RMargin Dashboard How it works Open an account About Contact

Privacy statement

Last updated: October 2026

Who we are

RxMargin is a free live market and margin dashboard for NHS dispensing practices, run by Dr Edward Muffett and Dr Mark Piper, both UK GPs. The data controller is RxMargin Ltd, registered in England and Wales, company number 17290865, and registered with the Information Commissioner's Office under registration number C1973448. Our Data Protection Officer is Dr Mark Piper. For any question about your data, email [email protected].

The live dashboard

The dashboard is free. Looking up a drug requires no account, no sign-in and no personal details, and doing so does not identify you to us in any way. The full toolkit, which includes the prescribing wins, buy signals, reports and the order optimiser, asks you to sign in with your NHS email address, and that does identify you to us.

Three things the dashboard sends us as you use it. When you look up a drug without signing in, the name you type is sent to us so that we can find its card; it is sent without any cookie and we do not keep it. When you choose a practice on the dashboard, the page tells us that practice's NHS code and nothing else: we keep a count of how often each practice is chosen, by day for 45 days and as a running total for up to 400 days after it was last chosen, with nothing about who chose it. If you report a price as wrong, the page sends us the product, the wholesaler, the form and the note you typed; we keep that report for 35 days with a scrambled form of your network address that changes every day rather than the address itself, so that we can check the price, and a copy without the address is emailed to our own inbox in a daily summary, where it stays until we delete it. Reports made before we changed this in autumn 2026 kept the network address itself, and each of those is deleted automatically 35 days after it was made. To stop bulk copying, each of these also keeps a short-lived count of requests, filed under a scrambled form of your network address that changes every day rather than the address itself, and deleted within two hours.

What we hold when you sign in

Looking up a drug still needs no account, and viewing the site that way does not identify you to us. When you sign in for the full toolkit we hold: your NHS email address, the dispensary you told us (if you did), a record of the devices you have signed in on, the date you accepted our terms, and - if you use the order optimiser's remembered matches - the match choices you save, meaning the product you picked for an order line you typed, kept so your matches follow you between devices. If your account is attached to your practice we also hold your practice's own record, described under the next heading. You can forget any saved match from the optimiser itself. We use these to run your sign-in, to send you the six-digit codes, to stop bulk extraction of the dataset, and - only if you ticked the box - to send occasional product updates. We do not sell or share any of it. Codes expire in ten minutes and are stored only as one-way hashes. If your practice has consented to its own figures appearing, your account can be attached to that practice; the attachment ends the moment the practice withdraws consent. To remove your account and its records, email [email protected] from the address you signed in with. The copies of them in our daily backups and in our own inbox are not deleted at once: we delete those by hand as part of the removal, as described under Who else handles your data. Data controller: RxMargin; data protection contact: our DPO via the same address.

Your practice's own record

If your account is attached to your practice, we keep one record for that practice, shared by the people signed in and attached there. It holds four things. The practice's name and NHS code. The email address, role and joining date of each person signed in at the practice. With these we keep who created the record, how each person joined and who set their role, and anyone removed from the practice stays in the list marked as removed. Any prescribing-wins switch that someone has marked as done, with who marked it and when, kept until someone unticks it. And the basket lines described under the RxConnect heading below: for each line that was added to a wholesaler's basket and showed a price there, the product, the quantity, the wholesaler, the price, the time, a reference for that send and the email address of the person who sent it. The dashboard shows the price your practice last paid, and which switches are done, only to people signed in and attached at your practice; we hold the record, so we can read it too. We set no time limit on it: we keep it until your practice asks us to remove it. The copies of it in our daily backups and in our own inbox are not deleted at once: we delete those by hand as part of the removal, as described under Who else handles your data. The dashboard has no button for that today, so to have your practice's record removed, email [email protected] from the address you signed in with. If your account is not attached to a practice, there is no such record.

The order optimiser

The order optimiser does its matching in your own browser, so your priced, split order comes back without waiting on us. If you are not signed in, that is the whole of it: the file is read in your browser for the length of that session, no copy is sent to us, we keep nothing and we email nothing. If you are signed in, a copy of the order pad you uploaded is sent to us and we use it to improve the matching for everyone, and if you ask for your results by email we send them to the address you typed in. When the optimiser matches your lines, the page also sends us, for each line, the product text you typed, whether it matched and what it matched to, together with the column headings of your file, and nothing about quantity, pack size or what you pay. We keep that for 180 days with no name and no practice on it, to improve the matching. A copy of the same lines is also emailed to our own inbox with the address you signed in with, so that we can ask you about a line, and it stays there until we delete it. We keep an order pad you have sent us until you ask us to delete it. Order pads should carry product, PIP code, quantity and pack size only; we screen every upload for anything that looks like patient data and quarantine it if we find any, but please do not send us a file with patient details in it. If you add your email address, and optionally your practice name, we use those only to get back to you about your results. If you were signed in when you uploaded, our own internal note about that upload records the NHS email address you signed in with, so that we can get in touch with you about a problem with your own upload; it is not stored with the upload, it is not shown to anyone else, and we use it for nothing else.

The RxConnect browser extension

RxConnect is an optional browser extension that shows your practice's own account prices from the wholesalers you connect, in the dashboard. It supports AAH, Alliance, PSUK, Trident, Clarity and Sigma. Installing it approves access to all six of those sites at once, and your browser names them in the install prompt; after that it reads nothing from a wholesaler you have not explicitly connected, and it is the extension's own list of connected wholesalers that holds the rest untouched rather than the browser. It runs entirely on your own computer. It never asks for, reads or stores your wholesaler usernames or passwords, which you type into your wholesaler's own site as you do today. It reads your account prices from your own signed-in session, keeps them in your browser's local extension storage on that machine and passes them to the dashboard page in that same browser so the page can show them. The extension itself does not send those prices to us, but the dashboard page sends us some of them in two cases. First, when you are signed in and send a basket from the dashboard, the page sends us, for each line that was added to a wholesaler's basket and showed a price there, the product, the quantity, the wholesaler, the price that basket showed, the time and a reference for that send. If your account is attached to your practice, we keep those lines in your practice's own record, described above, with the email address of the person who sent them, so that the people signed in at your practice can see what the practice last paid; we set no time limit on them and keep them until your practice asks us to remove its record. The copies of those lines in our daily backups are not deleted at once: we delete those by hand as part of that removal, as described under Who else handles your data. If your account is not attached to a practice, we refuse those lines when they arrive and keep none of them. Second, if you ask the order optimiser to email you your results, the totals in that email are worked out from your own prices where the dashboard has them, and they pass through us and our email provider on the way to you. Apart from the counts of lines sent and refused and the health switch, both described below, the extension sends no data to RxMargin at all, and it runs no other analytics and sets no tracking cookies. It does fetch two reference files of order codes from this site; when you are signed in that request carries your sign-in cookie, as every request from the dashboard does, and nothing else about you. It also reads one small status file from this site, which holds the site's refresh times and check results and nothing about you, and is used to check that the file of record ids is no older than the latest refresh; that request is made the same way, with the same cookie. As well as reading prices, it can put a line into your wholesaler's basket and take a line back out, when you ask it to from the dashboard. It can never place an order, reach a checkout, confirm, pay or submit anything: adding and removing lines are the only changes it can make at all, and you place every order yourself on the wholesaler's own site. Removing the extension deletes everything it had stored.

Counts of lines sent and refused

After you send a basket, the extension counts, for each wholesaler, how many lines it tried to put in that wholesaler's basket, how many the wholesaler took and how many it refused, and splits the refused lines by reason: the wholesaler would not accept the order code, you were signed out, the wholesaler does not list the pack, the account was at its credit limit, or any other reason. That is eight whole numbers per wholesaler, sent to us every few minutes after a send, and nothing else. From version 1.3.61, the extension sends fourteen more whole numbers per wholesaler with them - a finer split of the any-other-reason lines, and counts of what the extension found when you pressed send - and two labels: the extension's version number, and whether your browser is Chrome, Edge or another. There is no field in it for a drug, a pack, a quantity, a price, a basket, your practice, your account, a person or a time, so there is nowhere for one to be written even by accident. We add the numbers into hourly and daily totals per wholesaler, keep those totals for 14 days, and use them to spot a wholesaler that suddenly starts refusing lines, so that we can fix it before you have to tell us. The totals are not stored with your IP address. To stop abuse, this address also keeps a short-lived count of requests, filed under a scrambled form of your network address that changes every day rather than the address itself, deleted within two hours and never joined to the totals. This is on unless you switch it off: click the RxConnect icon in your browser's toolbar to open the extension's own settings page, where the exact message is shown and the switch sits beneath it. Switching it off stops the counting and deletes anything counted and not yet sent.

If you turn on the health switch

The extension has a switch, off unless you turn it on, that sends us a daily count of how the extension itself is getting on. It sends ten whole numbers per wholesaler per day, with the day they are for, the extension's version number and the number of the message format, and nothing else: how many times you connected a wholesaler; how many times an order was sent to a wholesaler; how many of those went through; how many did not; and, of those that did not, how many failed because the wholesaler had signed you out, how many because we could not find the right wholesaler tab, how many because the wholesaler had changed their order form, how many we stopped ourselves to stay a polite guest, how many failed on the wholesaler's own order or account setup, and how many failed for any other reason. There is no field in it for a drug, a pack, a quantity, a price, a basket, a practice or a person, so there is nowhere for one to be written even by accident. Turning the switch off again deletes the counts it had gathered. It is off until you turn it on. The daily counts that have reached us are kept for 45 days. Beside them, and for as long, we keep a tally of how many of these messages each version of the extension sent each day.

Getting in touch

The contact page gives you two mailto links for supplier and practice enquiries. Sending us an email shares whatever you include in it, name, practice and message, so that we can reply. We do not add you to any marketing list from an enquiry email, and we do not share or sell your details to anyone.

Cookies

Opening the dashboard to look up a drug sets one cookie, named rx_um_hint, whether or not you are signed in: a marker with a fixed value of 1 that tells the page saved matches are switched on. It carries no personal data, the page can read it, it lapses an hour after you last opened the dashboard, and it is not set at all while saved matches are switched off. Signing in sets two more: one because that is the only way your browser can remember you, and one so the page knows to offer you the way out. There is no separate practice sign-in any more. Two further cookies are each set in one case only. If you are signed in and clear the practice you had chosen on the dashboard, the page itself writes one named rx_land, with a fixed value of 0 and no personal data, so that the dashboard does not switch you back to your practice's view when it next loads; it is cleared when you choose a practice again, and otherwise lasts only for that browser session. And if we have sent your practice a private link, opening it sets one named rx_pt, which holds that link's code and lasts 90 days. Our own code sets no other cookies.

Both are strictly necessary to keep you signed in, so we do not ask for consent for them, and neither is used to follow you around the web. The sign-in cookie is set so that no script in your browser can read it; the display marker is deliberately readable by the page, which is all it is for. To clear them, delete the cookies for rxmargin.co.uk in your browser settings; you will simply be asked for a fresh code next time. To have your account and its device records removed altogether, email [email protected] from the address you signed in with. The copies of them in our daily backups and in our own inbox are not deleted at once: we delete those by hand as part of the removal, as described under Who else handles your data.

You do not have to delete cookies by hand to get out. When you are signed in the page shows you a sign-out link, and pressing it clears both of these cookies from your browser and, on our side, retires that device's record, so the sign-in cannot be picked up again. It also clears the two cookies the retired practice sign-in used to set, in case your browser is still holding them from before. One honest limit: if a copy of the sign-in cookie had been taken out of your browser beforehand, that copy can still work for up to five minutes afterwards, because signed-in pages re-check with our server every five minutes rather than on every request. The browser in your hand is signed out straight away.

The bot check

The sign-in form, the order optimiser upload and the practice digest sign-up are protected by Cloudflare Turnstile, which checks that a form is being used by a person rather than an automated script. It loads from Cloudflare only when you open one of those forms, it tells us nothing about you beyond pass or fail, and it is not advertising technology. If Cloudflare challenges your connection it may set its own short-lived cookie to record that you passed; we do not read it.

Who else handles your data

A few outside services do specific jobs for us. Cloudflare hosts the site and stores what we hold: your sign-in and device records, your saved matches, the order pads you upload and the match notes from them, your practice's own record if it has one, the price reports and the counts described on this page, and the bot check described above. Every request to this site reaches Cloudflare, which hosts it, with your network address, as a request to any web host does. Once a day we also copy the whole database behind sign-in, which includes your sign-in and device records, your saved matches, the daily request counts and your practice's own record if it has one, to a backup file on our own computer: one dated file for each day, kept in a Microsoft OneDrive folder, which OneDrive can also store on Microsoft's servers. Each morning that this backup succeeds, our code deletes the files that are more than 30 days old. Each night we also copy the same database to a second backup: a dated folder on our own computer, which is then copied to Google Drive, on Google's servers. Our code thins that second backup too. On our computer it keeps the 14 newest nights and the 8 newest Sundays and deletes the rest. On Google Drive, after a night when every part of the backup worked, it keeps the 7 newest complete nights, the 4 newest Sunday full backups and the newest full backup from each of the 3 newest months that have one, with any earlier night one of those needs in order to be restored; from each other night that uploaded completely it removes the database copy, once a newer night it is keeping holds one, and it removes nothing on a night when it cannot check what the kept backups depend on. No code deletes the emails that have reached our own inbox. When we remove an account or a practice's record we do not wait for any of that: we delete the earlier backup copies in each of those places and the inbox copies by hand, the backup copies once a backup taken after the removal exists. Resend sends our emails, so the six-digit sign-in codes, any results email you ask for and the notices this site sends to our own inbox pass through it. ntfy carries a short operational alert to us when an order pad is uploaded; that alert carries the line counts and the practice name you typed, and never the file, the filename or your email address. ntfy also carries an alert to us when one wholesaler starts refusing many of the lines sent to it; that alert carries only the wholesaler, the hour and the totals of lines sent and refused, and nothing about any practice. None of these is an advertising or analytics service, and we do not give any of them your data to use for their own purposes.

Those three, and Microsoft and Google for the backups, are the only outside parties involved at all, and beyond Cloudflare, which hosts this site and so answers every page you load here in the way any web host would, simply reading a page puts you in touch with nobody. Everything a page needs comes from this site: the type, the pictures, the styling and the scripts are all served from rxmargin.co.uk, so no other company is asked for anything, and neither Resend nor ntfy is ever told that you visited. The single exception is the bot check described above, which is fetched from Cloudflare at the moment you open one of the three forms it protects, and not before.

What we do not do

We use no analytics service, no advertising trackers and no third-party tracking scripts, on any page. The counting we do is the counting this page describes and one more: to stop bulk copying we count, for each signed-in account and device, how many data requests it makes each day, and we keep those daily counts with your sign-in record. We do not sell or share your details. The dashboard can be installed as an app on your desktop or phone; that uses your browser's own installable-app mechanism, not a cookie, and does not track you.

Your rights

You have rights under UK GDPR, including access to, correction of and erasure of your personal data. To exercise them, email [email protected]. If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk, although we would appreciate the chance to put things right first.