By: The Reasonable Adjustment 29/07/2025
Over the past 10 days, The Reasonable Adjustment has been supporting a patient who encountered multiple failures while trying to access their legally prescribed medical cannabis. This case has revealed serious flaws in the UK’s current dispensing and delivery system – flaws that place the burden of risk on the patient while shielding service providers from accountability.
Option 1: IPS Pharma – Delays, Obstruction, and Possible Data Breaches
Despite a strong reputation on forums like r/ukmedicalcannabis, IPS Pharma’s handling of this patient’s prescription was deeply concerning:
- Delays in dispatching medication despite prompt payment
- Contradictory stock communication at point of payment
- Sudden enforcement of address confirmation procedures not previously required
- Failure to respect autism-related communication needs, with repeated attempts to initiate phone contact despite a request for email-only correspondence under the Equality Act 2010
- A serious data breach where the patient received another individual’s prescription email, complete with product details and a live payment link
IPS Pharma disputed that this amounted to a GDPR breach, claiming the data was not identifiable. However, the email contained a prescription reference, product list, expiry date, and payment functionality. This clearly meets the threshold for personal data under the UK GDPR and raises significant concerns around governance and safeguarding.
A Dangerous Question: What If the Patient Had Paid?
One critical question remains unanswered – what would have happened if the patient had paid?
When IPS Pharma mistakenly sent a live payment link for another individual’s prescription, it wasn’t simply a clerical error. It was a systemic failure that introduced the possibility of a legal medical cannabis patient unknowingly paying for – and potentially receiving – someone else’s Schedule 2 medication.
This was not a minor transaction. The total cost exceeded £300, covering multiple controlled products. If IPS Pharma’s system allows a live payment link to be sent in error, then the question becomes:
- If dispatch would not have occurred, why was the payment link sent without authentication?
- If dispatch could have occurred, where are the safeguards to prevent this?
Either there is no secure link between payment and patient identity, or the system lacks critical checks to prevent unlawful fulfilment. In either case, the burden of risk falls on the patient – not the provider.
In any healthcare context, especially when dispensing controlled drugs, such a scenario should not be technically possible. Yet in this case, it was. That alone warrants regulatory review, not dismissal.
Option 2: Curaleaf’s In-House Pharmacy – Courier Restrictions and Legal Grey Zones
Following the issues with IPS Pharma, the patient considered switching to Curaleaf’s in-house pharmacy. On the surface, this option avoids some of the delays seen with IPS – but it comes with an equally troubling risk.
Curaleaf uses DPD Local as its courier. However, according to DPD’s own Terms and Conditions of Carriage, the following items are explicitly prohibited:
- Personally identifiable data (including prescriptions)
- Pharmaceutical products
- Cannabidiol (CBD) products
- Liquids exceeding 100ml
- Any goods that require a licence or are subject to transportation restrictions
Medical cannabis clearly meets multiple prohibited criteria – it is a Schedule 2 controlled drug, a prescription item, and in many cases a cannabinoid-based or flower product. The use of DPD as a delivery partner may therefore violate their own operating rules.
There is no disclosure or exemption notice provided to patients. No legal protections are mentioned. If a parcel is flagged, delayed, or intercepted, it is unclear who holds liability – the courier, the pharmacy, or the patient.
For a patient with a past conviction or heightened legal scrutiny, this kind of ambiguity is not acceptable. It turns a legitimate prescription into a potential legal liability, and once again places all the risk on the individual.
Needlessly Complex – and Entirely Avoidable
The patient in question lives just 20 minutes from the prescribing clinic in Sunderland. Yet under the current system:
- The signed prescription must be posted from Sunderland to IPS Pharma in London
- The medication is then dispatched back up to Tyneside – often with delays, confusion, and courier dependence
This system is not effective, efficient, or fit for purpose. It creates risk where there should be certainty, and deflects responsibility away from those profiting from the private medical cannabis sector.
What Needs to Change
To protect patients and restore trust, we urgently need:
- In-person collection options for eligible patients near clinics
- Medical courier services with appropriate licences and indemnity cover
- Clear patient protections against courier disputes, police stops, or prescription mishandling
- Robust adherence to GDPR and the Equality Act 2010 by all service providers
Without this, patients are forced into a no-win situation – delays and governance failures with IPS Pharma, or legal grey zones with Curaleaf’s DPD partnership. Neither model currently reflects the standards expected in modern clinical care.
Next Steps
The Reasonable Adjustment is preparing formal complaints to:
- The Information Commissioner’s Office (ICO)
- The General Pharmaceutical Council (GPhC)
- Relevant equality and safeguarding bodies, where appropriate
Have You Been Affected?
If you’ve experienced similar issues with IPS Pharma, Curaleaf, or any other medical cannabis provider, we want to hear from you.
Email us confidentially at [email protected]
– The Reasonable Adjustment
Be First to Comment