IPS Pharma Still Hasn’t Updated Its Privacy Policy – But Their Lawyers Had Time to Accuse Us

Since the start of September we have been taking near daily, timestamped captures of IPS Pharma’s public privacy policy. When organisations change pages after scrutiny, good, but patients deserve a record of what was shown on each day. We keep that record.

IPS Pharma’s published privacy policy still shows 25 May 2018 as the last update. In 2025, for a company handling special category health data, that is not a small miss, it is a governance problem.

What we tested, and what happened next

We checked IPS’s notice and the National Pharmacy Association’s site. At the time, the NPA’s footer links for legal policies looped users back to the homepage instead of the actual documents. We flagged it. They fixed the links promptly, credit where due.

Then their representative thanked us by alleging misrepresentation. Bold customer care strategy. If someone helps you become compliant, accusing them of misrepresentation does not strengthen your case, it only makes you look allergic to scrutiny. Meanwhile, IPS still presents a 2018 dated notice.

Representation and conduct

IPS is represented by NPA Insurance. Our pre-action correspondence and invitations to comment are on file. The NPA has not provided a substantive reply. We will keep the invitation open.

For the record: the misrepresentation allegation came from Alicia Grace Day, an SRA regulated solicitor acting via NPA Insurance. An in-depth piece on the NPA’s conduct is in preparation, with the full timeline and documents so readers can judge the facts for themselves.

Evidence log, daily captures

We maintain a local archive of IPS’s privacy page snapshots. Folders include the dates below, and more are added as needed.

• 2025-08-31
• 2025-09-03
• 2025-09-04
• 2025-09-07
• 2025-09-08
• 2025-09-09
• 2025-09-11
• 2025-09-12
• 2025-09-13
• 2025-09-16
• 2025-09-17
• 2025-09-19
• 2025-09-21

What a modern privacy notice must cover

If you handle medical data, your notice must match reality and use plain English. At minimum it should state:

• Purposes of processing and lawful bases
• Retention periods and real world deletion practices
• Processor list, data sharing, and any international transfers
• Cookies and tracking, with specific detail
• How to exercise rights, including SAR routes and working contacts

Receipts, updates, next steps

We will note improvements in plain language. If IPS publishes a current, accurate policy and fixes SAR handling, readers will see it here first. If not, we escalate through the proper channels, including the ICO and the courts where necessary.