Privacy Policy

Last updated: May 2026

1. Data Controller

The data controller responsible for your personal data is Elva Research Ltd, an International Business Company registered in the Republic of Seychelles (Company Number: 248808). We are a telehealth company providing clinician-led weight management programmes through shop.elvalabs.co.

If you have any questions about this Privacy Policy or how we handle your personal data, you can contact our Data Protection Officer (DPO) at help@elvalabs.co. All data protection enquiries are handled by our DPO.

2. Data We Collect

We collect the following categories of personal data when you interact with our website, place an order, or contact us:

Identity and contact data: your name, email address, telephone number, and billing or delivery address.

Order and transaction data: details of products purchased, order history, payment confirmation references, and delivery information.

Professional data: where you provide it, your medical history, health questionnaire responses, and clinical information (used to assess eligibility for our weight management programmes).

Technical and usage data: IP address, browser type, device information, operating system, pages visited, referring URL, and session data, collected automatically via cookies and server logs.

Communications data: any messages you send us via email or contact forms, including the content of those communications.

We collect health-related data as necessary to provide our telehealth services, including medical questionnaire responses. This data is processed under Article 9(2)(h) of UK GDPR (provision of health care) and is handled with appropriate safeguards.

3. How We Use Your Data

We use your personal data for the following purposes:

• To process and fulfil your orders, including arranging delivery and issuing invoices;
• To assess your clinical eligibility for weight management programmes via our health questionnaire;
• To communicate with you about your orders, including dispatch notifications, delivery updates, and responses to your enquiries;
• To send transactional emails such as order confirmations and refund notifications;
• To process payments securely via our payment providers;
• To detect, investigate, and prevent fraudulent transactions and other illegal activity;
• To comply with our legal and regulatory obligations, including tax and accounting requirements;
• To improve our website, products, and services based on aggregate usage data.

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects on you.

4. Legal Basis for Processing (UK GDPR)

Under UK GDPR, we rely on the following lawful bases for processing your personal data:

• Contract (Article 6(1)(b)): processing is necessary to perform the contract of sale with you, including processing your order, arranging delivery, and handling returns or refunds;
• Legal obligation (Article 6(1)(c)): processing is necessary for us to comply with our legal obligations, including VAT records, accounting obligations, and fraud prevention requirements;
• Legitimate interests (Article 6(1)(f)): processing is necessary for our legitimate interests in preventing fraud, assessing clinical eligibility, securing our systems, and improving our services — provided these interests are not overridden by your rights and freedoms;
• Consent (Article 6(1)(a)): where we rely on consent (for example, for optional marketing communications), you may withdraw this at any time by contacting us or using the unsubscribe link in any marketing email.

5. Payment Processing

We use third-party payment providers to process payments on our website. When you place an order, your payment details are collected and processed directly by our payment providers and are not stored on our servers.

Our payment providers process payment data as independent data controllers and in accordance with their own privacy policies. They maintain appropriate payment security certifications. We receive only a payment confirmation and a reference identifier from our payment providers, which we use to reconcile your order.

Where our payment providers process data on our behalf (for example, in relation to fraud analysis services), they do so as data processors under data processing agreements that comply with UK GDPR requirements.

6. Data Sharing

We share your personal data only where necessary and with appropriate safeguards in place. Recipients include:

• Delivery and logistics providers: your name and delivery address are shared with our courier partners solely for the purpose of fulfilling your order;
• Payment processors: as described in section 5 above;
• IT and infrastructure providers: we use trusted third-party services for website hosting, email delivery, and data storage, all bound by appropriate data processing agreements;
• Legal and regulatory authorities: where required by law, a court order, or a regulatory authority (such as HMRC), we may disclose personal data;
• Professional advisers: our accountants, auditors, and legal advisers may have access to data as strictly necessary for their professional services.

We do not sell, rent, or trade your personal data to any third party for marketing or commercial purposes.

7. Cookies

Our website uses cookies and similar technologies. Cookies are small text files placed on your device by your browser when you visit a website.

We use the following types of cookies:

• Strictly necessary cookies: required for the website to function, including maintaining your session and shopping basket. These cannot be disabled without affecting website functionality;
• Analytics cookies: used to understand how visitors interact with our website in aggregate (e.g. pages visited, time on site). This helps us improve our content and user experience;
• Payment cookies: set by our payment processors to facilitate secure payment processing and fraud prevention.

You can manage or disable non-essential cookies through your browser settings. For instructions on how to do this, refer to your browser's help documentation. Note that disabling cookies may affect the functionality of our website.

8. Data Retention

We retain your personal data for no longer than is necessary for the purposes described in this policy, or as required by law. Our standard retention periods are:

• Order and transaction records: retained for 7 years from the date of purchase in accordance with HMRC requirements for financial records;
• Customer account data: retained for the duration of your customer relationship with us and for 3 years thereafter, after which it is securely deleted or anonymised;
• Communications: enquiry and support emails are retained for 2 years from the date of last contact;
• Technical logs and analytics: retained for up to 13 months, then deleted or anonymised.

Where retention is required by law or to protect our legitimate legal interests (for example, in the event of a dispute), we may retain data for longer than the standard periods above.

9. Your Rights Under UK GDPR

As a UK data subject, you have the following rights in relation to your personal data:

• Right of access: you may request a copy of the personal data we hold about you (a "subject access request");
• Right to rectification: you may ask us to correct inaccurate or incomplete personal data;
• Right to erasure: in certain circumstances, you may ask us to delete your personal data ("the right to be forgotten");
• Right to restrict processing: you may ask us to restrict the processing of your data in certain circumstances, for example while a complaint is being resolved;
• Right to data portability: where processing is based on consent or contract, you may request your data in a structured, machine-readable format;
• Right to object: you may object to processing based on legitimate interests or direct marketing at any time;
• Right to withdraw consent: where we rely on consent as the legal basis for processing, you may withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact our DPO at help@elvalabs.co. We will respond to your request within one calendar month, or inform you if we require an extension (up to a further two months for complex requests). We may need to verify your identity before acting on a request.

If you are not satisfied with how we handle your personal data, you have the right to lodge a complaint with the UK's supervisory authority: the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

10. International Transfers

We primarily process and store your personal data within the United Kingdom. Where we use third-party service providers that transfer data outside the UK (for example, cloud infrastructure providers or our payment processors), we ensure that appropriate safeguards are in place, including:

• Transfers to countries with a UK adequacy decision issued by the Secretary of State;
• Transfers subject to UK International Data Transfer Agreements (IDTAs) or UK Addendum to EU Standard Contractual Clauses;
• Other legally recognised transfer mechanisms under UK GDPR.

You may request further details about the safeguards in place for any specific transfer by contacting us at help@elvalabs.co.

11. Children

Our website and products are not directed at, and are not intended for, individuals under the age of 18. We do not knowingly collect personal data from children. If you have reason to believe that a child under 18 has provided us with personal data, please contact us immediately at help@elvalabs.co and we will take appropriate steps to delete that data as promptly as possible.

12. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, alteration, or disclosure. These measures include:

• Encryption of data in transit using TLS/SSL;
• Restricted access to personal data on a need-to-know basis;
• Use of reputable, security-certified third-party providers;
• Regular review of our data processing practices and security controls.

Notwithstanding these measures, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security and you share your data with us at your own risk. In the event of a data breach that is likely to result in a high risk to your rights and freedoms, we will notify you and the ICO as required under UK GDPR.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the services we offer. Updated versions will be posted on this page with a revised "Last updated" date. Where changes are material, we will take reasonable steps to notify you, which may include sending an email to the address associated with your account.

Your continued use of our website or services following the posting of a revised Privacy Policy constitutes your acknowledgment of and agreement to the updated terms. We encourage you to review this page periodically.

14. Contact & DPO

If you have any questions or concerns about this Privacy Policy, or if you wish to exercise your data protection rights, please contact us:

• Email (DPO): help@elvalabs.co
• Company: Elva Research Ltd, registered in the Republic of Seychelles (Company Number: 248808)
• Supervisory authority: Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, SK9 5AF — ico.org.uk

Elva Research Ltd is a telehealth company providing clinician-led weight management programmes. This Privacy Policy applies to our data collection and processing activities in connection with the provision of telehealth services and the sale of weight management products through shop.elvalabs.co.