Order medicines and health products online from Pharma and Allied

Security Policy

Text last revised 5 October 2026

This page says what the Pharma and Allied website itself does with your sign-in, your orders and the files you send through it, and what it will never ask you for. See also the Cookie Policy, which lists what this site keeps in your browser.

1. Check the connection

Look for the padlock in your browser's address bar before you type a password, a phone number or anything about your health. If it is not there, the connection to this website is not encrypted: do not enter anything, and tell the shop.

2. Your account

  • You sign in with your email address and password, or with a Google account where the shop has switched that on. Your password is sent only when you sign in, register or reset it. With Google, this website never sees your Google password; Google passes on your name, email address and profile picture, and the account is made from those.
  • Signing in puts an access token and a refresh token in this browser's storage, and they are what later requests carry in place of your password. Any script running on a page of this site could read them, which is one reason the site loads so few from elsewhere (the Cookie Policy lists them).
  • A password is reset through a link sent to the email address on the account.
  • Signing out removes the tokens from this browser, along with the order you last placed and your conversation with the assistant. Your basket stays. On a shared or public computer, sign out and close the tab when you are done.

3. Orders and payments

  • This website has no field for a card number, a card's security code or a mobile-money PIN. A mobile-money PIN is entered on your own phone and nowhere on this website.
  • A guest can look up an order only with its tracking number together with the phone number given at checkout. A signed-in customer sees the orders placed with their account.
  • What an order holds, and how long it is kept, is in the shop's own records and is the shop's to describe.

4. Prescriptions and uploads

  • A prescription you send is uploaded through this website to the shop's system (RegEx), together with the patient's name and the phone number or email address you give. It is not attached to an order by this website, and a product marked prescription-only cannot be added to a basket here.
  • This website keeps no copy of the file. Who at the shop can see it, and how long it is kept, is the shop's to describe.
  • What this website keeps in your browser is listed, item by item, in the Cookie Policy.

5. What this website never asks for

  • Your password, anywhere but on its own sign-in, registration and password-reset forms.
  • A card number or a mobile-money PIN: there is nowhere on this website to enter one.
  • If a message asks you for any of these in the shop's name, it did not come from this website. Do not answer it; check with the shop using the details on the Contact page.

6. Reporting a weakness

If you find a security weakness in this website — a way to see someone else's order, to act as another customer — please tell the shop privately, using the details on the Contact page, with enough detail to reproduce it and without looking at more of anyone's data than is needed to show the problem.

7. Contact