Privacy Policy
This policy explains what personal data NovoVita collects, why we hold it, who else sees it and what you can require us to do with it. It is written to be read, not to be skimmed past. If anything here is unclear, ask us and we will answer plainly.
Section01
Who is responsible for your data
NovoVita Health Ltd (company number 17414187; registered office: 71-75 Shelton Street, Covent Garden, London WC2H 9JQ) is the data controller for the personal data described in this policy. We are registered with the Information Commissioner’s Office under registration number ZC229349.
Email: support@novovita.health
WhatsApp: 0044 73 8615 3082
Section02
What we collect, and why
| Data | Why we hold it | Lawful basis |
|---|---|---|
| Name, delivery address, billing address | To send your order and to keep an accurate record of what went where | Performance of a contract |
| Email address, phone number | Order confirmations, dispatch notices, answering your questions | Performance of a contract |
| Order history | Support, returns, refunds, and our accounting obligations | Contract, and legal obligation for tax records |
| Payment card details | We never see or store these. They go directly to Stripe. | — |
| Your account password | Stored only as a one-way hash. We cannot read it. | Performance of a contract |
| IP address, browser and device information | Security, fraud prevention, keeping the site working | Legitimate interests |
| Messages you send us | To answer them, and to remember the context next time | Legitimate interests |
| Marketing email address | Only if you have asked to hear from us — by ticking the research-notes box at checkout, or by signing up on our homepage and confirming the link we email you. We send occasional research notes and restock news, a few times a month at most, each with an unsubscribe link. | Consent, withdrawable at any time |
We do not collect special category data. We do not ask why you are buying a compound, what you intend to study, or anything about your health — and you should not tell us. If you send us that information unprompted we will delete it.
Section03
Who else sees your data
We share the minimum necessary with the following, and with nobody else:
- Stripe — payment processing. They receive your payment and billing details directly. We receive only a confirmation and the last four digits of the card.
- Royal Mail and other carriers — your name, delivery address and, where you have given it, a contact number for delivery notifications.
- ShipStation (Auctane) — through whom we buy Royal Mail postage for UK parcels: the same name, delivery address and, where you have given it, contact number, under their data-processing terms.
- SiteGround — our hosting provider, who store the site and its database on our behalf under a data-processing agreement.
- Our email providers, including Bird (MessageBird B.V.) — to deliver order and dispatch notifications and, only where you have asked for them, our research-notes emails on our behalf, under data-processing agreements, with processing hosted in the EU. Bird also holds the record of your consent. If you ask to be emailed when a product is back in stock, we hold that address for that single purpose only and remove it once the one notice has been sent.
- Our accountant, and HMRC — order records, as required for tax.
We do not sell your data. We do not rent it, trade it, or hand it to advertising networks or data brokers. There is no commercial arrangement anywhere in our business that involves passing your details to a third party for their own purposes.
We may disclose data where we are legally required to — a court order, or a lawful request from a regulator or law enforcement agency. If that ever happens we will tell you unless we are prohibited from doing so.
Section04
Where your data is held
Our website and database are hosted within the United Kingdom or the European Economic Area. Some of our processors — Stripe and ShipStation in particular — may transfer data outside the UK. Where they do, those transfers are covered by UK adequacy regulations or by the International Data Transfer Agreement, which requires an equivalent standard of protection.
Section05
How long we keep it
| Record | Kept for |
|---|---|
| Order and transaction records | 6 years after the end of the relevant tax year (HMRC requirement) |
| Customer account | Until you ask us to close it |
| Support messages | 2 years from the last contact |
| Marketing consent and contact details | Until you unsubscribe, then a suppression record so we do not contact you again by mistake |
| Website security logs | 12 months |
Section06
Your rights
Under the UK GDPR you have the right to:
- Be told what we hold and why — this policy, plus a copy on request.
- Get a copy of your data, normally within one month and free of charge.
- Correct anything inaccurate.
- Have it erased, where we have no overriding legal reason to keep it. Note that we cannot delete order records inside the six-year tax retention period.
- Restrict or object to processing based on legitimate interests.
- Portability — receive your data in a machine-readable form, or have it sent to another provider.
- Withdraw consent for marketing at any time, with no effect on anything else.
To exercise any of these, email support@novovita.health. We will not ask you to justify the request.
Section07
Cookies
We use the smallest set of cookies that lets a shop work:
- Strictly necessary — your basket contents, your logged-in session, and a security token that prevents cross-site request forgery. The site cannot function without these and they are not optional.
- Preference — remembering choices such as recently viewed items.
- Site statistics — if you allow it, a first-party record of how you reached the site, so we can tell which pages bring people here. Plausible, which counts the visit itself, sets no cookies at all.
Site statistics. We use Plausible Analytics to count visits and see which pages are read. It sets no cookies, stores nothing on your device, and builds no profile of you — visitors are counted using a temporary value that is destroyed every 24 hours and cannot be linked from one day to the next, or across websites. Plausible is an EU company, the data is held in the EU, and it processes it only on our instructions and never for its own purposes. It is never shared with any advertising network. If you would rather not be counted, switch Analytics off in the cookie preferences link in the footer — nothing else on the site changes.
We do not run advertising or cross-site tracking cookies, and we do not operate a remarketing pixel. You can clear or block cookies through your browser, though the basket and login will stop working if you block the necessary ones.
Section08
Keeping it secure
The site is served over TLS throughout. Passwords are stored only as salted one-way hashes. Card details never touch our server. Administrative access is limited to named accounts, and the credentials our systems use to talk to each other are held server-side and are never exposed to a browser.
If a breach ever occurs that is likely to result in a risk to your rights and freedoms, we will report it to the Information Commissioner’s Office within 72 hours and tell you directly where the risk is high.
Section09
Children
This site is not intended for anyone under 18 and we do not knowingly collect data from children. Orders may only be placed by adults purchasing on behalf of a laboratory, institution or bona fide research activity.
Section10
Complaints
If you are unhappy with how we have handled your data, please tell us first — we would rather fix it than have you escalate. If we do not resolve it to your satisfaction, you can complain to the supervisory authority:
Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
ico.org.uk/make-a-complaint
Section11
Changes to this policy
If we change this policy we will update the date at the top. Where a change materially affects how we use your data, we will tell registered customers by email rather than relying on you to notice.