Bolt Healthcare Ltd (trading as Bolt Pharmacy)
Last updated: 6 November 2026
1. Who we are and how to contact us
This Privacy Policy applies to Bolt Healthcare Ltd, trading as Bolt Pharmacy, and covers our website, web app, and mobile app (iOS and Android). We are registered in England and Wales under company number 15149039. Our registered office and pharmacy premises are at Unit 3C, Frontier Park, Blackburn, Lancashire, BB1 3AL.
For the purposes of UK data protection law, Bolt Healthcare Ltd and Aios LLC act as joint controllers under Article 26 UK GDPR for personal data collected through this website and processed on our platform, including data relating to your account, dispensing, and delivery. For personal data relating to your clinical consultation and prescribing decisions, Bolt Healthcare Ltd and AIOS Technology Ltd act as joint controllers under Article 26 UK GDPR. A summary of each arrangement, including who to contact, is set out in Sections 5.1 and 5.2 below.
We have appointed Mishcon de Reya LLP as our Data Protection Officer. If you have any questions about our use of your personal data, please contact us at:
- Email: [email protected]
- Post: Bolt Pharmacy, Unit 3C, Frontier Park, Blackburn, Lancashire, BB1 3AL
- Telephone: 03330162337
We are registered with the Information Commissioner's Office (ICO) under registration number ZB678271.
2. What personal data we collect
2.1 Information you give us
When you use our website or services you may provide us with:
- Identity and contact data: your name, date of birth, address, email address, and telephone number
- Health data: your medical history, current medications, allergies, symptoms, BMI, weight, height, lifestyle information, and other clinical information necessary for a prescriber to assess your suitability for treatment
- Identity verification data: photo ID and, where required, identity verification information
- Financial data: payment card details (processed securely by our payment provider — we do not store full card numbers)
- Account data: your login credentials and account preferences
- Communications: messages you send us via email, phone, or our secure messaging system
2.2 Information we collect automatically
When you visit our website, we automatically collect:
- Technical data: your IP address, browser type and version, device information, operating system, and time zone
- Usage data: pages you visit, links you click, time spent on pages, and how you navigate our site
This data is collected using cookies and similar technologies. Please see our Cookies Policy for details.
2.3 Information we receive from third parties
We may receive information about you from:
- AIOS Technology Ltd, our CQC-registered prescribing partner, for the purpose of providing you with clinical services
- Identity verification services, to confirm your identity
- Your GP or other healthcare providers, where you have consented to us contacting them or they have referred you to us
2.4 Face data
We collect two types of face data:
- Photo ID and selfie: to verify your identity before treatment, we ask you to photograph the front and back of your photo ID and take a selfie, using Persona, our identity verification provider. Persona compares your selfie to the photo on your ID to confirm it is you. We keep a copy of these images in your patient record, and Persona keeps its own copy. We do not share your face data with anyone else.
- BMI verification video: to check your BMI, our mobile app asks you to record a short video of your face and body, including a side view. While you record, the app checks on your device that your face and body are in frame and that you have turned to the side. We do not keep any face data from these checks. Only the video is uploaded, for our clinicians to review.
We store these images and videos in our systems, hosted by Amazon Web Services. Our clinicians and patient support team can view them in our clinical system.
We keep BMI videos for 8 years after your last treatment, as part of your healthcare record. We keep your photo ID and selfie for 2 years after you provide them, both in our systems and at Persona. After these periods, we delete them.
3. Special category data
Because we provide healthcare services, we process health data, and when we verify your identity, we process biometric data by comparing your selfie to your photo ID. Both are special categories of personal data under UK GDPR Article 9. We only process this data where a specific Article 9 condition is met, including:
- You have given explicit consent to the processing
- Processing is necessary for the purposes of medical diagnosis, the provision of health or social care or treatment, or the management of health systems, carried out by a health professional under a duty of confidentiality
- Processing is necessary for the establishment, exercise, or defence of legal claims
3.1 Equality, diversity, and inclusion
Bolt Pharmacy is committed to providing an equitable service that is accessible and welcoming to all patients, regardless of age, disability, gender reassignment or gender identity, marriage or civil partnership status, pregnancy or maternity, race, ethnicity, or national origin, religion or belief, sex, or sexual orientation — the nine protected characteristics under the Equality Act 2010.
We do not require you to disclose your gender, ethnicity, religion, or any other protected characteristic as a condition of receiving care, except where it is clinically necessary — for example, biological sex assigned at birth may be relevant to prescribing decisions. Where we collect this kind of information, we process it as special category data under Article 9 UK GDPR, on the same lawful basis set out above, and only for the purpose it was collected for.
For our wider equality, diversity, and inclusion commitments, see our Complaints Policy.
4. Why we use your personal data and our legal basis
We process your personal data for the following purposes:
- To provide you with clinical consultation and prescription services — lawful basis: contractual necessity and, for health data, provision of healthcare (Article 9(2)(h))
- To verify your identity before treatment, including comparing your selfie to your photo ID — lawful basis: legal obligation; for the biometric comparison, explicit consent
- To pass your information to AIOS Technology Ltd prescribers so they can assess your suitability for treatment — lawful basis: contractual necessity and healthcare provision
- To dispense and deliver prescribed medicines — lawful basis: contractual necessity
- To manage your account and respond to your enquiries — lawful basis: contractual necessity and legitimate interests
- To comply with our legal and regulatory obligations as a GPhC-registered pharmacy — lawful basis: legal obligation
- To notify you of important changes to our services — lawful basis: legitimate interests
- To send you marketing communications about our services — lawful basis: consent (you may withdraw this at any time)
- To improve our website and services through analytics — lawful basis: legitimate interests
- To detect and prevent fraud and misuse of our services — lawful basis: legitimate interests and legal obligation
5. Who we share your data with
We share your personal data only where necessary and in accordance with UK data protection law. Recipients include:
- AIOS Technology Ltd (CQC-registered prescribing service) — to conduct clinical consultations and issue prescriptions
- Aios LLC (joint controller) – to build, host, and operate our website and platform, and to provide customer service and technical support
- Bolt Pharmacy dispensing team — to dispense medicines against valid prescriptions
- Delivery providers — to deliver your medication to your home address
- Payment processors — to handle payment transactions securely
- IT and hosting providers — to operate our website and secure systems
- Your GP or NHS services — where clinically appropriate and with your consent, or where there is an overriding clinical or legal reason
- Regulatory bodies including the GPhC, CQC, MHRA, ICO, and GMC — where we have a legal obligation to disclose
- Legal and professional advisers — where necessary and subject to confidentiality obligations
We do not sell your personal data to third parties. We do not share your data with advertisers without your consent.
5.1 Joint controller arrangement with AIOS Technology Ltd
For the clinical consultation and prescribing part of your treatment, Bolt Healthcare Ltd and AIOS Technology Ltd, our CQC-registered prescribing partner, are joint controllers of your personal data, including your health data. This means both organisations jointly determine the purposes and means of processing that data for clinical assessment, prescribing, and related patient safety monitoring.
Broadly: AIOS is responsible for your clinical consultation, assessment, and prescribing records. Bolt is responsible for your dispensing, delivery, and account records. Both organisations may access the shared parts of your record where necessary for your care.
You may contact either organisation to exercise your data protection rights. As your primary point of contact, Bolt Healthcare Ltd ([email protected]) will coordinate your request with AIOS Technology Ltd where needed, in line with our internal data sharing agreement.
5.2 Joint controller arrangement with Aios LLC
For the personal data processed through our website and platform, Bolt Healthcare Ltd and Aios LLC, a member of our group, are joint controllers. This means both organisations jointly determine the purposes and means of processing that data.
Broadly: Aios LLC designs, develops, and runs the platform, is responsible for its security, and provides customer service and marketing. Bolt Healthcare Ltd is responsible for the information in this Privacy Notice and is your point of contact.
You may exercise your data protection rights against either organisation. Please use the contact details in Section 1, and Bolt Healthcare Ltd will coordinate your request with Aios LLC where needed. Aios LLC's address is 2261 Market Street #4540, San Francisco, CA 94114, United States.
6. Data retention
We retain your personal data only for as long as necessary for the purposes for which it was collected, subject to any longer retention period required by law.
- Healthcare records: minimum 8 years from the date of your last treatment, in accordance with NHS records management guidelines and applicable UK law
- Identity verification data (photo ID and selfie): 2 years from when you provide them
- Account data: for the duration of your account plus 2 years following closure
- Financial transaction records: 7 years from the date of the transaction, for tax and accounting purposes
- Marketing preferences: until you withdraw consent, or 3 years after your last interaction with us
In some circumstances we may anonymise your personal data so that it can no longer be associated with you, in which case we may retain it indefinitely for research or statistical purposes.
7. International transfers
We store and process your personal data primarily within the United Kingdom. Where data is transferred to countries outside the UK, we ensure appropriate safeguards are in place, including:
- Transfers to countries recognised by the UK government as providing adequate data protection
- Use of UK International Data Transfer Agreements (IDTAs) or Standard Contractual Clauses (SCCs) approved by the ICO
- For US-based providers, transfers only to organisations certified under the UK Extension to the EU–US Data Privacy Framework or covered by equivalent safeguards
For more information about our international transfer mechanisms, contact us at [email protected].
8. Data security
We have implemented appropriate technical and organisational measures to protect your personal data against accidental loss, unauthorised access, disclosure, alteration, or destruction. These include encryption of data in transit, access controls, and regular security reviews.
Access to your personal data is restricted to authorised personnel and third parties who have a legitimate need to access it, and only in accordance with our instructions.
We have procedures to detect, investigate, and report personal data breaches, and will notify you and the ICO where we are legally required to do so.
While we take all reasonable steps to protect your data, no internet transmission is completely secure. You are responsible for keeping your account password confidential.
9. Your rights
Under UK GDPR you have the following rights in relation to your personal data:
- Right of access: to request a copy of the personal data we hold about you
- Right to rectification: to ask us to correct inaccurate or incomplete data
- Right to erasure: to ask us to delete your data where there is no lawful reason to retain it
- Right to restrict processing: to ask us to limit how we use your data in certain circumstances
- Right to data portability: to receive your data in a structured, machine-readable format
- Right to object: to object to processing based on legitimate interests or for direct marketing
- Right to withdraw consent: where we rely on consent, to withdraw it at any time without affecting the lawfulness of prior processing
To exercise any of these rights, contact us at [email protected]. We will respond within one month. We may need to verify your identity before processing your request. There is no charge unless your request is manifestly unfounded or excessive.
10. Complaints
If you have concerns about how we handle your personal data, please contact us in the first instance at [email protected].
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO):
- Website: www.ico.org.uk
- Telephone: 0303 123 1113
- Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
11. Cookies
Our website uses cookies to distinguish you from other users and to improve your experience. Please see our Cookies Policy for full details of the cookies we use and how to manage your preferences.
12. Children
Our services are not intended for anyone under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately at [email protected] and we will take steps to delete it.
13. Third-party links
Our website may contain links to third-party websites. We are not responsible for the privacy practices of those websites and encourage you to read their privacy policies.
14. Marketing
We will only send you marketing communications where you have given your consent, or where we have a legitimate interest and you have not opted out. You can opt out at any time by clicking the unsubscribe link in any marketing email, or by contacting us at [email protected].
15. Changes to this policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or by posting a notice on our website before the change takes effect. The date of the most recent update is shown at the top of this page.
16. Regulatory information
Bolt Pharmacy is registered with the General Pharmaceutical Council (GPhC) under registration number 9013085. Superintendent Pharmacist: Phuong Nguyen (GPhC: 2204151).
Clinical services are provided by AIOS Technology Ltd, registered with the Care Quality Commission (CQC).
Bolt Healthcare Ltd is registered with the ICO under registration number ZB678271.
17. Automated tools and AI-assisted systems
We use AI-assisted systems at various points across our service — both in how patients interact with us and in how we operate internally. This section explains what those systems do, what they do not do, and your rights in relation to them.
17.1 What our AI systems do
Our AI-assisted systems are used across the following areas:
- Pre-enrolment and sales support — answering questions from prospective patients about our service, eligibility, and how to get started
- Enrolment and onboarding — guiding new patients through registration, account setup, and the initial stages of their treatment journey
- Administrative support — helping manage account updates, patient communications, and routine administrative tasks on our behalf
- Payment and subscription support — assisting with payment queries, processing support, subscription management, and order confirmations
- Ongoing patient support — providing general lifestyle and behavioural guidance during treatment, including advice on diet, exercise, and building healthy habits. Relaying and Repeating information of clinical notes on patient own system including shared clinical advice from clinicians.
- Re-engagement — reaching out to patients who have paused or lapsed from their treatment plan to offer support and information about returning to care
- Internal operations — supporting system updates, workflow management, and internal administrative processes
17.2 What our AI systems do not do
Our AI systems are not used for clinical prescribing decisions. Decisions about whether to prescribe, what medicine to prescribe, and at what dose are made exclusively by qualified prescribers operating under AIOS Technology Ltd, our CQC-registered clinical partner. Our AI systems have no role in the prescribing pathway.
17.3 How we keep you safe
- These are automated systems. Our AI systems use automated processing and may occasionally produce inaccurate or incomplete information. Our team monitors interactions to help identify and correct errors.
- Human oversight is always maintained. No decision about your clinical care, treatment, or prescribing is ever made solely by an automated system; those are always made by a qualified prescriber. Routine operational tasks (such as account updates, payment support, and order management) handled by our AI systems follow protocols designed and approved by our clinical and operational teams, and we regularly review and monitor how they perform.
- You can always speak to a person. If you are unsure about anything an AI system has communicated to you, or if you have a clinical question, contact our team at [email protected] or via the secure messaging system in your account. You may request human assistance at any time.
17.4 Third-Party AI Providers
To help provide our service, some of your personal information may be processed by trusted third-party AI providers that support our AI systems. These providers only process your data to perform these tasks on our behalf, never for their own purposes, under contractual terms requiring them to keep it secure and comply with UK GDPR and applicable data protection law.
17.5 Your rights under UK GDPR Article 22
Under UK GDPR Article 22, you have the right not to be subject to decisions based solely on automated processing where those decisions produce legal or similarly significant effects on you. No clinical decision about your treatment will ever be made solely by an automated system — a qualified prescriber will always review and take responsibility for any prescribing decision.
If you have questions about how our AI systems use your personal data, or wish to exercise your rights in this regard, contact us at [email protected].
