Privacy Policy

1. Who We Are

CB1 Medical operates this website as a UK shop for CBD products, vaporizers and consumables. We are committed to protecting your privacy and handling your personal data responsibly in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Data We Collect

We may collect the following types of personal data:

• Contact information: name, email address, phone number and delivery address when you place an order or contact us.
• Payment information: payment details are processed securely by Shopify Payments. We do not store your full card details.
• Clinic enquiry data: if you submit a clinic eligibility form, we collect the health and contact details you provide.
• Technical data: IP address, browser type, device information and cookies for website functionality and analytics.

3. How We Use Your Data

We use your personal data to:

• Process and fulfil your orders, including delivery and customer service.
• Respond to your enquiries and clinic eligibility checks.
• Send transactional emails such as order confirmations and shipping updates.
• Improve our website, products and services through analytics.
• Comply with legal obligations, including tax and accounting requirements.

4. Legal Basis for Processing

We process your personal data on the basis of: (a) performance of a contract when you place an order; (b) your consent for clinic enquiries and marketing communications; (c) our legitimate interests in running and improving our business; and (d) compliance with legal obligations.

5. Data Sharing

We do not sell your personal data. We share data only with trusted third parties necessary to operate our business:

• Shopify: our e-commerce platform and payment processor.
• Delivery couriers: to dispatch your orders.
• Clinic partners: if you submit a clinic enquiry, your details are shared with the CB1 Medical clinic team for triage and booking.
• Legal and regulatory bodies: where required by law.

6. Data Retention

We keep your personal data only for as long as necessary for the purposes for which it was collected. Order records are retained for 6 years to comply with UK tax and accounting laws. Clinic enquiry data is retained for 7 years in line with medical record retention requirements. You may request deletion of your data at any time (see Section 9).

7. Cookies

Our website uses cookies to enable shopping cart functionality, remember your preferences and analyse site traffic. By using our website, you consent to our use of cookies in accordance with this policy. You can manage or disable cookies through your browser settings, though this may affect site functionality.

8. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss or destruction. All payment transactions are encrypted using SSL technology via Shopify Payments.

9. Your Rights

Under UK data protection law, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Request erasure of your data (the "right to be forgotten").
• Restrict or object to certain types of processing.
• Request a copy of your data in a portable format.
• Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, please contact us using the details on our Contact page.

10. Third-Party Links

Our website may contain links to third-party websites, including our sister clinic. We are not responsible for the privacy practices of those sites and encourage you to review their privacy policies.

11. Changes to This Policy

We may update this privacy policy from time to time. Any changes will be posted on this page with an updated effective date. We encourage you to review this policy periodically.

12. Contact Us

If you have any questions about this privacy policy or how we handle your data, please contact us via the details on our Contact page.