Privacy Policy

This Privacy Policy is issued by Mirage Distribution Limited, a company registered in England and Wales (Company No. 07080694), trading as MDL Connect. We operate the website at mdlconnect.co.uk (the "Website").

We collect different types of information depending on how you interact with our Website. The table below summarises the key categories:

We do not collect sensitive personal data (e.g., racial or ethnic origin, political opinions, health data) unless strictly required for regulatory compliance purposes in our capacity as a licensed pharmaceutical distributor (MHRA WDA (H): 39731).

We process your personal data for the following purposes:

• Contractual necessity: Processing joining applications, managing customer accounts, order fulfilment, and delivery coordination
• Legitimate interest: Arranging requested sales visits, responding to enquiries, and improving our services
• Consent: Sending marketing communications (where you have opted in) and placing analytics cookies
• Legal obligation: Maintaining records required by pharmaceutical distribution regulations, tax law, and anti-money laundering requirements

We will never use your personal data for automated decision-making or profiling that produces legal effects concerning you.

Your data is stored securely using industry-standard encryption and access controls. We use the following measures to protect your information:

• Encryption in transit (TLS/SSL) and at rest
• Row-Level Security (RLS) ensuring data isolation between users
• Two-factor authentication for all staff accounts
• Regular security audits and vulnerability assessments
• Role-based access controls limiting data access to authorised personnel
• Automatic session timeouts and idle session management

Data is hosted on secure infrastructure within the UK and European Economic Area (EEA). We do not transfer personal data outside the UK/EEA.

We do not sell your personal data to any third party, under any circumstances. We may share limited data with the following categories of recipients, only where necessary:

• Courier partners (DHL, DPD) -- delivery name and address only, for order fulfilment
• Regulatory authorities (MHRA, GPhC) -- where legally required for pharmaceutical distribution compliance
• Payment processors -- for direct debit mandate setup and payment collection
• Email service providers -- for transactional and notification emails (name and email address only)

All third-party processors are bound by data processing agreements that comply with UK GDPR requirements.

Under UK GDPR, you have the following rights regarding your personal data:

To exercise any of these rights, please contact us using the details in Section 1. We will respond within 30 days of receiving your request.

Please note that some data may be exempt from erasure where we are legally required to retain it (e.g., pharmaceutical distribution records, financial records).

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Specific retention periods include:

• Customer account data: Duration of the business relationship plus 7 years (tax and regulatory requirements)
• Joining applications: Duration of the business relationship, or 12 months if not approved
• Visit requests: 12 months from the date of submission
• Analytics data: 90 days (automatically deleted)
• Audit logs: 7 years (regulatory compliance)

Our Website uses cookies to ensure it functions correctly and, with your consent, to collect anonymous analytics data. For full details about the cookies we use and how to manage your preferences, please see our Cookie Policy.

Our Website and services are intended for use by pharmacy professionals and businesses. We do not knowingly collect personal data from anyone under the age of 18. If you believe we have inadvertently collected such data, please contact us immediately and we will take steps to delete it.

We may update this Privacy Policy from time to time. Any material changes will be highlighted on our Website and the "Last updated" date at the top of this page will be revised. For significant changes affecting how we process your data, we will seek to notify you directly where possible.