Last updated: 17 October 2026
Who We Are
MediWatch UK (mediwatch.co.uk) provides a free medicine shortage search for UK patients. This policy explains how we handle your information.
Information We Collect
Email Alerts
If you sign up for shortage alerts, we collect your email address and the medicines you choose to track. This information is used solely to send you relevant shortage notifications.
Accounts & Saved Searches
If you create a free account (for example by entering your email to continue using the medicine search), we collect your email address and associate the medicine searches you make while using your account with it. We use this to save your place, to send you service emails about your account (such as confirming your email or finishing an incomplete sign-up), and to understand which medicines people need — in aggregate — so we can improve shortage coverage. We do not use this information for third-party advertising, and every email we send includes an unsubscribe link. You can delete your account yourself at any time: sign in, open My account, choose the Account tab, then Delete my account. It takes effect straight away. We delete your account, your email address, the medicines you track and your email settings, and we stop emailing you. If you pay for a plan, it is cancelled at the same time and you won't be charged again; Stripe, who process our payments, keep the payment records we must hold for tax. We keep only records that no longer identify you (such as how many alerts were sent) and a one-way scrambled code made from your address, so we can't email it again by mistake. If you'd rather we did it for you, email us from your account address (see Contact below).
Cookies and analytics
We use Google Analytics, the Meta pixel and Microsoft Clarity unless you choose Essential only in the cookie banner. They run before you choose and after you press OK. Essential only turns all three off for this browser, and deletes the cookies they set on mediwatch.co.uk; our own anonymous visit count (below) carries on unless you also turn it off. You can change your choice at any time with Cookie settings, also linked at the bottom of every page.
Essential (always on)
If you sign in, a session cookie keeps you signed in. Our security checks on sign-up forms come from Cloudflare Turnstile. Cloudflare, which hosts the site, also adds its Web Analytics script to our pages: it counts page views and measures how fast pages load, without cookies or local storage. The cookie banner doesn’t switch it off. Your cookie choice, and your choice to turn off our visit count below, are saved in your browser’s local storage so we don’t ask again. Your cookie choice lasts six months.
Google Analytics (unless you choose Essential only)
Google Analytics runs on every page, including before you choose, unless you choose Essential only. It sets cookies named _ga and _ga_*. Google receives the full address and title of each page you open (medicine pages included, so it can tell which medicines you look up), the page you came from, the buttons and links you click, and the device, browser and approximate location Google works out from your connection. We use it to see how people find MediWatch and use it.
Meta pixel and Conversions API (unless you choose Essential only)
The Meta pixel also runs unless you choose Essential only, so we can measure our adverts on Facebook and Instagram. It sets a cookie named _fbp and tells Meta the pages you open, but it doesn’t load at all on medicine, guide, news or shortage pages. Our server also tells Meta when someone searches, creates an account, confirms their email address, signs up a pharmacy or starts a checkout, and, on medicine, guide, news and shortage pages (where the pixel doesn’t load), that one of those pages was viewed (Meta’s Conversions API). It sends your IP address and browser details, and, if you’re signed in, a scrambled one-way code (a hash) of your email address so Meta can match it. For those pages Meta is told only that it was one of them, never which one, and never a medicine name. We don’t send Meta the medicines you track or anything you type. After Essential only, our server sends Meta nothing about your visits. A cookie named mw_choice holds your cookie choice so our server can respect it. If you arrive from an advert or campaign link, a cookie named mw_src keeps that link’s campaign tags and ad click code until you close your browser, and if you sign up we store them with your account so we can see which adverts bring people to MediWatch. mw_src is not set after Essential only.
Microsoft Clarity (unless you choose Essential only)
Microsoft Clarity also runs unless you choose Essential only, so we can see where pages confuse people or don’t work. It records how you use each page: clicks, taps, scrolling and mouse movement, which Clarity can play back as a recording of the visit, along with the page address, your device and browser, and the approximate location Microsoft works out from your connection. Everything you type is hidden from it: search boxes, email addresses, postcodes and other form entries appear as blank boxes, and so do search results and the medicines in your account. It sets cookies named _clck and _clsk, and Microsoft may set its own (such as MUID). It doesn’t load on sign-in, email confirmation and unsubscribe pages, on My account, or on any page whose address carries a search or a code, so those never reach Microsoft. Microsoft processes this data under its privacy statement.
To stop Google Analytics, the Meta pixel and Microsoft Clarity, choose Essential only in the banner (open it again with Cookie settings). From then on none of the three loads in this browser, our server stops telling Meta about your visits, and their cookies on mediwatch.co.uk (_ga, _fbp, _clck, _clsk and similar) are deleted. Cookies Microsoft or Meta keep on their own sites are theirs to delete. The choice is kept for six months, then we ask again. You can also block cookies or trackers in your browser, or use Google’s opt-out add-on and your Meta ad settings.
Our own visit count (on unless you turn it off)
To find pages that are broken or confusing, we also count visits ourselves. This is how it works:
- Unless you press OK (so before you choose, and after Essential only), a random visit code is kept in your browser’s session storage and deleted when you close the tab. It is not a cookie, and it can’t link one visit to the next. If you press OK, we keep a longer-lasting visitor code in local storage instead, so our count can tell one visit from the next.
- We record the pages you open (medicine pages included, by their web address), how long each page was open, how far you scrolled on medicine pages, which steps of signing up, signing in and managing your alerts you reached, the country and type of device you use, and signs that something went wrong: repeated clicks on one spot, clicks that did nothing, page errors, failed requests (the error code only) and forms you started but didn’t send.
- This count never records what you type: no searches, email addresses, postcodes or other form entries. It doesn’t record your screen, your keystrokes or a fingerprint of your device. (Microsoft Clarity, above, is separate.)
- We don’t store your IP address for it. We keep a one-way code made from it with a key that changes every day and is then destroyed, so the code can’t be turned back into your address.
- What we record ourselves stays with MediWatch, on our own server and on Cloudflare, which hosts the service for us. We don’t pass it to Google, Meta or anyone else. (Google Analytics, the Meta pixel and Microsoft Clarity, above, collect their own records directly from your browser.)
How to turn it off. Essential only doesn’t turn off this anonymous count. To stop it too, use this button, or turn on Global Privacy Control or Do Not Track in your browser (these are ignored once you’ve pressed OK on the banner): . This stops our own count. It does not stop Google Analytics, the Meta pixel or Microsoft Clarity: Essential only does that.
How We Use Your Data
- To send medicine shortage alerts you've subscribed to
- To improve our service and fix issues
- To respond to your enquiries
Data Sharing
We do not sell or rent your personal data, and we share it with no one except as described under Cookies and analytics. We don’t give your email address to advertisers or marketing companies. The exception is Meta: when you’re signed in (unless you chose Essential only), and when someone buys a paid plan, Meta receives a scrambled one-way code (a hash) of the email address, so we can measure our adverts (see Cookies and analytics). It never includes the medicines you track.
Data Retention
Email alert subscriptions are retained until you unsubscribe. You can unsubscribe at any time using the link in any alert email.
Your Rights (UK GDPR)
Under UK data protection law, you have the right to:
- Access your personal data
- Correct inaccurate data
- Request deletion of your data
- Unsubscribe from communications
- Lodge a complaint with the ICO
Contact
For any data protection enquiries, email hello@mediwatch.co.uk.