Cannabis-based medicinal products

by | Jan 26, 2026 | Library

Cannabis-based medicinal products: what CQC expects from providers

3 July 2024

  1. What CQC expects from providers
  2. Registration with CQC
  3. What we look at when we register and inspect
  1. Remote online prescribing of cannabis-based medicinal products
  2. Cannabidiol (CBD) ‘oil’ products
  3. Further guidance and information

Cannabis-based medicinal products were classed as controlled drugs under the Misuse of Drugs Regulations 2001 from 1 November 2018. This means they are available on prescription.

Most of the products are unlicensed medicines in the UK, apart from some products with a marketing authorisation, which are licensed for certain conditions.

Although many medicines prescribed in the NHS are unlicensed, particularly those prescribed for children, treating patients with unlicensed medicines poses a higher risk than with a licensed medicine as they may not have been assessed for safety, quality, and efficacy.

The prescribing restrictions in the Misuse of Drugs Regulations ensure that patients with clinical needs that can’t be met by licensed medicines have access to these medicines, while also minimising the risks of misuse, harm, and diversion:

  • Cannabis-based products for medicinal use (CBPMs) can only be prescribed by or under the direction of a specialist doctor (via a shared care agreement) who must have specialist knowledge and expertise.
  • They must also be on the specialist register of the General Medical Council.
  • Licensed products can be prescribed by any practitioner with the authority to do so under the 2001 Regulations.
Powered by  GDPR Cookie Compliance
Privacy Overview

Privacy Overview

Introduction

This privacy overview explains how our website, [Your Website Name], collects, uses, and protects your personal data in accordance with the General Data Protection Regulation (GDPR). We are committed to safeguarding your privacy and ensuring the security of your information.

What is the GDPR?

The GDPR is a European data protection law that gives individuals more control over their personal data. It applies to all organizations that process the personal data of EU residents, regardless of where the organization is located.

Data We Collect

We only collect data that is necessary for the purposes for which it is collected. The types of data we may collect include:

  • Contact Information: Name, email address, phone number, and postal address when you fill out a form or sign up for a newsletter.
  • Technical Data: IP address, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access this website. We collect this data through cookies and similar technologies.
  • Usage Data: Information about how you use our website, products, and services.

How We Use Your Data

We use your data for the following purposes:

  • To provide you with the services you have requested, such as a newsletter or a product purchase.
  • To improve our website and services.
  • To communicate with you about your account or our services.
  • To comply with legal obligations.
  • With your consent, to send you marketing communications.

Legal Basis for Processing

We will only process your personal data where we have a lawful basis to do so, which may include:

  • Consent: You have given us clear consent to process your personal data for a specific purpose.
  • Contract: The processing is necessary for a contract we have with you.
  • Legal Obligation: The processing is necessary for us to comply with the law.
  • Legitimate Interests: The processing is necessary for our legitimate interests or those of a third party, provided your fundamental rights are not overridden.

Your Rights

Under the GDPR, you have the following rights regarding your personal data:

  • Right to be Informed: The right to be informed about how we collect and use your data.
  • Right of Access: The right to request a copy of the data we hold about you.
  • Right to Rectification: The right to correct any inaccurate or incomplete data we hold about you.
  • Right to Erasure ('Right to be Forgotten'): The right to request the deletion of your personal data in certain circumstances.
  • Right to Restrict Processing: The right to restrict the processing of your data in certain situations.
  • Right to Data Portability: The right to obtain and reuse your personal data for your own purposes across different services.
  • Right to Object: The right to object to the processing of your data in certain circumstances.
  • Rights related to automated decision-making and profiling: The right not to be subject to a decision based solely on automated processing.