Privacy Policy

Last updated: 8 July 2026. This policy explains how Rhythm Health Limited ("we", "us") collects, uses and protects your personal data when you visit our website or place an order.

Who we are

Rhythm Health Limited, 12 Hatherley Road, Sidcup, England, DA14 4DT, United Kingdom. Company no. 08912028. For any privacy question or to exercise your rights, contact us at brian@rhythmhealth.co.uk.

What we collect

• Order information — when you buy, your name, email, delivery address and order details. Card payments are handled entirely by Stripe; we never see or store your full card number.
• Contact & newsletter — the email address you give us if you subscribe or get in touch.
• Technical & usage data — basic information your browser sends (IP address, device/browser type) and cookieless analytics about how you use the site (via Cloudflare Web Analytics, which sets no cookies and does not track you across sites).

How we use it, and our lawful basis

• To process and deliver your order and provide customer support — performance of a contract.
• To send marketing emails — only with your consent, which you can withdraw at any time.
• To keep the site secure, working and improving — our legitimate interests.
• To meet accounting and legal obligations — legal obligation.

Who we share it with

We do not sell your personal data. We share it only with the service providers that help us run the shop, each acting under a data-processing agreement:

• Stripe — payment processing.
• Resend — sending order and transactional emails.
• Cloudflare — website hosting, content delivery and security.
• YouTube (Google) — only if you click to play a video, which then loads from YouTube's privacy-enhanced domain.
• Cloudflare Web Analytics — privacy-first, cookieless website analytics. (A newsletter provider will be listed here if and when we launch a newsletter.)

International transfers

Some providers may process data outside the UK. Where they do, the transfer is covered by appropriate safeguards (such as UK-approved standard contractual clauses or an adequacy decision).

Cookies

The site sets no non-essential or advertising cookies. Our website analytics (Cloudflare Web Analytics) is cookieless and does not track you across sites, so no consent banner is required. Third-party cookies (for example from YouTube) are only set if you actively choose to load that content. If we ever add cookie-based analytics or marketing tools (such as Google Analytics), we will ask for your consent first via a cookie banner.

How long we keep it

We keep order and transaction records for as long as needed to fulfil the order and to meet legal/accounting requirements (typically 6 years). Marketing contacts are kept until you unsubscribe. We then delete or anonymise the data.

Your rights

Under UK data-protection law you can ask us to give you access to, correct, delete, or export your data, and to restrict or object to certain uses. To exercise any of these, email brian@rhythmhealth.co.uk. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.

Security

We use encryption in transit (HTTPS), keep payment data with Stripe rather than on our own servers, and limit access to personal data. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your information.

Children

Our products and site are intended for adults. We do not knowingly collect data from children under 16.

Changes

We may update this policy from time to time. The "last updated" date above shows the latest version, and material changes will be highlighted on this page.