Privacy Policy

1. Who we are

This Privacy Policy explains how Novum Healthcare (we, us or our) collects and uses your personal data when you use novumcare.co.uk (the Site) or place an order with us.

Novum Healthcare is a trading name of Nadoron Biotech Ltd. The formal data controller identity is [DATA CONTROLLER IDENTITY — TO BE CONFIRMED]. Company number: [COMPANY REGISTRATION NUMBER — TO BE CONFIRMED]. Registered office: [REGISTERED OFFICE ADDRESS — TO BE CONFIRMED].

ICO registration status and, if applicable, registration number: [ICO STATUS AND REGISTRATION NUMBER — TO BE CONFIRMED].

For any privacy question, or to exercise your rights, contact us at [CONTACT EMAIL — TO BE CONFIRMED].

2. The personal data we collect

When you place an order or contact us, we collect:

• Identity and contact data: your name, email address and phone number;
• Delivery data: your shipping address;
• Order data: the products you order, order value, order reference, payment method and payment status;
• Enquiry data: any information you include when you contact us;
• Technical data: IP address and limited device or browser information, including data processed by our bot-protection provider when you submit forms and, only if you accept analytics, online identifiers and usage data collected by Google Analytics.

Bank transfers are made directly by you to our account using the reference we provide; we do not receive your online-banking credentials. Bitcoin payments are sent to the public receiving address shown with your order and verified manually. We obtain the BTC/GBP market rate through a server-side Coinbase price request that does not include your order details or personal information.

3. How we use your data and our lawful basis

We do not use your data for marketing without your consent.

4. Who we share your data with

We share data only with service providers (processors) who help us run the Site and fulfil orders, and only as needed:

• Hosting and platform: [Vercel Inc. — TO BE CONFIRMED];
• Database and storage: [Supabase — region TO BE CONFIRMED];
• Transactional and consent-based marketing email delivery: Resend;
• Bot protection and security: [Cloudflare (Turnstile)];
• Optional site analytics: Google Analytics 4, provided by Google, only after you accept analytics cookies;
• Delivery: our courier or postal carrier [CARRIER — TO BE CONFIRMED], which receives your name and delivery address;
• Professional advisers and authorities: where required by law.

We do not sell your personal data.

5. International transfers

Some of our providers, including Google, may process data outside the UK. Where they do, we ensure an appropriate safeguard is in place (such as UK adequacy regulations or the International Data Transfer Agreement or Addendum). Details: [TRANSFER SAFEGUARDS / PROVIDER LOCATIONS — TO BE CONFIRMED].

6. How long we keep your data

We keep order and transaction records for six years after the end of the relevant tax year, to meet legal and accounting obligations. Enquiry data is kept for 24 months. Marketing consent records are retained while you are subscribed. If you unsubscribe, we retain the minimum email address, withdrawal and suppression evidence needed to honour that request and prevent future marketing sends. After these periods we delete or anonymise data where it is no longer required.

7. Your rights

Under UK data protection law you have the right to: access your data; have inaccurate data corrected; have data erased; restrict or object to processing; data portability; and to withdraw consent where processing relies on consent. Every marketing email contains an unsubscribe link, and signed-in customers can also change this choice in My Account. Service and order emails are separate from marketing. To exercise any right, email [email protected].

You also have the right to complain to the ICO (ico.org.uk; 0303 123 1113), though we would ask you to contact us first so that we can help.

8. Cookies and similar technologies

We use strictly necessary browser storage to make the Site work, including remembering your basket, checkout progress and cookie preference. This storage is always available because the essential shopping and payment flow cannot operate without it. Our bot-protection provider may also set strictly necessary cookies to secure form submissions.

Google Analytics 4 is optional and is off by default. If you select “Accept analytics”, Google Analytics uses cookies such as _ga and _ga_* to distinguish visits and help us understand product views, additions to the basket, checkout starts and completed purchases. We send product information, quantities, GBP values and a path-only page location. We do not send customer names, email addresses, delivery addresses, phone numbers, order numbers, confirmation tokens or other customer identifiers to Google.

Rejecting analytics does not affect the basket, checkout, Bitcoin, bank transfer, account or promotional functionality. Your choice is stored on this device and can be changed at any time using Cookie settings in the footer. Rejecting after previously accepting disables Google Analytics and removes its first-party analytics cookies where accessible.

For more information, read Google's explanation of how it uses information from sites that use its services. You may change your choice now:

9. Security

We use appropriate technical and organisational measures to protect your data, including encryption in transit, access controls and the use of reputable processors. No method of transmission over the internet is completely secure.

10. Children

The Site and our products are intended only for customers aged 18 or over. We do not knowingly collect data from anyone under 18.

11. Changes to this policy

We may update this policy from time to time. The “Last updated” date shows the latest version.

12. Contact

Novum Healthcare, [TRADING/CONTACT ADDRESS — TO BE CONFIRMED]. Email: [CONTACT EMAIL — TO BE CONFIRMED].