This privacy policy explains how Camden Medicals (“we”, “us”, “our”) collects, uses, stores and protects your personal data when you visit camdenmedicals.co.uk or place an order with us. We are committed to protecting your privacy in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Last updated: August 2026.
1. Data Controller
Camden Medicals Limited, Unit 236, 46 Eversholt Street, London NW1 1DA. Registered in England and Wales, company number 16602982. Email: info@camdenmedicals.co.uk.
Camden Medicals Limited is registered with the Information Commissioner’s Office (ICO), registration reference ZC110890.
2. What Data We Collect
We may collect the following personal data:
- Identity data: name, company name (for trade accounts)
- Contact data: email address, telephone number, delivery and billing address
- Transaction data: order history, payment details (processed securely by our payment providers — we do not store card numbers)
- Account data: username, password (encrypted), trade account details, company registration number
- Technical data: IP address, browser type, operating system, pages visited, referring site
- Communication data: correspondence with us via email, contact forms, or phone
2.1 Health information (special category data)
Some things you tell us are special category data under Article 9 of the UK GDPR, which the law protects more strictly. This happens in three situations:
- If you use “Ask about an ingredient” on our site. You may type something about how you feel. We use it only to find reference entries for you to read, or to show you who to contact for advice. We do not store it. There is no field in our records for what you typed — not the text, not a summary, not a copy anywhere. It is used to produce the answer on your screen and then it is gone. See section 11.
- If you report a suspected side effect, by email or through a form. We keep this, because we have a legal duty as a food business to act on reports that a product we sold may be unsafe.
- If you tell us something about your health when you contact us, for example to explain a return.
Our lawful basis is your explicit consent (Article 9(2)(a)) — you choose to tell us, and we tell you at the point you do so what it will be used for. You can withdraw consent at any time; where we hold nothing, there is nothing to withdraw it from.
We never use health information for marketing, advertising, profiling, or to build any picture of you. We do not sell it, and we do not share it with advertising networks.
3. How We Use Your Data
We process your personal data on the following lawful bases:
- Contract performance: to process and fulfil your orders, manage your account, and provide customer support
- Legitimate interests: to improve our website, detect fraud, and manage our business operations
- Legal obligation: to comply with tax, accounting, and regulatory requirements
- Consent: to send marketing communications where you have opted in (you may withdraw consent at any time)
4. Cookies
Our website uses cookies to provide essential functionality (such as your shopping cart and login session) and to understand how visitors use our site. When you first visit, you will be asked to accept or manage cookie preferences. Essential cookies cannot be disabled as they are necessary for the website to function. Analytics cookies help us understand site usage and are only set with your consent.
5. Who We Share Data With
We use the following processors. Each is bound by a data processing agreement and may only act on our instructions.
| Who | What they do for us | Where |
|---|---|---|
| Cloudflare, Inc. | Website security and performance; runs the “Ask about an ingredient” service, its bot check, and the record of which safety rule fired | Global edge; the stored records are held in the European Union |
| Cloudways / DigitalOcean | Hosts and serves our website | United Kingdom |
| Stripe, PayPal | Process your payment securely | UK / EU / US |
| Task Fulfilment Ltd | Picks, packs and ships your order | United Kingdom |
| Courier partners | Deliver your order | United Kingdom |
| Email and marketing platforms | Send order confirmations and, where you have consented, marketing email | UK / EU / US |
| Online marketplaces | Where you bought from us on a marketplace rather than our own site, that marketplace processes the order | Varies by marketplace |
We also disclose data to HMRC or other regulatory bodies where required by law.
We do not sell your personal data. We do not share health information with advertising networks, and we do not use it for advertising.
6. Data Retention and International Transfers
We retain your personal data for as long as necessary to fulfil the purposes for which it was collected:
- Order data: 7 years (to comply with HMRC tax record requirements)
- Account data: for the duration of your account, plus 2 years after closure
- Marketing data: until you unsubscribe or withdraw consent
- Technical/analytics data: up to 26 months
- “Ask about an ingredient” records: 24 months. These records contain no text you typed and nothing that identifies you — see section 11
6.1 Transfers outside the UK
Some of our processors are based outside the UK, or use sub-processors that are. Where personal data is transferred outside the UK, it is protected by the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, as set out in our agreement with each processor.
The records created by “Ask about an ingredient” are stored in the European Union.
7. Your Rights
Under UK GDPR, you have the right to:
- Access your personal data (subject access request)
- Rectify inaccurate or incomplete data
- Erase your data (“right to be forgotten”) where there is no compelling reason to continue processing
- Restrict processing in certain circumstances
- Data portability — receive your data in a structured, machine-readable format
- Object to processing based on legitimate interests or for direct marketing
- Withdraw consent at any time for consent-based processing
To exercise any of these rights, please email info@camdenmedicals.co.uk. We will respond within one month.
Please note that we cannot give you a copy of, or delete, something we never kept. Questions typed into “Ask about an ingredient” are not stored, so there is nothing to retrieve or erase.
8. Security
We use SSL/TLS encryption across our entire website. Payment processing is handled by PCI-DSS compliant providers (Stripe, PayPal). Access to personal data is restricted to authorised personnel only.
8.1 Passkeys (WebAuthn sign-in)
If you choose to register a passkey for signing in to your Camden Medicals account, we store:
- A credential identifier generated by your device
- A public key generated by your device
- The name you gave the passkey (if any) and the date you added it
- A count of how many times the passkey has been used, and the date it was last used
- The AAGUID (a non-unique identifier for the type of authenticator you registered, e.g. “Apple iCloud Keychain” or “YubiKey 5”)
We do not receive or store your biometric data (fingerprint, face, PIN). That stays on your device and never leaves it.
You can view, rename, or remove any registered passkey at any time from your account’s Security section at My account → Edit account. We will send an email to the address on your account whenever a passkey is added, renamed, or removed. If you delete your account, all registered passkeys are removed.
Legal basis: legitimate interest (operating a secure sign-in service for our customers). Retention: for as long as your account is active, or until you remove the passkey.
9. Complaints
If you think we have not handled your personal data properly, you have the right to complain to us directly. Please email info@camdenmedicals.co.uk with “Data protection complaint” in the subject line, or write to us at the address in section 1. You do not need to use any particular form of words.
What we will do. We will acknowledge your complaint within 30 days of receiving it. We will then look into it and tell you the outcome without undue delay, and we will keep you updated on our progress if it takes us a while.
You can also complain to the Information Commissioner’s Office at any time, at ico.org.uk or on 0303 123 1113. You do not have to complain to us first.
10. Changes to This Policy
We may update this policy from time to time. The date at the top shows when it was last revised. Where a change materially affects how we use your data, we will tell you.
11. Automated Processing — “Ask about an ingredient”
Our site offers a feature that lets you type a question and shows you reference entries from our ingredient encyclopaedia, or tells you who to contact for advice. It is automated. No person reads what you type.
How it works, and what it is not. It follows a fixed set of written rules. It is not an AI chatbot, it does not learn from what you type, and what you type is never sent to any AI or language-model provider. It cannot diagnose you, cannot tell you what to take, and will not recommend a product in response to a health question.
What we keep. We keep one short record per question, and it contains none of your words. It records the date and time, which safety rule (if any) applied, which topic was matched, how many reference entries were shown, and a two-letter country code. It contains no name, no email, no IP address, no account, no cookie and no device identifier, and there is no field in it for the text of your question.
We keep those records to check that the safety rules are working — that a question which should show an emergency signpost does show one. Our lawful basis is our legitimate interest in operating the feature safely.
Emergencies. This feature is not a medical service and is not monitored. If you are in an emergency, call 999. For urgent advice, call NHS 111 or speak to your GP or a pharmacist. If you are struggling to cope or thinking about harming yourself, Samaritans is free on 116 123, at any time.
Automated decisions. This feature is fully automated, and it does use information about your health. It does not, however, make any significant decision about you — that is, a decision producing a legal effect concerning you or similarly significantly affecting you. It shows you reading material, or tells you who to contact. It decides nothing about your treatment, your account, your money or your rights, and it cannot refuse you anything. The rules on solely automated decision-making (Articles 22A to 22D of the UK GDPR, which replaced Article 22 on 5 February 2026) therefore do not apply to it.
You can, of course, speak to a person instead at any time — email info@camdenmedicals.co.uk. We would always rather you did that than rely on an automated tool for anything that matters.