Privacy policy

Bargain Chemist Privacy Policy

1. About this policy

This policy explains how Bargain Chemist ("we", "us") collects, uses, stores and shares your personal information when you visit or buy from www.bargainchemist.co.nz (the "Site"), shop in one of our pharmacies, use Click & Collect, book a vaccination or other pharmacy service, or otherwise deal with us.

We are a pharmacy, so we hold health information about you. We handle it under the Privacy Act 2020 and the Health Information Privacy Code 2020 (the "Code"), which sets stricter rules for health agencies. In this policy "personal information" includes health information unless we say otherwise.

2. Personal information we collect

2.1 Device Information

When you visit the Site, we automatically collect certain information about your device, including information about your web browser, IP address, time zone, and some of the cookies that are installed on your device. As you browse the Site, we collect information about the individual web pages or products that you view, what websites or search terms referred you to the Site, and how you interact with the Site. We call this "Device Information".

2.2 Order and account information

When you make or attempt to make a purchase through the Site, or create an account, we collect your name, billing address, shipping address, email address, phone number, date of birth (where we need it for age-restricted or pharmacist-only products), your login details and your order history. We call this "Order Information". Our payment providers (see section 5) collect and process your card details. We do not store them.

2.3 Health Information

We also collect health information when you:

• have a prescription dispensed by us, in store or online;
• ask for a pharmacist-only or pharmacy-only medicine, including your answers to our screening questions;
• book or receive a vaccination, health check or other pharmacy service;
• ask about or join a weight-management or other clinical programme (for example Wegovy or Mounjaro), including any consultation with prescriber / telehealth partner
• ask our pharmacists for advice about your health or medicines.

This can include your NHI number, medicines and dispensing history, allergies, health conditions, prescriber details and consultation notes. We call this "Health Information". We only collect what we need to supply your medicine or service safely and to meet our legal obligations as a pharmacy.

2.4 In-store information

In our pharmacies we may take your contact details for Click & Collect, refunds, product orders, recalls or loyalty programmes. Our stores have CCTV for the safety of staff and customers.

2.5 Information from other sources

We may also get information about you from your prescriber or medical practice, the New Zealand ePrescription Service, Health New Zealand | Te Whatu Ora (for funded vaccinations, for example), another pharmacy when you transfer a prescription to us, or someone acting for you, such as a caregiver collecting your medicine. "Personal Information" in this policy means Device Information, Order Information, Health Information, in-store information and information we receive from other sources.

3. How we collect Device Information

We use the following technologies:

• "Cookies" are data files placed on your device or computer and often include an anonymous unique identifier. For more about cookies and how to disable them, visit http://www.allaboutcookies.org.
• "Log files" track actions on the Site and collect data including your IP address, browser type, internet service provider, referring/exit pages, and date/time stamps.
• "Web beacons", "tags" and "pixels" are electronic files that record how you browse the Site.

4. How we use your Personal Information

We use Order Information to fulfil orders placed through the Site, including arranging shipping and sending you invoices and order confirmations. We may share your name and shipping details with the third-party logistics providers who fulfil orders for us.

We also use Order Information to:

• communicate with you about your order, account or enquiry;
• review requests for pharmacist-only medicines;
• screen orders for potential risk or fraud;
• manage refunds, exchanges, product recalls and Price Beat Guarantee claims; and
• where you have told us you want it, send you information or advertising about our products or services, including advertising run with our advertising and social media partners (Meta and Google, for example) as described in section 7.

We use Health Information to:

• dispense prescriptions and supply medicines safely, including checking for interactions, allergies and contraindications;
• give pharmacist advice, vaccinations, health checks and clinical programmes;
• talk to your prescriber or other health providers involved in your care;
• claim funding or subsidies from Health New Zealand | Te Whatu Ora or other funders;
• keep the records we must keep by law as a pharmacy; and
• respond to product recalls or safety notices for a medicine you have received.

We do not use your Health Information, prescription history or the fact that you bought a particular medicine to build advertising profiles or target you with advertising. We do not sell your Personal Information.

We use Device Information to screen for potential risk and fraud (in particular your IP address) and to improve the Site, for example by looking at how customers browse and interact with it and whether our marketing and advertising campaigns are working.

5. Who we share your Personal Information with

We share Personal Information with third parties only where we need to in order to run our business and provide our services. They are:

• Shopify, which powers our online store. You can read how Shopify uses your Personal Information at https://www.shopify.com/legal/privacy.
• Google Analytics, which helps us understand how customers use the Site. You can read how Google uses your Personal Information at https://www.google.com/intl/en/policies/privacy/ and opt out of Google Analytics at https://tools.google.com/dlpage/gaoptout.
• Courier and third-party logistics providers who deliver your orders (e.g. NZ Post, NZ Couriers, other).
• Payment providers: Shopify Payments, PayPal, Afterpay and the card schemes. They process your payment and may run their own fraud and credit checks under their own privacy policies.
• Email and SMS providers for communications you have opted in to, and the advertising partners described in section 7.
• Our dispensing and pharmacy management software, the New Zealand ePrescription Service, our vaccination booking system and the clinical partners who prescribe or consult for programmes we offer
• Your prescriber, other health practitioners involved in your care, Health New Zealand | Te Whatu Ora and Manatū Hauora | Ministry of Health, where needed to provide funded services or required by law.
• IT, hosting, security, accounting, legal and insurance providers who support our business and are bound by confidentiality obligations.

We may also share Personal Information to comply with applicable laws and regulations, to respond to a subpoena, search warrant or other lawful request for information, to a regulator such as the Pharmacy Council or Medsafe, or otherwise to protect our rights, our customers or the public.

If we sell, merge or restructure all or part of our business, Personal Information may pass to the new owner or its advisers as part of that transaction. It will stay subject to confidentiality obligations and to this policy or one that gives equivalent protection.

6. Overseas disclosure

Some of the providers above store or process information outside New Zealand. Shopify, Google, Meta and our email, SMS and payment providers have servers in countries including Australia, the United States and Canada. Where we send Personal Information overseas we take reasonable steps to make sure it gets protection comparable to the Privacy Act 2020, by contract or because the recipient is covered by comparable privacy law. Health Information in our dispensing system is stored in New Zealand.

7. Cookies, advertising and your choices

Our website uses technologies from advertising partners (third-party companies) that recognise your device and collect information about your browsing so they can show you advertisements likely to interest you. These partners collect information about your activity on this website so that we can show you advertisements for our products and services on other websites and apps. Some of them use non-cookie technologies, which browser settings that block cookies may not affect.

As set out in section 4, Health Information and medicine purchases are excluded from this.

You can opt out of targeted advertising in your settings with:

• Meta (Facebook and Instagram): https://www.facebook.com/settings/?tab=ads
• Google: https://adssettings.google.com
• TikTok: in the TikTok app under Settings and privacy > Ads

You can also block or delete cookies in your browser settings. That may stop some parts of the Site working, such as your saved store or cart.

8. Marketing communications

If you opt in to marketing from us, at checkout, on the website or in store, we may email or text you about products, offers or promotions. You can unsubscribe at any time using the link in our messages, by replying STOP to a text, or by contacting us. We do not send marketing without your consent, and we comply with the Unsolicited Electronic Messages Act 2007.

9. How long we keep your Personal Information

We keep Personal Information for as long as we need it for the purposes in this policy and to meet our legal obligations. In particular:

• Health Information, including prescription and dispensing records, must be kept for at least 10 years from the last date we provided you a service, under the Health (Retention of Health Information) Regulations 1996 and the Medicines Regulations 1984. We cannot delete these records on request within that period.
• Order and transaction records are kept for at least 7 years for tax and accounting purposes.
• Account, marketing and Device Information is kept while your account is active or you are subscribed, and is deleted or de-identified within a reasonable time after that, or earlier if you ask and we have no legal reason to keep it.

When we no longer need information we securely delete or de-identify it.

10. Security

We take reasonable steps to protect your Personal Information from loss, misuse and unauthorised access, change or disclosure. Access to Health Information is limited to pharmacists and authorised staff. Data is encrypted in transit and hosted securely through Shopify and our other providers. Staff are trained, and the third parties who process information for us are bound by contract. No storage or transmission method is completely secure, and we cannot guarantee absolute security.

11. Your rights: access and correction

Under the Privacy Act 2020 and the Code you can ask us for a copy of the Personal Information we hold about you, and ask us to correct it if you think it is wrong. Contact our Privacy Officer using the details in section 15. We will respond within 20 working days. We may need to check your identity first, particularly for Health Information. Access requests are free, though we may charge a reasonable fee for repeat requests. If we decline to correct something, you can ask us to attach a note of the correction you asked for to the record.

Where the law requires us to collect information (your details when we dispense a prescription, for example), we will tell you at the time. If you do not give us the information we ask for, we may not be able to supply the product or service.

12. Privacy breaches

If we become aware of a privacy breach that is likely to cause you serious harm, we will notify the Office of the Privacy Commissioner and, where practicable, you, as Part 6 of the Privacy Act 2020 requires, and tell you what you can do to protect yourself.

13. Children

The Site is not aimed at children under 16. Where we provide pharmacy services to a child, we collect Health Information from and communicate with their parent or guardian unless the law allows the child to make their own health decisions.

14. Changes to this policy

We may update this policy from time to time to reflect changes to our practices or for other operational, legal or regulatory reasons. The current version and its effective date will always be on the Site. We will notify material changes on the Site or by email to account holders.

15. Contact us and how to complain

For questions about our privacy practices, to access or correct your information, or to make a complaint, contact our Privacy Officer:

Privacy Officer, Bargain Chemist Limited
Email: info@bargainchemist.co.nz

We will acknowledge your complaint within 5 working days and aim to resolve it within 20 working days. If you are not happy with our response, you can complain to the Office of the Privacy Commissioner at www.privacy.org.nz, by email to enquiries@privacy.org.nz, or by phone on 0800 803 909.