Privacy Policy
This policy explains what personal data DR2U collects, why, and what rights you have over it under UK GDPR and the Data Protection Act 2018.
Who we are
GPS Health Online LTD (trading as DR2U), registered in England (company number 12596423, registered office 228, Church Lane, London, NW9 8SN), is the data controller for the personal data described in this policy. We're registered with the Information Commissioner's Office (ICO), registration number ZA797162.
What personal data we collect
- Account details — name, email address, and password (stored as a salted hash, never in plain text).
- Order details — the products you've ordered, order value, and order history.
- Delivery and billing details — name, address, and phone number, so we can deliver your order and process payment.
- Payment metadata — your order amount and payment status. We never hold your full card details ourselves; these are collected and processed directly by CardStream, our payment provider, via their hosted payment page.
- Device and browsing information — IP address and browser details, used to detect and prevent fraud and to understand how the site is used.
- Marketing preferences — whether you've opted in to marketing communications, and your cookie consent choices (see our Cookie Policy).
Our lawful bases for using your data
| Purpose | Lawful basis |
|---|---|
| Creating your account, processing and delivering your orders | Performance of a contract |
| Keeping order and financial records for accounting and tax purposes | Legal obligation |
| Detecting and preventing fraud and account abuse | Legitimate interests |
| Sending you marketing communications | Consent — you can withdraw this at any time |
Who we share your data with
We share personal data with the following named third parties, only as needed to run the site and fulfil your order:
- CardStream — our payment provider, to process your payment. They receive your order amount and reference; we never share your account password with them, and they never share your full card details with us.
- Delivery carriers — your name, delivery address, and phone number, to get your order to you.
- Microsoft 365 — our email provider, used to send order confirmations, account, and security emails.
- Our hosting provider — who hosts the servers this site and your data run on.
- Analytics providers — where you've consented to analytics cookies, to help us understand how the site is used (see our Cookie Policy for details).
We don't sell your personal data to anyone, and we only share what's necessary for the purpose in each case above.
International transfers
Where any of the providers above store or process data outside the UK, we ensure appropriate safeguards are in place — such as the UK's International Data Transfer Agreement or an adequacy decision — before any transfer happens.
How long we keep your data
We keep account and order data for as long as your account is active. Order and financial records are kept for six years after the end of the relevant tax year, as required for UK tax purposes, even if you close your account. Marketing consent records are kept until you withdraw consent, plus a short period afterwards to evidence that withdrawal.
Your rights
Under UK GDPR, you have the right to:
- Access the personal data we hold about you.
- Rectification of inaccurate or incomplete data.
- Erasure of your data ("right to be forgotten"), subject to our legal obligation to retain order and financial records for six years.
- Restrict or object to certain processing, including direct marketing.
- Data portability — receive your data in a structured, machine-readable format.
If you have an account, you can exercise the access and erasure rights directly: Export my data and Delete my account are available from your account settings. For any other request, or if you'd rather not use self-service, email info@dr2u.co.uk.
Complaints to the ICO
You have the right to complain to the Information Commissioner's Office (ICO) if you think we've mishandled your data. We'd appreciate the chance to put things right first — please contact us at info@dr2u.co.uk — but you're free to contact the ICO directly at any time, via ico.org.uk/make-a-complaint or on 0303 123 1113.