Privacy policy

Last updated on: 12th February 2025

Part 1: Melve GmbH Privacy Policy

Melve GmbH takes data protection extraordinarily seriously. During our activities, we process personal data only in compliance with data protection regulations. Melve GmbH (“Melve”, “we” or “us”) respects the privacy of individuals. We are a “controller” for the purposes of the General Data Protection Regulation (EU) 2016/679 (“GDPR”), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (EU) 2003/2426 (collectively referred to as the “Data Protection Laws”).

We process personal data only for previously defined purposes and ensure that the data is correct and up to date. Personal data that is no longer needed for the defined purpose or incorrect will be deleted immediately. Furthermore, we ensure adequate security of the data processed by us and protect it against unauthorized access.

1. Information about Melve GmbH

Melve GmbH

Schlossplatz 1

8502 Lannach

Austria

You can contact the responsible data protection officer at the following e-mail address: dataprivacy@melve.com

2. Categories of personal data processed

We will collect and hold these categories of personal data about you:

Data collected when you visit our homepage

When you use our website for information purposes only, we only collect the so-called “server log files” listed below, which are technically necessary for us to offer you our website and to ensure the stability and security of the website:

Date and time of the visit
Time zone difference from Greenwich Mean Time (GMT)
Content of the request (specific page)
Access status/HTTP status code
Quantity of data transferred
Type of browser
Operating system and its interface
Language and version of the browser software

General enquiries

If you submit a general inquiry, we will need to collect the following additional data:

First and last name
Contact details (e.g., address, phone number, e-mail address)

Registration within the context of an account on our platform

We collect the following additional information to create and maintain your account and enable the medical services provided to you:

First and last names
Email address, username, and password
Date of birth
Phone number

Information about your state of health / medical information

To organize the consultation of the doctor for the online treatment, we require your relevant health data, and you need to fill in our medical questionnaire. This is a special category of personal data and may include photographs that you submit in connection with your medical consultation. Your explicit consent is a prerequisite for us to process this data.

Purchase of products

We will collect the following information to administer any purchases you wish to make from our partners / us:

Contact and delivery details (phone number, email address, and postal address)
Your purchase information (product, date, amount, invoice address)
Prescription
Payment information (We do not store your payment card details within your account. All payments are dealt with directly via PayPal (Europe) S.à r.l. et Cie, S.C.A. or Stripe Payments Europe, Ltd., and we will only be notified whether a transaction is successful or not).

3. Purpose and legal basis of data processing

The types of personal data listed above are processed for the following purposes and based on the following legal basis:

Categories	Purpose	Legal Basis
Visit of the homepage / server log files	Necessary for us to present our website to you and to ensure the stability and security of the website.	Legitimate interests
General inquiries	To handle and respond to your general inquiries.	Legitimate interests
Account registration	To manage and administer your account on our platform, which is necessary to conclude a contract with us.	Contract
Medical information	To organize the consultation of the doctor for the online treatment and share with the respective doctors.	Consent
Purchase of products	To process your payments for products / redeeming of vouchers and administer your purchase of products.	Contract

4. Data protection and disclosure of personal data

The security of your data is our top priority, and our business model is based on integrity and discretion. We cooperate with pharmacies so that you can receive your ordered product after your electronic prescription has been signed by a doctor. During the ordering process, you have the choice between sending your medication either through a mail-order pharmacy or picking up your medication on-site at a pharmacy of your choice. Depending on your selection, your personal data, together with the electronic prescription issued by the doctor and the associated drug voucher created by us, will be forwarded to the pharmacy you have selected to process your order.

Moreover, we share your personal information with several service providers who process your data as part of the services they offer to us. We take steps to ensure that our service providers treat your data in accordance with the law, only use it in accordance with our contract with them, and keep it secure.

Service Providers We Use:

Google Cloud: Used for web hosting in the Google Cloud (Google Cloud Platform, GCP), specifically the Frankfurt, Germany region (europe-west3). The Google Cloud operates a multi-tenant environment, so data is replicated between many geographically distributed fail-safe data centers. Service provider: Google Ireland Limited; Parent company: Google LLC. Personal data is only transferred outside the EU within the scope of hosting under EU standard contractual clauses.
Google Analytics and Tag Manager: This website uses Google Analytics to analyze how users use the site using "cookies." IP anonymization is activated, meaning Google will reduce your IP address within Member States of the European Union. You can prevent Google from collecting the data by installing a browser plug-in (http://tools.google.com/dlpage/gaoptout?hl=en).
Facebook: For advertising and marketing.
Google AdWords: For advertising and marketing.

Separate Data Controllers:

We share your personal data with the following organizations who act as separate controllers. You should review their privacy policies regarding how they process your data:

EU-registered doctors: Who assess your medical information to prescribe the products.
Apotheek Bad Nieuweschans B.V.: Sells and delivers the prescription products to you.
Stripe Payments Europe, Ltd.: Takes payment for the products.
PayPal (Europe) S.à r.l. et Cie, S.C.A.: Takes payment for the products.

We also share data as necessary to enforce our legal rights, defend legal claims, and if required by law, to disclose to courts, police, law enforcement agencies, or regulators. To protect our technical systems against unauthorized access, we have taken technical and organizational precautions. We will obtain an explicit declaration of consent from you before passing on your medical data to the telemedicine provider, cooperating doctors, and the partner pharmacy.

5. Cookies

Our website uses so-called cookies. These small text files are stored on your mobile device using the browser and do not cause any damage. We use cookies to make our website user-friendly. Some cookies remain stored on your device until you delete them, enabling us to recognize your browser the next time you visit. If you do not wish for this to happen, you can set your browser to inform you about the setting of cookies so you can allow them on a case-by-case basis. Deactivating cookies may limit the functionality of our website.

6. How long will the personal data be stored?

Personal data will only be stored for as long as it is necessary to fulfill a contractual relationship or a legal obligation. After this period, the personal data will be anonymized or deleted.

7. Which rights do you have as a data subject?

According to current data protection law, you can request the following from the person in charge:

Right of access by the data subject (Art 15 GDPR)
Right to rectification and right to erasure (Art 16 and 17 GDPR)
Right to restriction of processing (Art 18 GDPR)
Right to data portability (Art 20 GDPR)

You also have the right to:

Revoke your consent upon processing your personal data (Art 13 sec 1 (c) and Art 14 sec 2 (d) GDPR)
Object to the processing of the personal data (Art 21 GDPR)
Lodge a complaint with a supervisory authority (Art 13 sec 2 (d) and Art 14 sec 2 (e) GDPR)

If you have any further questions or comments regarding the processing of your personal data or the exercise of your rights, please contact us at dataprivacy@melve.com, with the subject line “Data Protection”.

Part 2: Health Counter Privacy Policy

The Executive Management of Health Counter (Cedarwood Pharmacy) ensures that effective internal processes are undertaken within the business to protect the data of its employees, patients, suppliers, and customers.

This policy and procedure are created in the context of the Health Counter core value to "Be Disciplined and Professional" and recognizes the Services provided by Cedarwood Pharmacy and its responsibility to protect healthcare data as a special category. As part of this, additional measures are in place to protect patient records and processing. This policy and Privacy Notice is overseen by the Health Counter Data Protection Officer (DPO), a requirement of the GDPR legislation.

1. Objectives, Aim and Scope

1.1. Aims and Objectives

The objectives of the Health Counter Network Security Policy are:

GDPR Compliance: To ensure that Health Counter has an overarching Data Protection Policy enabling a consistent approach to secure data management across the company and compliance with the legislation.
Employee Awareness: To provide insight to colleagues around GDPR and its responsibilities for the company, management, and colleagues.
Patient Understanding: To provide a privacy policy notice to patients.

1.2. Scope

This policy and procedure apply to Health Counter and relates to the provision of Services provided by Cedarwood Pharmacy.

2. Legislation

General Data Protection Legislation (GDPR) 2018
NHS Information Governance Alliance (IGA)

3. Health Counter Privacy Policy

Our pharmacists and staff are members of your online healthcare team. They aim to provide you with the highest quality of healthcare. To do this, they need to keep records about you, your health, and the care we have provided or plan to provide to you. We know that you value your privacy and the security of personal information held about you.

Information recorded

As part of providing a professional, safe, and efficient service, there is certain information that we record. This includes details of drugs and appliances dispensed against your prescriptions as well as significant advice given, referrals made to other health professionals, and any other relevant information.

Information recorded may include:

Basic details about you, such as address, date of birth, contact details, etc.
Records of medicines you have been prescribed by the doctor or another qualified prescriber, and which have been supplied by Cedarwood Pharmacy.
Details of medicines purchased from the pharmacy without a prescription (“p-meds; over the counter medicines”).
Other details and notes about your health and medical treatment.
Information relevant to your continued care from other people who care for you and know you well, such as other health professionals and relatives.
Any other services we may provide to you.

Processing Information

We process your personal data, which includes information from your prescriptions and any other pharmacy and health care services we provide to you for the purposes of:

Your care: Providing pharmacy services and care to you and sharing your information with your physician and others, as appropriate.
Management: Sharing only relevant information with Local Authorities, if necessary; as well as those external to Cedarwood Pharmacy who ensure we maintain appropriate professional and service standards and that your declarations and ours are accurate (e.g., Inspections by GPhC).
Retention: We hold your information for as long as advised by the GPhC.

Your Rights

You have the right to confidentiality under the General Data Protection Regulation and the Data Protection Act 2018, the Human Rights Act 1998, and the common law duty of confidence (the Equality Act may also apply).

We also comply with the NHS Code of Practice on Confidentiality, and pharmacists have a requirement under their professional standards to keep records about you confidential, secure, and accurate. All our staff contracts of employment contain a requirement to keep patient information confidential. Our guiding principle is that we process your records in strict confidence.

Your right to view your health record

You have the right to ask for a copy of all pharmacy records about you.
Generally, there will be no charge for a printed copy of the information we hold about you.
We are required to respond to your request within one month.
You will need to give adequate information for pharmacy staff to identify you (for example, full name, address, and date of birth). You will be required to provide ID.