Legal

Privacy Policy

Last updated: 8 July 2026. This policy explains how Rhythm Health Limited ("we", "us") collects, uses and protects your personal data when you visit our website or place an order.

Who we are

Rhythm Health Limited, 12 Hatherley Road, Sidcup, England, DA14 4DT, United Kingdom. Company no. 08912028. For any privacy question or to exercise your rights, contact us at brian@rhythmhealth.co.uk.

What we collect

  • Order information — when you buy, your name, email, delivery address and order details. Card payments are handled entirely by Stripe; we never see or store your full card number.
  • Contact & newsletter — the email address you give us if you subscribe, ask for a welcome discount code, or get in touch. When you ask for a welcome code we also note how you reached the site (for example YouTube or an advert) and check whether you have ordered before, as the offer is for first orders only.
  • Technical & usage data — basic information your browser sends (IP address, device/browser type) and cookieless analytics about how you use the site (via Cloudflare Web Analytics, which sets no cookies and does not track you across sites).

How we use it, and our lawful basis

  • To process and deliver your order and provide customer support — performance of a contract.
  • To send marketing emails — only with your consent, which you can withdraw at any time.
  • To keep the site secure, working and improving — our legitimate interests.
  • To meet accounting and legal obligations — legal obligation.

Who we share it with

We do not sell your personal data. We share it only with the service providers that help us run the shop, each acting under a data-processing agreement:

  • Stripe — payment processing.
  • Resend — sending order and transactional emails.
  • Cloudflare — website hosting, content delivery and security.
  • YouTube (Google) — only if you click to play a video, which then loads from YouTube's privacy-enhanced domain.
  • Google (Google Ads) — advert measurement, with advertising cookies only if you accept them.
  • Cloudflare Web Analytics — privacy-first, cookieless website analytics. (A newsletter provider will be listed here if and when we launch a newsletter.)

International transfers

Some providers may process data outside the UK. Where they do, the transfer is covered by appropriate safeguards (such as UK-approved standard contractual clauses or an adequacy decision).

Cookies

We use Google Ads to measure how well our adverts work and to show relevant ads. Its advertising cookies are only set if you click Accept in our cookie banner. If you reject, or until you choose, Google receives only basic cookieless signals (such as that a page was viewed) and no advertising cookie is stored on your device. You can change your choice at any time with the Cookie settings link at the bottom of every page.

Our website analytics (Cloudflare Web Analytics) is cookieless and does not track you across sites. Third-party cookies from YouTube are only set if you choose to play a video. We also keep a few small preferences in your browser's local storage (your basket, your cookie choice and whether you have seen our welcome offer); these are needed for the site to work and are never shared.

How long we keep it

We keep order and transaction records for as long as needed to fulfil the order and to meet legal/accounting requirements (typically 6 years). Marketing contacts are kept until you unsubscribe. We then delete or anonymise the data.

Your rights

Under UK data-protection law you can ask us to give you access to, correct, delete, or export your data, and to restrict or object to certain uses. To exercise any of these, email brian@rhythmhealth.co.uk. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.

Security

We use encryption in transit (HTTPS), keep payment data with Stripe rather than on our own servers, and limit access to personal data. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your information.

Children

Our products and site are intended for adults. We do not knowingly collect data from children under 16.

Changes

We may update this policy from time to time. The "last updated" date above shows the latest version, and material changes will be highlighted on this page.