Privacy Policy

The data controller is [Company legal name] Ltd, trading as Medicare.Haus, company number [Company number], at [Registered office address], United Kingdom. We are registered with the Information Commissioner's Office under number [ICO registration number].

For any privacy question or request, contact hello@medicare.haus.

• Account data: name, email address, password (stored hashed) or Google sign-in details.
• Trade application data: clinic or business name, business type, address, phone, company and VAT numbers, professional registration body and number, qualifications, insurer, policy expiry date and insurance certificate, product interests and expected spend.
• Order and subscription data: products, quantities, delivery and billing addresses, order history and spend. Payment card data is handled directly by Shopify Payments and Stripe; we never receive full card numbers.
• Communications: emails, calls and meeting notes recorded in our client records, and your marketing preferences.
• Technical data: IP address, browser and device type, and essential cookies (see our Cookie Policy).
• Browsing on our site: products you have viewed, stored on your own device to power quick reorder.

If you sign in with Google, we receive only your name, email address and profile photo (scopes: openid, email, profile). We use them only to create your account, sign you in and run your account.

We do not sell, rent or share Google user data, use it for advertising, or use it to train AI models. Our use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. You can revoke access at any time from your Google account's permissions page.

• Creating and running your account, processing orders and subscriptions, delivery and customer service — performance of a contract.
• Verifying professional eligibility and insurance before supplying professional products — legitimate interests (safe and lawful supply) and legal obligation.
• Keeping accounting, tax, traceability and recall records — legal obligation.
• Managing our client relationship, account reviews, reorder reminders and service emails — legitimate interests in running and growing our business. You can object at any time.
• Marketing emails (newsletters, offers, training dates) — your consent, given through "Join the Haus" or a tick box. You can withdraw it at any time.
• Fraud prevention, security and enforcing our terms — legitimate interests.

Registration and insurance details are professional information, not health data. We do not ask for patient data and you must not send it to us. If you share health information about yourself, for example in an adverse event report, we process it only as required under Article 9(2)(g)/(h) UK GDPR and Schedule 1 of the Data Protection Act 2018.

We never sell personal data. We share it only with service providers acting on our instructions under data processing terms:

• Shopify (online store, checkout and order processing);
• Stripe (subscription and payment links);
• Resend (email delivery);
• our hosting and database providers;
• Google (sign-in, where you choose it);
• delivery carriers (name, address and phone, for delivery only);
• professional advisers, manufacturers (for recalls and safety notices), and regulators, the police or courts where the law requires it.

If our business is sold or restructured, data may transfer to the new owner under the same protections.

Some providers process data outside the UK, including in the EEA and the USA. Where they do, we rely on UK adequacy regulations, the UK International Data Transfer Agreement or Addendum, or the UK Extension to the EU–US Data Privacy Framework.

• Order, invoice and supply records: 6 years after the end of the financial year they relate to.
• Trade account, registration and insurance records: while the account is active, plus 6 years.
• Declined trade applications: 12 months.
• Marketing list: until you unsubscribe. We then keep a suppression record so we don't email you again.
• Client relationship notes: while we have a relationship with you, plus 3 years.
• Accounts with no activity for 3 years may be closed and deleted.

Data is encrypted in transit and at rest. Access is restricted by role to authorised staff only. Insurance certificates are kept in private storage that only you and our staff can open. Our providers maintain recognised security certifications. If a data breach is likely to put you at risk, we will tell you and the ICO as the law requires.

You have the right to:

• access your data;
• have it corrected or erased;
• restrict or object to processing, including an absolute right to object to direct marketing;
• data portability;
• withdraw consent at any time.

Email hello@medicare.haus. We reply within one month. We may need to verify your identity, and some data must be kept by law.

We send marketing only with consent. Every marketing email includes a one-click unsubscribe link. Service emails about your account, orders, trade application or insurance expiry are not marketing and will still be sent while your account is open.

We do not make decisions with legal or similarly significant effects by automated means alone. Every trade application is reviewed by a person.

Our services are for professionals only and are not directed at anyone under 18.

Please contact us first. You also have the right to complain to the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow SK9 5AF — ico.org.uk, 0303 123 1113.

We may update this policy. We will tell you about material changes by email or on the site. The version date above shows when it last changed.