Privacy statement

Last updated: September 2026

Who we are

RxMargin is a free live market and margin dashboard for NHS dispensing practices, run by Dr Edward Muffett and Dr Mark Piper, both UK GPs. The data controller is RxMargin Ltd, registered in England and Wales, company number 17290865, and registered with the Information Commissioner's Office under registration number C1973448. Our Data Protection Officer is Dr Mark Piper. For any question about your data, email [email protected].

The live dashboard

The dashboard is free. Looking up a drug requires no account, no sign-in and no personal details, and doing so does not identify you to us in any way. The full toolkit, which includes the prescribing wins, buy signals, reports and the order optimiser, asks you to sign in with your NHS email address, and that does identify you to us.

What we hold when you sign in

Looking up a drug still needs no account, and viewing the site that way does not identify you to us. When you sign in for the full toolkit we hold: your NHS email address, the dispensary you told us (if you did), a record of the devices you have signed in on, the date you accepted our terms, and - if you use the order optimiser's remembered matches - the match choices you save, meaning the product you picked for an order line you typed, kept so your matches follow you between devices. You can forget any saved match from the optimiser itself. We use these to run your sign-in, to send you the six-digit codes, to stop bulk extraction of the dataset, and - only if you ticked the box - to send occasional product updates. We do not sell or share any of it. Codes expire in ten minutes and are stored only as one-way hashes. If your practice has consented to its own figures appearing, your account can be attached to that practice; the attachment ends the moment the practice withdraws consent. To remove your account and its records, email [email protected] from the address you signed in with. Data controller: RxMargin; data protection contact: our DPO via the same address.

The order optimiser

The order optimiser does its matching in your own browser, so your priced, split order comes back without waiting on us. If you are not signed in, that is the whole of it: the file is read in your browser for the length of that session, no copy is sent to us, we keep nothing and we email nothing. If you are signed in, a copy of the order pad you uploaded is sent to us and we use it to improve the matching for everyone, and if you ask for your results by email we send them to the address you typed in. We keep an order pad you have sent us until you ask us to delete it. Order pads should carry product, PIP code, quantity and pack size only; we screen every upload for anything that looks like patient data and quarantine it if we find any, but please do not send us a file with patient details in it. If you add your email address, and optionally your practice name, we use those only to get back to you about your results. If you were signed in when you uploaded, our own internal note about that upload records the NHS email address you signed in with, so that we can get in touch with you about a problem with your own upload; it is not stored with the upload, it is not shown to anyone else, and we use it for nothing else.

The RxConnect browser extension

RxConnect is an optional browser extension that shows your practice's own account prices from the wholesalers you connect, in the dashboard. It supports AAH, Alliance, PSUK, Trident, Clarity and Sigma. Installing it approves access to all six of those sites at once, and your browser names them in the install prompt; after that it reads nothing from a wholesaler you have not explicitly connected, and it is the extension's own list of connected wholesalers that holds the rest untouched rather than the browser. It runs entirely on your own computer. It never asks for, reads or stores your wholesaler usernames or passwords, which you type into your wholesaler's own site as you do today. It reads your account prices from your own signed-in session and keeps them in your browser's local extension storage on that machine. Those prices are never sent to us: we do not receive them, we do not store them, and we could not produce them if you asked us to. Apart from the counts of lines sent and refused and the health switch, both described below, the extension sends no data to RxMargin at all, and it runs no other analytics and sets no tracking cookies. As well as reading prices, it can put a line into your wholesaler's basket and take a line back out, when you ask it to from the dashboard. It can never place an order, reach a checkout, confirm, pay or submit anything: adding and removing lines are the only changes it can make at all, and you place every order yourself on the wholesaler's own site. Removing the extension deletes everything it had stored.

Counts of lines sent and refused

After you send a basket, the extension counts, for each wholesaler, how many lines it tried to put in that wholesaler's basket, how many the wholesaler took and how many it refused, and splits the refused lines by reason: the wholesaler would not accept the order code, you were signed out, the wholesaler does not list the pack, the account was at its credit limit, or any other reason. That is eight whole numbers per wholesaler, sent to us every few minutes after a send, and nothing else. There is no field in it for a drug, a pack, a quantity, a price, a basket, your practice, your account, a person or a time, so there is nowhere for one to be written even by accident. We add the numbers into hourly and daily totals per wholesaler, keep those totals for 14 days, and use them to spot a wholesaler that suddenly starts refusing lines, so that we can fix it before you have to tell us. The totals are not stored with your IP address. To stop abuse, this address also keeps a short-lived count of requests, filed under a scrambled form of your network address that changes every day rather than the address itself, deleted within two hours and never joined to the totals. This is on unless you switch it off: click the RxConnect icon in your browser's toolbar to open the extension's own settings page, where the exact message is shown and the switch sits beneath it. Switching it off stops the counting and deletes anything counted and not yet sent.

If you turn on the health switch

The extension has a switch, off unless you turn it on, that sends us a daily count of how the extension itself is getting on. It sends ten whole numbers per wholesaler per day, and nothing else: how many times you connected a wholesaler; how many times an order was sent to a wholesaler; how many of those went through; how many did not; and, of those that did not, how many failed because the wholesaler had signed you out, how many because we could not find the right wholesaler tab, how many because the wholesaler had changed their order form, how many we stopped ourselves to stay a polite guest, how many failed on the wholesaler's own order or account setup, and how many failed for any other reason. There is no field in it for a drug, a pack, a quantity, a price, a basket, a practice or a person, so there is nowhere for one to be written even by accident. Turning the switch off again deletes the counts it had gathered. It is off until you turn it on.

Getting in touch

The contact page gives you two mailto links for supplier and practice enquiries. Sending us an email shares whatever you include in it, name, practice and message, so that we can reply. We do not add you to any marketing list from an enquiry email, and we do not share or sell your details to anyone.

Cookies

Looking up a drug sets no cookies. Signing in sets two: one because that is the only way your browser can remember you, and one so the page knows to offer you the way out. There is no separate practice sign-in any more, so there are no other cookies.

• The sign-in cookie, named rx_gate. Set when you enter your six-digit code. It holds your email address, an identifier for that device and a date stamp, signed so it cannot be altered. It lasts 90 days and renews while you keep using the site, so it only lapses if you stay away for 90 days. You can be signed in on five devices at once; sign in on a sixth and the device you have not used for longest is quietly signed out.
• A display marker, named rx_gate_hint. Set alongside the sign-in cookie so the page can show you the sign-out link without waiting on our server. Its value is a fixed 1, it carries no personal data, and it lapses with the sign-in cookie.

Both are strictly necessary to keep you signed in, so we do not ask for consent for them, and neither is used to follow you around the web. The sign-in cookie is set so that no script in your browser can read it; the display marker is deliberately readable by the page, which is all it is for. To clear them, delete the cookies for rxmargin.co.uk in your browser settings; you will simply be asked for a fresh code next time. To have your account and its device records removed altogether, email [email protected] from the address you signed in with.

You do not have to delete cookies by hand to get out. When you are signed in the page shows you a sign-out link, and pressing it clears both of these cookies from your browser and, on our side, retires that device's record, so the sign-in cannot be picked up again. It also clears the two cookies the retired practice sign-in used to set, in case your browser is still holding them from before. One honest limit: if a copy of the sign-in cookie had been taken out of your browser beforehand, that copy can still work for up to five minutes afterwards, because signed-in pages re-check with our server every five minutes rather than on every request. The browser in your hand is signed out straight away.

The bot check

The sign-in form, the order optimiser upload and the practice digest sign-up are protected by Cloudflare Turnstile, which checks that a form is being used by a person rather than an automated script. It loads from Cloudflare only when you open one of those forms, it tells us nothing about you beyond pass or fail, and it is not advertising technology. If Cloudflare challenges your connection it may set its own short-lived cookie to record that you passed; we do not read it.

Who else handles your data

A few outside services do specific jobs for us. Cloudflare hosts the site and stores what we hold: your sign-in and device records, the order pads you upload, and the bot check described above. Resend sends our emails, so the six-digit sign-in codes and any results email you ask for pass through it. ntfy carries a short operational alert to us when an order pad is uploaded; that alert carries the line counts and the practice name you typed, and never the file, the filename or your email address. ntfy also carries an alert to us when one wholesaler starts refusing many of the lines sent to it; that alert carries only the wholesaler, the hour and the totals of lines sent and refused, and nothing about any practice. None of these is an advertising or analytics service, and we do not give any of them your data to use for their own purposes.

Those three are the only outside parties involved at all, and beyond Cloudflare, which hosts this site and so answers every page you load here in the way any web host would, simply reading a page puts you in touch with nobody. Everything a page needs comes from this site: the type, the pictures, the styling and the scripts are all served from rxmargin.co.uk, so no other company is asked for anything, and neither Resend nor ntfy is ever told that you visited. The single exception is the bot check described above, which is fetched from Cloudflare at the moment you open one of the three forms it protects, and not before.

What we do not do

We run no analytics, no advertising trackers and no third-party tracking scripts, on any page. We do not sell or share your details. The dashboard can be installed as an app on your desktop or phone; that uses your browser's own installable-app mechanism, not a cookie, and does not track you.

Your rights

You have rights under UK GDPR, including access to, correction of and erasure of your personal data. To exercise them, email [email protected]. If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk, although we would appreciate the chance to put things right first.