Privacy Policy

Information you give us: name, email address, delivery address, billing address and telephone number; account login details if you create an account; order history including what you bought, when and for how much; anything you write to us by email, contact form or messaging app.

Information we collect automatically: IP address, browser type, device type, operating system and approximate location derived from your IP; pages you visited, what you clicked, how you moved through the site and how long you stayed; cookies and similar technologies set by us and by the third parties listed below.

Information we never hold: card numbers. We do not accept card payments and do not store card details. Bank login credentials are entered with your own bank, never on this site.

We rely on the lawful bases set out in Article 6 of the UK GDPR. Each use of your information is matched to a basis below:

• Take and fulfil your order, arrange delivery and handle order queries: performance of a contract with you.
• Send order confirmations, dispatch notices and other service messages: performance of a contract with you.
• Keep records of sales for accounting and tax: legal obligation.
• Prevent and investigate fraud, misuse and abuse of the site: legitimate interests, being the protection of our business and our customers.
• Measure how the site is used and improve it, including analytics: consent.
• Send marketing emails about products and offers: consent, which you can withdraw at any time.

Where we rely on consent, you can withdraw it at any time. Withdrawing consent does not affect anything we did lawfully before you withdrew it.

Payments are processed by our payment provider using open banking, which means you are redirected to your own bank to approve the payment. Your banking credentials are entered with your bank, not with us, and we never see or store them.

Our payment provider receives your name, the amount and a reference for the transaction, and processes that information as its own controller under its own privacy policy. What comes back to us is confirmation that a payment succeeded or failed, and a transaction reference.

We do not sell your personal information, and we do not share it for anyone else's marketing. We share it only with the suppliers who make the shop work, and only with what they need: our payment provider; delivery carriers (who receive your name, delivery address and, where the service needs it, your email or phone number for delivery notifications); our email provider; our hosting and infrastructure providers; and our accountant and professional advisers where they need records to do their work. Where web analytics is enabled and you have consented, Google also receives the analytics data described in the next section.

We will also disclose information where the law requires it, or to establish, exercise or defend legal claims.

Some cookies are strictly necessary. They keep you logged in, remember what is in your basket and let checkout work. The site cannot function without them.

Beyond those, we use Google Analytics when you consent to it, to measure how many people visit, which pages they land on and where they come from. The analytics script loads only after you accept analytics cookies in our consent banner and only while analytics is enabled on the site; until both are true, no analytics script runs and no analytics network calls are made. We do not use session recording or replay tools such as Microsoft Clarity, and we do not capture mouse movement, scrolling or recordings of your browsing. You can block or delete cookies in your browser settings, and you can opt out of Google Analytics using Google's browser add-on.

Our website and database are hosted in Europe. Some of the suppliers listed above, including Google, are based outside the UK or may process information outside it. Where information is transferred outside the UK, it is protected by the safeguards UK data protection law requires, which in practice means the UK International Data Transfer Agreement or an adequacy decision covering the country concerned.

• Order and transaction records: six years from the end of the financial year they fall in, because tax law requires it.
• Account details: for as long as your account is open, and for six years after your last order.
• Marketing consent and email history: until you unsubscribe, and for a short period after that so we can prove you were removed.
• Support correspondence: two years from the last message in the conversation.
• Analytics data: for the retention period set by the tool, currently up to 26 months for Google Analytics.

Under the UK GDPR and the Data Protection Act 2018 you have the right to:

• Ask what personal information we hold about you and get a copy of it.
• Have inaccurate information corrected.
• Ask us to delete information, where we have no continuing reason to keep it.
• Ask us to restrict how we use it while a question about it is resolved.
• Object to us using it on the basis of legitimate interests.
• Ask for a portable copy of information you gave us.
• Withdraw consent at any time, where we relied on consent.
• Opt out of marketing at any time, using the unsubscribe link in any marketing email or by emailing us.

To exercise any of these, email support@corehealthgb.cc. We will respond within one month. There is no charge unless a request is manifestly unfounded or excessive. If you are unhappy with how we have handled your information, you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113. We would rather you came to us first so we can put it right.

The site runs over an encrypted connection, sits behind a security and filtering layer, and access to the order system is limited to the people who need it. No system is perfectly secure, but if a breach occurs that is likely to put your rights at risk, we will tell you and the Information Commissioner's Office within the time limits the law sets.

This site is not intended for anyone under 18 and we do not knowingly collect information about children. If you believe a child has given us personal information, email us and we will delete it.

If we change this policy we will update the date shown above, and where the change is significant we will say so on the site.