Strictly necessary

Needed for the site to work — signing in, keeping your booking as you move through the steps, and security. These cannot be switched off.

Always on
Skip to content
De Rohan Pharmacy Book an Appointment
De Rohan Pharmacy

Privacy Policy

Last updated 26 July 2026.

This policy explains what personal information De Rohan Pharmacy collects, why we collect it, what we do with it and the rights you have over it. It applies to this website and to the services we provide at the pharmacy.

We know that health information is sensitive. We treat it that way.

Who is responsible for your information

GM Pharma Ltd, trading as De Rohan Pharmacy, is the data controller. You can reach us at:

  • 25, St. Anthony Street, Żebbuġ, ZBG 2236, Malta
  • Email: info@grimapharma.com
  • Telephone: +356 21464 128

If you have a question about how we handle your information, please contact us using any of the above and ask for the person responsible for data protection.

What we collect, and why

When you book an appointment

We collect your name, mobile number and, if you give one, your email address. Depending on the service we may also ask for your identity-card number and date of birth. We record which service you booked, with whom, and when.

Your mobile number is how we identify you: it is the key we use to find your record when you book again, so that your history stays in one place rather than scattered across duplicates.

Lawful basis: performing the contract you enter into when you book (Article 6(1)(b) UK/EU GDPR). Because the fact that you booked a particular clinical service is information about your health, we also rely on Article 9(2)(h) — the provision of health care and the management of health-care systems and services.

When you are seen at the pharmacy

Where a pharmacist or a visiting specialist records clinical notes, those notes form part of your health record. Access to them inside our system is restricted to the staff who need them for your care; other staff who can see your appointment cannot see your clinical notes.

Lawful basis: Article 6(1)(b) and Article 6(1)(c) where a professional or legal obligation applies, together with Article 9(2)(h).

When you contact us

If you send an enquiry through the website we collect your name, your contact details and whatever you choose to tell us, so that we can answer you.

Lawful basis: our legitimate interest in responding to people who contact us (Article 6(1)(f)), or taking steps at your request before entering into a contract (Article 6(1)(b)).

When you apply for a job

If you send us a CV we collect what you put in it, and we keep it while we consider your application.

Lawful basis: taking steps at your request before entering into a contract (Article 6(1)(b)) and our legitimate interest in recruiting (Article 6(1)(f)).

When you use this website

Our website sets cookies that are strictly necessary for it to work — keeping your booking as you move through the steps, and protecting the site against abuse. These do not require your consent and cannot be switched off.

We also use analytics and advertising cookies, but only if you agree. Nothing non-essential is loaded until you choose. You can change or withdraw that choice at any time using the Cookie settings link in the footer of every page — withdrawing is as easy as giving.

Lawful basis: your consent (Article 6(1)(a)).

How we measure which of our adverts work

We keep a count of how people reach us — whether from a search, an advert, a social post or by typing our address — and of how many people book, send a message or tap our telephone number. This is a count only. It records no name, no telephone number and no IP address, it does not set a cookie of its own, and nothing in it can be traced back to you.

Lawful basis: our legitimate interest in knowing whether our advertising is working (Article 6(1)(f)). We have concluded that this does not affect your privacy, because nothing personal is recorded.

Messages we send you

If you book an appointment we will send you a confirmation, and a reminder before your appointment, by email and — where you have given us a mobile number — by SMS. These are part of the service you asked for, not marketing.

If you reply STOP to one of our text messages we will stop texting you.

Who we share it with

We do not sell your information, and we do not share it for anyone else's marketing.

We share it only with:

  • The professional you are booked with, so that they can see you.
  • Our suppliers, who process information on our instructions and only for us: the company that hosts this website, the service that sends our email, and the service that sends our text messages.
  • Analytics and advertising providers, and only if you have consented to those cookies.
  • Authorities and regulators, where the law requires it of us.

Some of these suppliers may process information outside the European Economic Area. Where they do, that transfer is covered by the safeguards the GDPR requires — most commonly the European Commission's standard contractual clauses, or a finding that the country in question offers adequate protection.

How long we keep it

We keep your information for as long as we need it for the purpose we collected it, and then for as long as we are required to keep it — health records in particular are subject to retention periods set by Maltese law and by professional obligations, which can be considerably longer than you might expect.

Enquiries and job applications are kept only for as long as they are useful, and are then deleted. If you would like to know how long we hold a particular record, please ask.

How we protect it

Access to our systems requires an individual account and a second factor of authentication. Staff see only what their role requires: our front desk can manage your appointments without being able to read clinical notes. Traffic to this website is encrypted, and we keep a record of changes made to appointments.

Your rights

You have the right to:

  • Be told what we hold about you and why — which is what this policy is for.
  • Get a copy of the information we hold about you.
  • Have it corrected if it is wrong or incomplete.
  • Have it deleted, where we have no overriding reason or legal duty to keep it.
  • Restrict what we do with it while a question about it is resolved.
  • Object to our processing it on the basis of legitimate interests.
  • Receive it in a portable form, where we processed it by consent or under a contract and did so automatically.
  • Withdraw your consent at any time, where consent is what we relied on. Withdrawing does not affect anything we did lawfully before you withdrew.

To exercise any of these, contact us at info@grimapharma.com. We will respond within one month. We may need to confirm your identity first — that is to protect you, not to delay you.

Complaints

If you are unhappy with how we have handled your information, please tell us first so that we have the chance to put it right. You also have the right to complain to Malta's supervisory authority:

Information and Data Protection Commissioner (IDPC)
Floor 2, Airways House, High Street, Sliema SLM 1549, Malta
idpc.org.mt

Automated decisions

We do not make decisions about you by automated means, and we do not profile you.

Children

Where a service is provided to a child, the booking is made and the consent given by a parent or guardian.

Changes to this policy

If we change what we do with your information we will update this page, and change the date at the top. Where the change is significant we will ask for your consent again.