Privacy Policy
Last updated: 11 August 2026. This Privacy Policy is issued by Balmevo Health Ltd (company number SC394821), of 22 Princes Street, Edinburgh, EH2 2AN, trading as Balmevo ("Balmevo", "we", "us", "our"). It explains, in plain and specific terms, how we collect, use, store, share and delete personal information relating to visitors and customers of balmevo.info, and it should be read alongside our Cookie Policy, Terms of Use and Return Policy. We are the data controller for the personal information described in this document under the UK General Data Protection Regulation and the Data Protection Act 2018.
1. Scope of this document
This policy applies to personal information collected through balmevo.info, through the order form for CoQ10 200, through telephone confirmation calls placed to the number you provide, and through any written correspondence you send to [email protected] or to our registered office. It covers browsing activity captured through cookies and similar technologies, order and delivery administration, customer service enquiries, and any optional communications you choose to receive from us. It does not apply to the practices of independent couriers, payment networks used by couriers at the point of delivery, or third-party websites that we link to but do not operate. Where you interact with a third party directly, for example a courier's own tracking portal, that organisation's own privacy notice governs that interaction, and we encourage you to read it before providing further information.
2. Information we collect
When you use the order form we collect your full name, telephone number, delivery address, street address, town/city, postcode, chosen country code, and any notes you add for the courier. When we telephone you to confirm an order we may record the outcome of that call, such as confirmed, rescheduled or cancelled, together with the date and time, so that dispatch instructions are accurate. When you contact us by email or telephone for customer service we collect the content of your message, your contact details and, where relevant, your order reference. Technical information collected automatically includes your IP address, browser type and version, device type, referring page, approximate location derived from your IP address, and the pages and features of the site you use, all of which support basic security, fraud prevention and site performance measurement. We do not collect card numbers, card expiry dates or card security codes through the website, because payment on delivery is handled directly between you and the courier, not through balmevo.info.
3. Legal basis for processing
We rely on Article 6(1)(b) UK GDPR, performance of a contract or steps taken at your request before entering into one, to process your name, phone number and address in order to confirm, dispatch and deliver your CoQ10 200 order. We rely on Article 6(1)(c), compliance with a legal obligation, to retain certain order and accounting records in line with UK tax and consumer protection law. We rely on Article 6(1)(f), legitimate interests, to detect and prevent fraudulent or abusive use of the order form, to maintain the security of our systems, and to produce aggregated, non-identifying statistics about how the site is used; where we rely on legitimate interests we have considered the balance between our interests and your rights and freedoms. We rely on Article 6(1)(a), consent, for optional analytics and marketing cookies, and for any optional marketing communications, and you may withdraw that consent at any time through the Cookie Settings link in our footer or by emailing us.
4. Retention periods
Order and delivery records, including your name, address and phone number linked to a specific transaction, are retained for six years from the end of the financial year in which the order was placed, in line with HM Revenue & Customs record-keeping requirements and our obligations under the Consumer Contracts Regulations 2013. Customer service correspondence, including emails and notes from telephone calls, is retained for three years from the date the enquiry is closed, so that we can refer back to prior contact if you write to us again about the same matter. Website analytics data is retained in aggregated or pseudonymised form for no longer than fourteen months, consistent with the default retention period we apply to Google Analytics identifiers. Marketing consent records, where you have opted in, are retained for twenty-four months from your last interaction with our communications, after which we will ask you to reconfirm your preference. Where you exercise a right to erasure, we will delete or irreversibly anonymise the relevant personal information within thirty days, except where a legal retention obligation overrides that request.
5. Your rights and how to exercise them
Under UK GDPR you have the right to request access to the personal information we hold about you, to request correction of inaccurate information, to request erasure in certain circumstances, to request that we restrict processing while a query is resolved, to object to processing based on legitimate interests or direct marketing, to receive a portable copy of information you provided to us, and to withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal. To exercise any of these rights, email [email protected] with the subject line "Data Rights Request", or write to Balmevo Health Ltd, 22 Princes Street, Edinburgh, EH2 2AN, including enough detail for us to locate your records, such as your name and order reference if you have one. We will acknowledge your request within three working days and provide a substantive response within one calendar month, as required by Article 12(3) UK GDPR, extendable by a further two months for complex requests, in which case we will explain the reason for the extension.
6. Third-party processors we use
We work with a limited number of third-party organisations who process personal information on our behalf under written data processing agreements. Delivery and logistics partners, including Royal Mail Group and regional courier networks such as DPD UK and Evri, receive your name, delivery address and phone number solely to complete delivery and to contact you about a delivery attempt. Our website hosting and infrastructure is provided by Amazon Web Services EMEA SARL, which stores site data on servers located within the United Kingdom and European Economic Area. Where we use website analytics, this is provided by Google Ireland Limited under the Google Analytics service, configured with IP anonymisation enabled. Customer email correspondence is managed through a hosted business email platform operated by Microsoft Ireland Operations Limited. None of these processors are permitted to use your personal information for their own marketing purposes, and each is bound by contractual confidentiality and security obligations consistent with UK GDPR Article 28.
7. Cookies and similar technologies
We use a small number of cookies to operate the site and, with your consent, to understand how it is used. A strictly necessary session cookie, balmevo_session, keeps the order form working correctly during your visit and expires automatically when you close your browser. A preferences cookie, balmevo_consent, records your cookie choices for twelve months so that we do not ask you again on every visit. Where you consent to analytics, Google Analytics sets cookies named _ga, which persists for thirteen months, and _gid, which persists for twenty-four hours, to distinguish between visitor sessions on an aggregated basis. Where you consent to marketing cookies, a small number of third-party advertising cookies may be set for up to ninety days to measure the effectiveness of campaigns; these are never active until you actively opt in through the Cookie Settings modal. Full details, including how to change your preferences at any time, are set out in our separate Cookie Policy.
8. International transfers
Wherever possible we store and process personal information on servers located in the United Kingdom or the European Economic Area, which benefit from adequacy arrangements recognised under UK data protection law. Where a processor such as Google Ireland Limited or Amazon Web Services EMEA SARL transfers data outside the UK or EEA as part of its global infrastructure, that transfer is governed by Standard Contractual Clauses incorporating the UK International Data Transfer Addendum, together with supplementary technical and organisational safeguards such as encryption in transit and at rest. We do not sell personal information to third parties in any jurisdiction, and we do not permit processors to make onward international transfers unless equivalent safeguards are in place. If our arrangements change in a way that affects international transfers, we will update this policy and, where required by law, seek your consent before the change takes effect.
9. Complaints and how to contact us
If you have a concern about how we handle personal information, please contact us first at [email protected] or by post to Balmevo Health Ltd, 22 Princes Street, Edinburgh, EH2 2AN, so that we have the opportunity to investigate and resolve the matter directly. We aim to acknowledge every complaint within three working days and to provide a full written response within thirty calendar days, and where an investigation takes longer we will explain why and give you a revised timescale. If you remain dissatisfied with our response, or if you would prefer to raise the matter independently, you have the right to lodge a complaint with the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, telephone 0303 123 1113, or online at ico.org.uk. Raising a concern with us does not affect your right to complain to the ICO at any time, and we will not treat a complaint as affecting your ability to place future orders.
10. Changes to this policy and revision log
We review this Privacy Policy at least once a year and whenever our processing activities, suppliers or legal obligations change materially, and we will post the updated version on this page with a new "last updated" date at the top of the document. Material changes, such as a new category of processor or a change to retention periods, will also be highlighted through a notice on the homepage for at least thirty days. Version 3.0, dated 11 August 2026, clarified retention periods for order records and added named third-party processors. Version 2.1, dated 4 February 2026, updated the cookie section to reflect the introduction of the Cookie Settings modal and adjusted analytics cookie lifespans. Version 2.0, dated 9 September 2025, was the first version published following the launch of balmevo.info, and version 1.0 existed only as an internal draft prior to public launch and was never published externally.