)) or legitimate interests (Article 6(1)(f)).

Analytics and advertising cookies are non-essential. We set them only where you have given your consent through our cookie consent mechanism, in line with PECR. The corresponding UK GDPR basis is consent (Article 6(1)(a)). You can withdraw consent at any time, and doing so does not affect the lawfulness of processing before withdrawal.

## 5. Categories of Cookies We Use

Strictly necessary cookies — Essential for the website to function. They enable core features such as account login, shopping basket functionality, and secure checkout. These cookies cannot be disabled. They do not store information used for marketing or analytics.

Analytical and performance cookies — These help us understand how visitors use our website so we can measure and improve performance. They are set only with your consent.

Advertising and marketing cookies — These are used to measure the effectiveness of our advertising campaigns and to deliver relevant advertising. Where you consent to these cookies, they work in conjunction with the server-side Conversions APIs described in Section 7. They are set only with your consent.

## 6. Cookies and Tracking Technologies We Use

The table below lists the providers we use. We encourage you to review each provider's own privacy policy for further detail on how they handle data.

|---|---|---|---|---|---|

| Google Tag Manager | Google LLC | Tag management | Deploys and governs the analytics and advertising tags listed below; does not itself collect personal data beyond what those tags collect | Third-party | United States (UK Extension to the EU–US Data Privacy Framework) |

| Microsoft Clarity | Microsoft Corporation | Analytics | Heatmaps and session replay; configured to mask form-field content and does not capture keystrokes in fields containing personal or health data | Third-party | United States (UK Extension to the EU–US Data Privacy Framework) |

| Triple Whale | Triple Whale, Inc. | Analytics | E-commerce and marketing analytics; configured so that no medication name, treatment category, or health-related product detail is transmitted | Third-party | United States (IDTA or UK Extension to the EU–US Data Privacy Framework) |

## 7. Server-Side Tracking (Conversions APIs)

In addition to browser-based cookies and pixels, we use server-side integrations known as Conversions APIs (CAPI) provided by Meta and Google. These send conversion event data directly from our server to the advertising platform's server.

Server-side tracking is subject to the same consent requirements as browser-based tracking. Data is only transmitted where you have consented to advertising and marketing cookies through our cookie consent mechanism. If you do not consent, or you withdraw consent, no data is transmitted via these integrations.

Where you have consented, only limited non-clinical data is shared: a hashed email address, a hashed telephone number, transaction value (without product or treatment details), a generic conversion event identifier, and technical identifiers such as IP address and browser user agent. We never share the name, type, or category of any medication, treatment, or product; any medical condition, symptom, or diagnosis; any consultation responses, clinical notes, or prescribing information; or any URL path that could reveal a health condition or treatment category. Full details are set out in Section 9 of our Privacy Policy.

## 8. International Data Transfers

Some providers are based outside the United Kingdom. Where data is transferred outside the UK, we ensure appropriate safeguards under Article 46 of the UK GDPR:

- Google LLC, Microsoft Corporation, and Meta Platforms, Inc. (United States) — participate in the UK Extension to the EU–US Data Privacy Framework, recognised by the UK Government as providing adequate protection.

- Triple Whale, Inc. (United States) — covered by an International Data Transfer Agreement (IDTA) or, where applicable, the UK Extension to the EU–US Data Privacy Framework.

- Ahrefs Pte. Ltd (Singapore) — covered by an IDTA or the addendum to the EU Standard Contractual Clauses.

Our own first-party analytics system (atrack) is hosted exclusively in the United Kingdom on a UK-based DigitalOcean droplet, and no international transfer of personal data takes place in respect of it.

## 9. Cross-Domain Notice

Some of our measurement technologies may recognise interactions across more than one domain we operate, in order to attribute conversions accurately and provide a consistent experience. Any such cross-domain measurement is carried out in compliance with PECR and the UK GDPR, is subject to your cookie consent where it is non-essential, and never involves clinical or health data.

## 10. Data Retention

We retain data collected through cookies only for as long as necessary for the purpose for which it was collected. Analytics data is retained for up to 14 months from collection (or the provider's default, whichever is shorter). After the applicable period, data is deleted or anonymised so that it can no longer identify you. Full retention periods are set out in Section 12 of our Privacy Policy.

## 11. How to Manage Your Cookie Preferences

You can manage your preferences at any time through the cookie settings interface, accessible via a link at the bottom of every page on our website. This lets you enable or disable analytics and advertising cookies. Strictly necessary cookies cannot be disabled as they are essential to the operation of the site.

You can also manage or delete cookies through your browser settings. Please note that disabling some cookies may affect the functionality of our website.

## 12. Your Rights

Under the UK GDPR and the Data Protection Act 2018 you have rights in relation to personal data collected through cookies, including the rights of access, rectification, erasure, restriction, portability, and objection, and the right to withdraw consent. To exercise any of these rights, please contact our Data Protection Officer using the details in Section 14. You also have the right to lodge a complaint with the ICO (www.ico.org.uk).

## 13. Changes to This Policy

We may update this Cookie Policy from time to time to reflect changes in our practices, the technologies we use, or legal requirements. Any changes will be posted on this page, and material changes will be notified to you in accordance with our Privacy Policy.

## 14. Contact Us

- Telephone: 0121 628 5318

- Email: [email protected]

- Address: Data Protection Officer, Apothecare Group Limited, Unit 2 Forge Industrial Park, Forge Lane, Sutton Coldfield, Birmingham, B76 1AJ