Data Protection Policy

the UK General Data Protection Regulation ("UK GDPR"); 

the Data Protection Act 2018 ("DPA 2018"), as amended by the Data (Use and Access) Act 2025; and 

the Privacy and Electronic Communications (EC Directive) Regulations 2003 ("PECR"), as amended, which govern cookies and electronic marketing. 

Processing and delivering orders, managing accounts, handling returns and refunds – performance of a contract. 

Taking payment and preventing fraud – performance of a contract and our legitimate interests in preventing fraud and securing our business. 

Customer service and handling complaints – performance of a contract and legitimate interests. 

Accounting, tax, VAT and statutory record-keeping – legal obligation. 

Product safety notifications and recalls – legal obligation and legitimate interests (and, where necessary, protecting people's vital interests). 

Email and SMS marketing to people who have opted in – consent. 

Email marketing to existing customers about similar products – the "soft opt-in" under PECR, with a clear opportunity to refuse at the point of collection and in every message. 

Abandoned basket reminders, where we send them – consent [or soft opt-in, if you can meet its conditions; please confirm]. 

Strictly necessary cookies (basket, checkout, security, load balancing) – no consent required. 

Analytics cookies – we [use only privacy-friendly analytics that fall within the statistical purposes exemption / ask for consent before setting analytics cookies]. [Confirm which applies.] 

Advertising, retargeting and social media pixels (e.g. [Meta Pixel, Google Ads, TikTok Pixel]) – consent, collected through our cookie banner before the cookies are set. 

We do not ask customers for health information as a condition of buying from us. 

We do not use order history to build profiles that infer health conditions, and we do not target marketing on that basis. 

Where a customer volunteers health information to us (for example when asking whether a product is suitable alongside a medication, or reporting an adverse reaction), we use it only to respond, to meet our product safety obligations and, where required, to report to the relevant authorities. Our lawful basis is [explicit consent / legal obligation / vital interests as applicable], and where this is special category data we also rely on the appropriate condition under Article 9 and Schedule 1 of the DPA 2018. 

Access to customer service records containing health information is restricted to those who need it. 

Right to be informed about how we use their data. 

Right of access (a "subject access request" or SAR). 

Right to rectification of inaccurate or incomplete data. 

Right to erasure in certain circumstances. 

Right to restrict processing in certain circumstances. 

Right to data portability for data provided by the individual and processed by automated means under consent or contract. 

Right to object, including an absolute right to object to direct marketing. 

Rights relating to automated decision-making, including profiling (see Section 8). 

Right to withdraw consent at any time, as easily as it was given. 

Requests can be made in any form, to any member of staff, verbally or in writing. Anyone who receives a request must forward it to the data protection contact the same working day. 

We will acknowledge the request and respond without undue delay and within one calendar month of receipt. We may extend this by up to a further two months for complex or numerous requests and will explain why. 

We may ask for information to confirm the person's identity or to clarify what they are asking for. The response time is paused while we wait for that information and restarts once we receive it. 

When responding to a subject access request, we carry out a reasonable and proportionate search for the personal data requested. We record the searches we carried out. 

We may refuse or charge a reasonable fee for a request that is manifestly unfounded or excessive, and will explain our reasons and the person's right to complain. 

We take care to protect other people's data and any legally privileged material when preparing a response. 

We keep a log of all requests, the actions taken and the dates of response. 

Consent must be freely given, specific, informed and unambiguous, given by a clear affirmative action (no pre-ticked boxes), recorded, and as easy to withdraw as to give. 

Legitimate interests may be used only after we have documented a legitimate interests assessment covering the purpose, the necessity of the processing and a balance against the individual's rights. The Data (Use and Access) Act 2025 recognises certain purposes as pre-approved (for example, some crime prevention and safeguarding purposes); where we rely on one of these we will record it, but we will still consider whether the processing is necessary. 

Special category data (such as health information) requires both a lawful basis and an additional condition, and in many cases an appropriate policy document. We keep the processing of this data to a minimum (see Section 4.5). 

e-commerce platform and website hosting Shopify host; 

payment service providers Shopify; 

couriers and fulfilment partners e.g. Royal Mail, DPD, Evri, third-party warehouse; 

email and SMS marketing platforms Klaviyo, Mailchimp; 

customer service and helpdesk tools; 

analytics and advertising platforms; 

cloud storage, IT support and accountancy and bookkeeping providers; and 

fraud prevention and age verification providers. 

professional advisers lawyers, auditors, insurers; 

HMRC, regulators, trading standards, the Medicines and Healthcare products Regulatory Agency or other authorities where we are legally required or entitled to do so (for example, product safety or recall reporting); 

law enforcement, where permitted by law; and 

a buyer or investor in the event of a sale, merger or restructuring of the business, subject to confidentiality and with notice to affected individuals where appropriate. 

the destination is covered by UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework, where the US recipient is certified); 

we have put in place the ICO's International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses; or 

a specific exception under Article 49 applies. 

encryption of data in transit (HTTPS/TLS) across the whole website and, where supported, at rest; 

secure payment pages operated by PCI DSS compliant providers; 

role-based access controls, with access limited to what each person needs for their job, and prompt removal of access when roles change or people leave; 

strong passwords and multi-factor authentication on admin, email, e-commerce and marketing accounts; 

regular software, plug-in and platform updates and security patches; 

firewalls, anti-malware and monitoring on company devices, with full-disk encryption on laptops and phones; 

regular, tested backups held separately from live systems; 

confidentiality obligations in staff and contractor agreements; 

secure disposal of paper records and devices; and 

regular data protection and cyber security training for all staff on induction and at least annually. 

Report immediately. Anyone who discovers or suspects a breach must tell the data protection contact immediately, and in any event within 24 hours. 

Contain and assess. We will contain the incident, assess what happened, what data is involved and the likely risk to individuals. 

Notify the ICO within 72 hours of becoming aware of the breach, unless it is unlikely to result in a risk to individuals. If we cannot give full details within 72 hours, we will provide what we can and follow up. 

Notify affected individuals without undue delay where the breach is likely to result in a high risk to them, explaining what happened, the likely consequences and what we are doing about it. 

Notify others as required, for example our payment provider or bank if payment data is involved, and the NCSC or police where appropriate. 

Record and learn. We keep a log of all breaches, including those not reported, and review each one to prevent recurrence. 

We send electronic marketing only to people who have consented, or who are existing customers within the soft opt-in rules (Section 4.3). 

Every marketing message includes a clear, free and simple way to unsubscribe. Opt-outs are processed promptly and in any event within [48 hours / 5 working days]. 

We do not buy or rent marketing lists. 

We do not send marketing to anyone who is on our suppression list. 

We obtain consent for non-essential cookies and similar technologies before they are set, and provide a way to reject them as easily as to accept them. 

Health and wellness claims in our marketing comply with the UK Nutrition and Health Claims Register rules and the CAP Code. Testimonials and influencer content are properly disclosed. 

We recognise that PECR breaches can attract fines of the same scale as UK GDPR breaches (up to £17.5 million or 4% of worldwide annual turnover, whichever is higher), and we treat compliance accordingly. 

We will acknowledge the complaint within 30 days of receiving it. 

We will investigate it appropriately and without undue delay, keep the person informed of progress and tell them the outcome. 

We will record every complaint and use them to improve our processes. 

read and follow this policy and complete their training; 

handle personal data only as needed for their job and only in approved systems; 

not share customer data in personal email, personal messaging apps or unapproved tools; 

lock screens, use strong passwords and keep devices secure; 

report breaches, suspected breaches, and individuals' requests immediately; and 

ask before starting a new project, tool or supplier that involves personal data. 

a record of processing activities (an "Article 30 record") covering what data we hold, why, where it is stored, who it is shared with and how long we keep it; 

a register of suppliers and their data processing agreements; 

records of consents, legitimate interests assessments and DPIAs; 

logs of individual rights requests, complaints and breaches; 

training records; and 

evidence of our security measures.