Last updated: 28 August 2026
Our Core Commitment
We collect: (a) Account information — name, email address, phone number, and role. (b) GP Practice details — practice name, address, and contact information. (c) Pharmacist profile — GPhC number, qualifications, insurance details, and compliance documents. (d) Shift information — workstream, date, time, location (city/region), and workload description. We do NOT collect, store, or process any patient data whatsoever.
Your data is used solely to operate the WorkFlow platform — including matching GP Practices with available Pharmacists, verifying Pharmacist compliance, sending in-app notifications, and managing subscriptions. We do not sell your data to third parties.
Documents uploaded by Pharmacists (GPhC registration, insurance certificates, right-to-work documents) are stored securely and accessible only to the Pharmacist who uploaded them and WorkFlow Administrators. GP Practices cannot access compliance documents.
When a Pharmacist accepts a shift, their contact details are shared with the relevant GP Practice, and the GP Practice's contact details are shared with the Pharmacist. This is necessary to allow the parties to communicate directly. No other data sharing occurs without your consent.
Account data is retained as long as your account is active. Upon account deletion, your personal data will be deleted within 30 days, except where retention is required by law.
Under UK GDPR, you have the right to: access your personal data, correct inaccurate data, request deletion of your data, object to processing, and data portability. To exercise these rights, please contact us via your account settings.
WorkFlow uses essential cookies only — for authentication and session management. We do not use advertising cookies or third-party tracking cookies.
We implement industry-standard security measures including encrypted data transmission (HTTPS), secure file storage, and access controls. However, no system is 100% secure, and you should use strong passwords and keep your credentials private.