Privacy Policy

UKMEDI Privacy Policy

Effective date: 7 August 2026
Last updated: 7 August 2026

1. Who we are

UKMEDI is a trading name of GG & BB Limited, a company registered in England and Wales under company number 11673847.

Registered office:
12–14 Diamond Road
Norwich
Norfolk
NR6 6AW
United Kingdom

Email: [email protected]
Telephone: 01603 336056

GG & BB Limited is the data controller responsible for the personal information described in this Privacy Policy.

This policy explains how we collect, use, disclose and protect personal information when you visit UKMEDI, create an account, place an order, contact us or otherwise interact with us.

2. Where we offer our services

UKMEDI is operated from the United Kingdom and accepts orders only for destinations supported by our checkout.

We do not accept orders for delivery to the United States of America or its territories. US delivery addresses are blocked at checkout.

Our website may still be technically accessible from the United States or other countries to which we do not deliver. Access to the website from a country does not mean that UKMEDI offers or solicits goods or services in that country.

Website privacy and cookie controls still apply to visitors regardless of whether they are able to place an order.

3. Personal information we collect

Depending on how you interact with us, we may collect:

Identity and contact information

This may include:

name;
email address;
telephone number;
billing and delivery address;
company or organisation name; and
account details.

Order and transaction information

This may include:

products ordered;
quantities;
prices;
order number;
returns and refunds;
delivery method;
transaction status; and
payment method.

Payment card details are generally handled directly by our payment providers. We do not need to receive or store your complete payment-card number in order to process an ordinary online order.

Communications

We may retain communications you send to us, including:

customer-service enquiries;
returns or complaints;
product questions;
delivery enquiries; and
other correspondence.

Website and device information

When you use our website, we and our technology providers may collect information such as:

IP address and approximate location;
browser and operating system;
device type and screen information;
language;
referral source;
pages and products viewed;
searches;
products added to or removed from a basket;
checkout and conversion events;
timestamps;
cookie and similar identifiers;
pseudonymous client or session identifiers;
campaign and attribution identifiers; and
information about how the website performs.

Where analytics or measurement technologies are enabled with the required consent, this can include the specific product pages or products that a browser views, adds to a basket or purchases.

4. Medical and health information

UKMEDI sells medical, healthcare, veterinary and related products. However, we are a retailer and do not require customers to provide medical records, diagnoses, prescriptions or treatment histories in order to purchase ordinary products from us.

The fact that somebody views or buys a particular product does not necessarily tell us why they are buying it, who it will be used by, or whether anybody has a particular health condition.

We do not diagnose customers or classify somebody as having a health condition merely because they view or purchase a particular product.

Some product browsing or purchase information could nevertheless relate to products commonly used for medical or healthcare purposes. We therefore treat such information with appropriate care and do not require customers to provide unnecessary clinical information.

Please do not send us medical records, diagnoses or other sensitive health information unless it is genuinely necessary for a specific enquiry and we have asked you to provide it.

5. How we use personal information and our lawful bases

We use personal information only where we have an appropriate legal basis.

Purpose	Main lawful basis
Taking and fulfilling orders	Performance of a contract
Processing payments	Performance of a contract
Delivering orders and dealing with returns	Performance of a contract
Managing customer accounts	Performance of a contract / legitimate interests
Customer service	Performance of a contract / legitimate interests
Accounting, VAT and tax records	Legal obligation
Detecting fraud, misuse and security threats	Legitimate interests / legal obligation where applicable
Protecting and enforcing our legal rights	Legitimate interests
Improving our website and services	Legitimate interests, or consent where tracking technologies require it
Non-essential analytics and measurement	Consent where required
Advertising and marketing tracking	Consent where required
Email and SMS marketing	Consent or the permitted existing-customer exemption where applicable
Responding to regulators, courts or law enforcement	Legal obligation / legitimate interests
Establishing, exercising or defending legal claims	Legitimate interests and other applicable legal bases

Where we rely on legitimate interests, we consider whether our interests are proportionate and whether your rights and interests override them.

6. Cookies, pixels and similar technologies

We use cookies and other storage or access technologies on the website.

These can include:

cookies;
pixels;
tags;
scripts;
local storage;
browser identifiers; and
similar technologies.

We use Consentmo to provide our cookie controls and record your preferences.

Non-essential technologies are used in accordance with the choices you make through our cookie controls.

You can find more information in our Cookie Policy and can change your choices through the Cookie Preferences control on our website.

7. Analytics, attribution and advertising

Subject to your cookie choices, we may use third-party services to understand website use, measure advertising and sales performance, attribute visits and orders, and improve the website.

Depending on the service, information processed can include:

page URLs and titles;
products viewed;
products added to a basket;
order and conversion events;
product IDs, SKUs, quantities and prices;
order or customer identifiers;
pseudonymous browser or client identifiers;
referral and campaign information;
device and browser information;
approximate location; and
advertising or analytics identifiers.

For example, we use RankTail for AI-search and conversion attribution. Where enabled, RankTail may receive ecommerce analytics events relating to pages and products viewed, products added to a basket and completed-order attribution, together with pseudonymous identifiers and browser/device information.

We may also use services provided by organisations such as Google, Microsoft and Meta, and analytics or ecommerce measurement providers, where enabled and subject to the applicable consent requirements.

The providers currently active on the website and the relevant cookie categories are available through our Cookie Preferences controls.

8. Marketing communications

We may send marketing emails or similar communications where:

you have consented; or
applicable law permits us to contact an existing customer about similar products or services and we gave you an opportunity to opt out when collecting the details.

Every electronic marketing message will include a straightforward way to unsubscribe.

You can also contact [email protected] to ask us to stop sending marketing communications.

Stopping marketing does not stop necessary service communications relating to an order, account, refund, security issue or other transaction.

The ICO confirms that marketing to individuals generally requires consent unless the limited existing-customer “soft opt-in” conditions are met.

9. Who we share personal information with

We may disclose information where reasonably necessary to organisations including:

Shopify and ecommerce infrastructure providers
Our online store is powered by Shopify. Shopify processes information required to operate the store, customer accounts, checkout and ecommerce functionality.

Payment providers
Payment processors, banks and payment services involved in processing your chosen payment method.

Delivery and fulfilment providers
Warehousing, fulfilment, postal and courier companies that need information to deliver an order.

Website, analytics and technology providers
Companies providing website functionality, hosting, consent management, analytics, attribution, search optimisation, fraud prevention, advertising measurement and similar technical services.

These may include services such as Consentmo, RankTail and other providers identified through our cookie controls.

Professional advisers
Accountants, solicitors, insurers, auditors and other advisers where required.

Government and regulatory authorities
Where disclosure is required by law or reasonably necessary in connection with legal proceedings, taxation, fraud prevention or regulatory obligations.

We do not disclose personal information to third parties simply because they request it. We require an appropriate legal or contractual basis for disclosure.

Some organisations act as processors on our behalf. Others may act as independent controllers for particular services and will process information under their own privacy terms.

10. Shopify

Our store uses Shopify.

For UK and European merchants, Shopify states that its primary contracting entity is Shopify International Limited in Ireland. Shopify may also process information through affiliated companies and subprocessors in other countries. Shopify describes the safeguards it uses for international transfers, including adequacy arrangements and contractual safeguards.

11. International transfers

Some organisations providing services to us operate outside the United Kingdom.

This can mean personal information is processed in countries including the European Economic Area, Canada and the United States.

Where UK data-protection law requires safeguards for an international transfer, we use an appropriate mechanism. Depending on the transfer, this may include:

UK adequacy regulations;
contractual protections;
the UK International Data Transfer Agreement;
the UK Addendum to approved EU Standard Contractual Clauses; or
another lawful transfer mechanism.

The ICO currently recognises the IDTA and UK Addendum as standard contractual safeguards for relevant restricted transfers.

12. How long we keep information

We do not keep personal information indefinitely without reason.

Order, invoice and accounting information will generally be retained for the period needed to comply with accounting, tax and legal obligations. In many cases this means at least six years.

HMRC requires companies to retain relevant accounting records for six years from the end of the financial year to which they relate, with some circumstances requiring longer retention.

Other information is generally retained as follows:

customer-account information: while the account remains active and for a reasonable period afterwards;
customer-service correspondence: for as long as reasonably needed to resolve the issue and deal with possible follow-up or legal claims;
marketing information: until you unsubscribe or we otherwise cease the relevant marketing activity;
suppression records: minimal information may be retained after an unsubscribe so that we can ensure you are not accidentally re-added;
security and fraud information: for as long as reasonably necessary to protect the business, customers and systems;
analytics information: according to the applicable service settings and retention periods; and
cookie-consent records: for an appropriate period to record and demonstrate your privacy choices.

Where information is needed for an active legal dispute, regulatory investigation or legal claim, we may retain it for longer.

13. Automated systems

We may use automated systems to assist with matters such as fraud detection, payment risk, website security and ecommerce analytics.

We do not use browsing of medical-supply products to make a medical diagnosis about you.

If we use solely automated decision-making that produces a legal or similarly significant effect and data-protection law gives you specific rights in relation to that decision, we will provide the information and safeguards required by law.

14. Your data-protection rights

Depending on the circumstances and applicable law, you may have rights to:

obtain a copy of personal information we hold about you;
correct inaccurate information;
request deletion;
restrict certain processing;
object to certain processing;
receive certain information in a portable format;
withdraw consent where processing is based on consent; and
object to direct marketing at any time.

These rights are not absolute and some exemptions apply.

To exercise a right, contact:

[email protected]

We may need to verify your identity before providing information.

15. Cookie consent

Where processing depends on your cookie or tracking consent, you can withdraw or change that consent at any time through Cookie Preferences.

Withdrawing consent does not make earlier lawful processing unlawful.

16. Security

We use reasonable technical and organisational measures designed to protect personal information against:

unauthorised access;
accidental loss;
disclosure;
alteration; and
destruction.

No internet-based service can guarantee absolute security.

17. Complaints

If you have concerns about how we process personal information, please contact us first at: