Privacy policy
This page explains what personal information we collect, why we need it, who we share it with and how long we keep it. It also explains your rights under the UK GDPR and the Data Protection Act 2018.
The short version
- We only collect what we need to make, engrave and deliver your pendant, and to answer your questions.
- We only use health details for engraving, such as your NHS number, with your explicit consent. We delete them 90 days after we dispatch your pendant.
- We engrave every pendant ourselves, in London. No other company makes or engraves it, and our suppliers never receive your details.
- We never see your medical record, and we don’t keep any medical records. There’s no account and no subscription.
- Your card details go straight to Stripe. We never see them.
- We never sell your information. We only send reminder emails if you ask for them.
- You can ask to see, correct or delete your information. Just contact us.
1. Who we are
Medi Wear Limited is responsible for your personal information. In data protection law, this makes us the “controller”. We are a company registered in England and Wales, number 16185806, with our registered office at 12 Noblefield Heights, London N2 0NX.
We’re a small company, so we don’t have a data protection officer. If you have any questions about your information, contact us:
- by email at hello@mediwear.co.uk
- by phone on 020 7183 0355, Monday to Friday, 9am to 5pm
- by post at Medi Wear Limited, 12 Noblefield Heights, London N2 0NX
2. What we collect
| What | When and why |
|---|---|
| Your email address | At checkout. We send your order confirmation and updates to it. |
| Your phone number, if you give it | At checkout, or on Stripe’s payment page. We only use it if we have a question about your order or your engraving. |
| A gift message, if you write one | At checkout. We handwrite it on a card in the box. |
| Whether you want reminder emails | At checkout, if you tick the box. We email you every three months to remind you to check your GP record is up to date. |
| Your consents | At checkout. We record that you accepted our terms and gave consent for us to use the health details in your engraving. |
| Your name and delivery address | On Stripe’s payment page. Stripe passes them to us so we can send your order. |
| Your card details | On Stripe’s payment page. These stay with Stripe. We never see or store them. |
| Your engraving | When you personalise a pendant: up to 4 lines that you choose. Each line can be a name, condition, allergy, medication, emergency contact, date of birth, NHS number, CHI number, H&C number, or your own words. |
| Your order | When you order: which pendant, the price, and the date. |
| Call-back requests | When you use our call-back form: your name, phone number, the best time to call and any message. |
| What you tell us by phone or email | When you contact us. If you order by phone, we take the same details as we would online. |
| Your IP address | When you visit our website. Your browser sends it to any website it connects to. We don’t use it to track you. |
Buying for someone else
If you’re ordering a pendant for someone else, you’ll be giving us their details, and perhaps health details too. Please only do this with their agreement. When you tick the consent box at checkout, you’re confirming that the wearer is happy for us to use their details to make the pendant.
If you add an emergency contact’s phone number to your engraving, please check they’re happy for you to.
What stays on your device
Your basket, including any engraving details you’ve typed, is kept in your web browser on your own device. We don’t receive it until you go through checkout. Our cookies page explains this in more detail.
We don’t use analytics, advertising or tracking of any kind on our website.
3. Your health details
A condition, an allergy, a medication, or a health ID number (an NHS, CHI or H&C number) on your engraving is health information. So is anything else on it that says something about your health. The law calls this “special category data” and gives it extra protection. Because you can write your own words on any line, we treat your whole engraving as health information.
You don’t have to engrave any health details. A health ID number is optional, although we recommend it.
- We only use it with your explicit consent. You give this at checkout by ticking a box. You can’t order an engraved pendant without it, because we can’t make the engraving without using these details.
- We only use it to make your pendant. Someone on our team reads your engraving to check it, and we engrave it ourselves, in London. No other company makes or engraves your pendant.
- Our suppliers never see it. Our blank pendants come from manufacturing suppliers abroad. They never receive your engraving or any other information about you.
- The services that run our checkout and emails hold it for us. Your engraving is saved with your order by Stripe, and included in the order emails we send through Twilio SendGrid. They may only use it to provide their service to us. Section 5 explains more.
- We delete it 90 days after dispatch. We keep it that long in case your pendant needs remaking or you have a question about it.
- We never see your medical record. Your NHS, CHI or H&C number links to the record your health service already keeps about you. We have no access to it, and we don’t keep any medical records.
Withdrawing your consent
You can withdraw your consent before your engraving is made. Contact us as soon as you can, on the same day if possible. We won’t make the engraving, we’ll delete your health details, and we’ll refund you in full.
Once the engraving has been made, it can’t be undone. You can still ask us to delete the copy of your engraving details that we hold, and we will.
4. How we use it, and why
The law says we must have a “lawful basis” for each way we use your information. These are ours.
| What we do | Our lawful basis |
|---|---|
| Make, engrave and deliver your order, and email you about it | Contract: we need to do this to fulfil your order (UK GDPR Article 6(1)(b)) |
| Use the health details in your engraving | Your explicit consent (Article 9(2)(a)), and contract (Article 6(1)(b)) |
| Call you if we have a question about your engraving | Contract (Article 6(1)(b)) |
| Take payment and prevent fraud | Contract (Article 6(1)(b)), and our legitimate interest in preventing fraud (Article 6(1)(f)) |
| Send reminder emails to check your GP record | Your consent (Article 6(1)(a)) |
| Answer your messages and call-back requests | Our legitimate interest in replying to you (Article 6(1)(f)) |
| Deal with remakes, complaints and legal claims | Contract (Article 6(1)(b)), and our legitimate interest in dealing with them properly (Article 6(1)(f)) |
| Keep order and payment records for tax | Legal obligation (Article 6(1)(c)) |
| Keep our website working and secure | Our legitimate interest in running a safe website (Article 6(1)(f)) |
We don’t use your information to make automated decisions about you, and we don’t build a profile of you. Stripe runs its own automatic checks on payments to prevent fraud, which its privacy policy explains.
5. Who we share it with
We never sell your information. We only share it with companies that help us run our business, and only what each one needs.
| Who | What they do for us | What they receive |
|---|---|---|
| Stripe | Takes card payments, checks for fraud and keeps a record of your order for us | Your name, email, phone number, delivery address, card details and order total, and your order details, including your engraving and any gift message |
| Vercel | Hosts our website, runs our checkout, and receives requests sent through our call-back form | Your call-back requests, your order details while you place your order, and your IP address when you visit |
| Twilio SendGrid | Sends our order emails and reminder emails, and passes call-back requests to us | Your email address and the contents of the emails we send, including your order and engraving details, and the name, phone number and message from any call-back request |
| Our delivery company | Delivers your parcel | The name and delivery address |
No other company makes or engraves your pendant. We engrave every pendant ourselves, in London. The suppliers who make our blank pendants never receive any information about you.
These companies may only use your information to do this work for us. Stripe is also responsible for some uses of your information itself, such as preventing fraud and meeting financial rules. You can read Stripe’s privacy policy.
When you visit our website, your browser also fetches our fonts from Google Fonts, and our product pages fetch a 3D graphics library from jsDelivr. Both receive your IP address when this happens. See our cookies page for more.
We may also share information if the law requires us to, for example with the police or a court. If we ever sold our business, your information would pass to the new owner, who would have to look after it in line with this policy.
6. Information sent outside the UK
Some of the companies we use, such as Stripe, Vercel and Twilio SendGrid, may store or access your information outside the UK, including in the United States.
When this happens, your information is protected in one of these ways:
- the UK government has decided the country protects personal information to a UK standard (an “adequacy regulation”), which includes the UK-US data bridge for US companies that have signed up to it
- the company has signed the Information Commissioner’s Office’s International Data Transfer Agreement, or the UK Addendum to the EU’s standard contractual clauses
Contact us if you’d like more details about these safeguards.
7. How long we keep it
| Information | How long we keep it |
|---|---|
| Engraving details, including health details | Deleted 90 days after we dispatch your pendant |
| Order and payment records | 6 years, because tax law requires it |
| Reminder email list | Until you unsubscribe |
| Call-back requests | Deleted after 12 months |
| Your basket, on your own device | Until you empty it or clear your browser’s storage |
8. Keeping it safe
- Our website uses a secure, encrypted connection (HTTPS).
- Your card details are handled by Stripe and never reach our systems.
- Only the people who need your information to do their job can see it.
- We engrave every pendant ourselves, so your engraving is never sent to another company to be made. Our suppliers never receive any information about you.
If there’s ever a data breach that puts your information at risk, we’ll report it to the Information Commissioner’s Office within 72 hours where the law requires. If it’s likely to cause you serious harm, we’ll tell you directly without delay.
9. Emails from us
We’ll email you about your order, for example to confirm it or to tell you about a delay. These emails are part of providing your order.
We only send reminder emails if you ask for them at checkout. You can stop them at any time using the unsubscribe link in each email, or by contacting us.
We never send marketing emails without your consent, and we never pass your email address to anyone for their marketing.
10. Your rights
You have the right to:
- see the information we hold about you, and get a copy
- correct information that’s wrong or incomplete
- delete your information
- restrict how we use it
- object to how we use it
- move it to another organisation (data portability)
- withdraw your consent at any time, where we rely on it
Some of these rights only apply in certain situations. For example, we have to keep order records for 6 years for tax, even if you ask us to delete them. If a right doesn’t apply, we’ll explain why.
To use any of your rights, contact us by email, phone or post. It’s free. We may need to check who you are first. We’ll reply within one month. If your request is complicated, we may need up to two more months, and we’ll tell you if so.
11. How to complain
If you’re unhappy with how we’ve handled your information, please contact us first and we’ll try to put it right.
You also have the right to complain to the Information Commissioner’s Office (ICO), the UK regulator for data protection:
- website: ico.org.uk
- phone: 0303 123 1113
- post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
12. Changes to this policy
We’ll update this policy if the way we use your information changes. The date at the top of this page shows when it last changed. If we make a big change that affects you and we have your email address, we’ll tell you before it happens.