Privacy Policy

Last updated: 1 August 2026

1. Introduction

HappyMeds respects your privacy and is committed to handling personal information lawfully, fairly, transparently and securely.

This Privacy Policy explains:

What personal information we collect.
How we collect it.
Why we use it.
The legal bases on which we rely.
Who information may be shared with.
How long information may be retained.
How we protect it.
The data-protection rights available to you.

This policy applies when you visit happymeds.uk, create an account, complete a form, submit an order, contact us, subscribe to communications or otherwise interact with the website.

2. Who Is Responsible for Your Information?

The data controller responsible for information collected directly through happymeds.uk is:

Trading name:

HappyMeds

Business contact address:

Privacy email:

help@happymeds.uk

The data controller determines how and why personal information is used.

Some third-party providers may act as separate data controllers where they independently determine how information is processed.

3. Information We May Collect

Depending on how you use the website, we may collect the following information.

Identity information:

Full name.
Date of birth.
Age confirmation.
Account username.
Identity-verification information.
Information contained in identification documents where verification is required.

Contact information:

Billing address.
Delivery address.
Email address.
Telephone number.

Account information:

Login credentials.
Account preferences.
Order history.
Account status.
Previous communications.
Security and verification records.

Order and transaction information:

Products selected.
Strengths and quantities selected.
Order value.
Payment status.
Dispatch and delivery information.
Tracking information.
Cancellation, refund and replacement records.
Previous and repeat-order information.

Payment information:

Payments may be processed by an external payment provider.

We may receive limited information including:

Transaction reference.
Payment status.
Payment method.
Card type.
Final digits or tokenised payment identifiers.
Fraud and security results.

We do not intentionally store complete payment-card information unless it is processed through an appropriately secured payment system.

Health and medicine-related information:

Where relevant to the service, information may include:

Symptoms.
Health conditions.
Current or previous medicines.
Allergies.
Relevant medical history.
Previous treatments.
Treatment preferences.
Information required to assess whether a request can be processed safely and lawfully.

Health information is special-category personal data and is subject to additional legal protection.

Technical and website-usage information:

Internet Protocol address.
Browser and device type.
Operating system.
Screen size.
Cookie identifiers.
Pages visited.
Date and time of access.
Referring website.
Click and navigation information.
Website errors.
Security and fraud-prevention signals.

Communication information:

Emails.
Contact forms.
Customer-service enquiries.
Complaints.
Reviews and feedback.
Records of communication preferences.

Marketing information:

Newsletter-subscription status.
Marketing consent.
Email engagement.
Communication preferences.

4. How We Collect Information

We may collect information:

Directly from you when you create an account, complete a form, place an order or contact us.
Automatically through cookies, website logs and similar technologies.
From payment processors.
From delivery providers.
From identity, age, address or fraud-verification services.
From service providers involved in processing your request.
From publicly available sources where legally permitted.

5. How We Use Personal Information

We may use information to:

Create and manage your account.
Process and administer an order.
Verify identity, age, address and payment information.
Review whether legal, safety or service requirements have been met.
Arrange dispatch, tracking and delivery.
Process cancellations, replacements and refunds.
Respond to enquiries and complaints.
Maintain customer-service records.
Prevent fraud, misuse and unauthorised transactions.
Detect duplicate or suspicious accounts.
Maintain website and account security.
Comply with legal, accounting, tax, safety and record-keeping obligations.
Establish, exercise or defend legal claims.
Improve website functionality and customer experience.
Analyse website performance.
Send essential service communications.
Send optional marketing communications where legally permitted.
Manage cookie and communication preferences.

We will not use personal information for an unrelated purpose without an appropriate lawful basis.

6. Lawful Bases for Processing

Depending on the activity, we may rely on one or more lawful bases.

Contract

We may process information where necessary to:

Create or manage an account.
Take steps requested by you.
Process an order.
Arrange delivery.
Manage a cancellation or refund.
Provide customer support.

Legal obligation

We may process information where necessary to comply with applicable legal, accounting, tax, safety, consumer-protection or record-keeping requirements.

Legitimate interests

We may process information where necessary for legitimate purposes such as:

Website operation.
Fraud prevention.
Service and account security.
Service improvement.
Complaint management.
Protection of legal rights.

Before relying on legitimate interests, we consider whether those interests are overridden by your rights and freedoms.

Consent

We may rely on consent for activities including:

Optional marketing.
Non-essential cookies.
Other processing where consent is the appropriate basis.

You may withdraw consent at any time. Withdrawal does not affect processing that was lawful before consent was withdrawn.

Vital interests

In exceptional circumstances, information may be processed where necessary to protect someone’s life.

7. Health and Special-Category Information

Health information is treated as special-category personal data.

Where health data is processed, we will identify:

An appropriate lawful basis under Article 6 of the UK GDPR.
An appropriate special-category condition under Article 9 of the UK GDPR.
Any relevant condition under the Data Protection Act 2018.

Depending on the actual service, this may include:

Processing necessary for health-related services by, or under the responsibility of, an appropriately qualified professional who is subject to confidentiality obligations.
Explicit consent where consent is legally appropriate.
Processing necessary to establish, exercise or defend legal claims.
Another condition permitted by applicable data-protection law.

Health information will not be used for unrelated advertising purposes.

8. Information Required to Provide the Service

Some personal information may be required to:

Create an account.
Process an order.
Verify identity or age.
Arrange payment or delivery.
Complete required safety or legal checks.

If required information is not provided, we may be unable to process the request or provide the relevant service.

9. Sharing Personal Information

We may share only the information reasonably necessary with trusted organisations involved in operating or supporting the service.

These may include:

Payment processors.
Delivery and tracking providers.
Website-hosting providers.
Website developers and technical-support providers.
Email and customer-support systems.
Identity, age, address and fraud-verification providers.
Service providers involved in reviewing, processing or fulfilling a request.
Professional advisers.
Insurers and auditors.
Government authorities.
Courts.
Regulators.
Law-enforcement organisations where disclosure is legally required.

Information may also be transferred as part of a legitimate sale, restructuring or transfer of the business or its assets, subject to appropriate safeguards.

We do not sell personal information to advertisers.

10. Service Providers

Service providers acting on our instructions must process information only for the agreed purpose and apply suitable security measures.

Where another organisation independently determines how and why information is processed, it may act as a separate controller and provide its own privacy information.

11. International Transfers

Some service providers may process information outside the United Kingdom.

Where a transfer requires legal protection, we may rely on:

A UK adequacy regulation.
The UK International Data Transfer Agreement.
An approved UK Addendum.
Appropriate contractual safeguards.
Another lawful transfer mechanism.

Additional technical and organisational protections may also be used where appropriate.

12. Data Retention

We retain personal information only for as long as reasonably necessary.

Retention periods may depend on:

The reason information was collected.
Account and order administration.
Legal and accounting obligations.
Fraud prevention.
Safety and record-keeping requirements.
Complaint and dispute periods.
The need to establish or defend legal claims.

Different categories of information may be kept for different periods.

When information is no longer required, it will be securely deleted, anonymised or otherwise disposed of.

13. Information Security

We use reasonable technical and organisational measures designed to protect information from:

Unauthorised access.
Accidental loss.
Destruction.
Alteration.
Unlawful disclosure.
Misuse.
Cyberattack.

Measures may include:

Access restrictions.
Authentication controls.
Secure hosting.
Encryption.
Monitoring.
Security updates.
Contractor and staff restrictions.
Backup and recovery procedures.

No internet-based system can be guaranteed to be completely secure.

You are responsible for protecting your account password and avoiding the use of unsafe or shared devices.

14. Cookies and Similar Technologies

The website may use cookies and similar technologies to:

Enable essential website functions.
Maintain basket or login information.
Protect website security.
Remember preferences.
Analyse website performance.
Understand how visitors use the website.
Support marketing where permission has been provided.

Strictly necessary cookies may operate without consent where permitted by law, such as cookies required to maintain a shopping basket, checkout or website security.

Non-essential analytics, preference and marketing cookies will be activated in accordance with the choices available through the cookie banner or consent tool.

You can change cookie preferences through the available consent controls or browser settings.

Restricting certain cookies may affect website functionality.

15. Analytics

Analytics providers may collect information about:

Pages visited.
Time spent on the website.
Device and browser details.
Navigation paths.
General location derived from an Internet Protocol address.
Website errors and performance.

Analytics information is used to understand and improve the website.

Where consent is required, non-essential analytics will not be activated before valid consent is obtained.

16. Marketing Communications

We may send marketing communications where you have provided valid consent or another lawful basis applies.

You can unsubscribe by:

Using the unsubscribe link in an email.
Updating available account preferences.
Contacting help@happymeds.uk.

Agreeing to marketing is not a condition of placing an order.

Unsubscribing from marketing will not stop essential communications concerning:

Your account.
An order.
Payment.
Delivery.
Security.
Customer support.
A cancellation or refund.

17. Your Data-Protection Rights

Depending on the circumstances and lawful basis used, you may have the right to:

Request access to personal information.
Request correction of inaccurate information.
Request completion of incomplete information.
Request deletion of information.
Request restriction of processing.
Object to processing based on legitimate interests.
Object to direct marketing.
Request transfer of eligible information.
Withdraw consent.
Request information about automated decision-making.
Complain to the Information Commissioner’s Office.

These rights are subject to legal conditions and exceptions.

We may request reasonable evidence of identity before responding.

18. Right to Object

You have the right to object at any time to the use of your personal information for direct marketing.

You may also object to processing based on legitimate interests. We will consider the objection and stop processing unless there are compelling legitimate grounds or the information is required for legal claims.

19. Automated Processing

Automated systems may be used to identify:

Suspicious transactions.
Duplicate accounts.
Unusual ordering patterns.
Potential fraud.
Website and account security threats.

We do not normally make a decision producing a legal or similarly significant effect based solely on automated processing unless this is lawful and appropriate safeguards are available.

20. Children

The ordering service is intended for adults aged 18 and over.

We do not knowingly accept orders from children.

Where we reasonably believe that an account or order belongs to a person under 18, we may:

Restrict the account.
Cancel the order.
Request age verification.
Delete information where legally permitted.

21. Third-Party Links

The website may contain links to external websites.

Independent websites operate under their own privacy policies. HappyMeds is not responsible for the privacy or security practices of external websites.

22. Personal-Data Breaches

Where a personal-data breach occurs, we will investigate and take appropriate steps.

Where required by law, we may notify:

The Information Commissioner’s Office.
Affected individuals.
Other relevant organisations.

23. Complaints

Privacy concerns should first be sent to:

Email: help@happymeds.uk

Please provide sufficient information to help identify the relevant account, order or communication.

Do not send complete payment-card details by email.

You also have the right to complain to the Information Commissioner’s Office.

24. Changes to This Policy

We may update this Privacy Policy to reflect changes in:

Law.
Website technology.
Services.
Data-processing practices.
Security requirements.

The latest version will be published on this page with its revision date.

25. Contact

For privacy enquiries or data-rights requests, contact: