Privacy Policy
This policy explains what personal data Dr2U collects, why, and what rights you have over it under UK GDPR and the Data Protection Act 2018.
Who we are
[company legal name pending] (registered in England & Wales, company number [pending], registered office [registered address pending]) is the data controller for the personal data described in this policy. You can reach us at [support email pending].
What we collect
| Data | Why we collect it | Lawful basis |
|---|---|---|
| Name, email, phone, delivery/billing address | To create your account, process and deliver orders, and contact you about them | Performance of a contract |
| Order history and items purchased | To fulfil orders, handle returns, and meet our own accounting and tax obligations | Contract / legal obligation |
| Password (stored as a salted hash, never in plain text) and two-factor authentication details | To secure your account | Contract |
| Device, browser, and IP address at login | To detect and prevent fraud and account abuse | Legitimate interests |
| Cookie preferences | To respect your consent choices | Legal obligation (PECR) |
| Age confirmation for restricted products | To comply with UK medicines regulation | Legal obligation |
We never collect or store your full card details — payment is handled by our payment provider's hosted payment page, which passes card data directly to them, not through our servers.
Who we share it with
- Payment provider — to process your payment. They receive your order amount and reference, not your account password.
- Delivery couriers — your name, delivery address, and phone number, to get your order to you.
- Email delivery provider — to send order confirmations, account, and security emails.
- Cloud storage provider — product images are hosted on our behalf; this doesn't involve your personal data.
We don't sell your personal data, and we only share what each provider needs to do its job.
How long we keep it
- Account data is kept while your account is active, and deleted or anonymised if you close your account (see "Your rights" below).
- Order records are kept for at least 6 years after the order date, to meet UK tax and accounting record-keeping requirements — this applies even if you delete your account, since the order itself remains a financial record.
- Login/session security logs are kept for a limited period and then deleted automatically.
Cookies
See our Cookie Policy for details on the cookies we use and how to manage your preferences.
Your rights
Under UK GDPR you have the right to:
- Access the personal data we hold about you.
- Rectify inaccurate data.
- Erase your data ("right to be forgotten"), subject to our legal obligation to retain order/financial records.
- Restrict or object to certain processing.
- Data portability — receive your data in a structured, machine-readable format.
If you have an account, you can exercise the access and erasure rights directly: Export my data and Delete my account are available from your account settings. For any other request, or if you'd rather not use self-service, email [support email pending]. You also have the right to complain to the Information Commissioner's Office (ICO) if you think we've mishandled your data.
International transfers
Where a provider we use stores data outside the UK, we ensure appropriate safeguards are in place (such as the UK's International Data Transfer Agreement or an adequacy decision) before any transfer happens.
Children
Our products and services are intended for adults. We don't knowingly collect personal data from children.
Changes to this policy
We'll update this page if how we handle your data changes, and update the "last updated" date accordingly.
Last updated: 14 August 2026