1. Who is responsible for your data

The controller of your personal data is the company behind DoxyPEP Shop; you find its name and address in our terms and conditions. The doctor who checks your order and the pharmacy that dispenses it are responsible for your medical record, as their professional rules require. Their names are shown to you when you order.

Questions about privacy? Email info@doxypepshop.com.

2. What data we collect

  • Contact and delivery details: name, address, email address and phone number.
  • Health information: your answers to the medical questionnaire, such as allergies, medicines you use and pregnancy.
  • Order and payment details: what you ordered and whether you paid. Payments are handled by Stripe; we never see your full card or bank details.
  • Contact history: emails you send us.
  • Sign-up for a notification: your email address, if you leave it under ‘Keep me posted’. We only use it to let you know when you can order DoxyPEP, based on your consent. The form runs through Web3Forms. After that, we delete your address. Want to be removed sooner? Email info@doxypepshop.com.

3. Why we use it, and on what legal basis

  • To handle your order and deliver it: needed to perform our agreement with you.
  • For the doctor's check and dispensing: health data is special category data. We process it only with your explicit consent, which you give in the questionnaire, and for the provision of health care.
  • To meet legal duties: such as keeping medical and tax records for the required period.
  • To answer your questions: based on our legitimate interest in helping you.

4. Who receives your data

Only parties who need it for your order: the doctor, the pharmacy, Stripe (payments), the delivery company, Vercel (website hosting), Web3Forms (the sign-up form) and our email provider. They may only use your data for that purpose. Your data is processed within the European Union and the United Kingdom, which the EU recognises as offering an adequate level of data protection. Where a provider such as Stripe or Web3Forms processes data outside these countries, this happens under the safeguards required by the GDPR.

5. How long we keep it

We do not store your order details or emails ourselves longer than needed to handle your order, except where the law requires us to keep records, such as for accounting. Your medical record is kept by the doctor and the pharmacy, for as long as their professional rules require. Payment records are kept by Stripe.

6. How we protect it

Your data travels over an encrypted connection, is stored securely and is only accessible to people who need it for your order.

7. Cookies

This website does not use tracking or advertising cookies. We only use what is technically needed for the site and the checkout to work.