Diomed Developments Limited, and companies within the group controlled by Diomed Developments Limited (“Diomed Group”, “we” or “us”), are committed to protecting your privacy and personal information. The companies within the Diomed Group include:
The Diomed Group company that corresponds with you or receives your information is the ‘data controller’ and is responsible for determining why and how your personal information is processed. Please see the section at the end of this policy for our legal information and contact details.
This policy describes the way we handle and use the personal information that we obtain from all the different interactions you may have with us as a business, including:
Should you take part in a research study, we will provide you with additional information about the particular study that will explain how your data is being processed.
Updates: This policy is subject to review and amendment regularly and when necessary. Please check this policy frequently to identify any changes and contact us using the details found in Section 11 should you have any queries regarding the relevant changes. You may be required to read and accept any updated versions of this policy to continue your use of the website.
Please contact us via firstname.lastname@example.org if you have any questions.
Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed and this will be classified as anonymous data. Some examples of personal information include: name, location data (e.g. IP address), telephone number.
Personal information relating to special categories of data, including race, ethnic origin, politics, religion, trade union membership, genetics, biometrics (where used for ID purposes), health, sex life or sexual orientation will be classified as ‘sensitive personal data’. The law imposes higher standards of protection on those who process special category data as it is more sensitive.
We receive personal information about you that you give to us, from sources such as those included in Section 1. We only collect personal information which we need and that is relevant for the purposes for which we intend to use it. Outlined below are the points of data collection, the data we collect and why we collect this data.
3.1 Personal information that you give to us
We collect the following information if you choose to give it to us for example, when you contact us following a purchase of one of our products from a third-party store or via a contact form on one of our websites:
3.2 Information that we collect about you
When you visit one of our websites or use our apps, we automatically collect:
When you visit our social media pages, we collect:
When you agree to take part in a research study, we collect:
We may process your personal information for a number of reasons. We will always ensure we have a valid legal ground to process your personal information. We use your personal information in the following ways:
4.1 Where you have provided CONSENT
Where you have provided your consent, we may process your personal information in ways such as the following:
You may withdraw your consent for us to use your information at any time. Please see Section 10 ‘Your rights in relation to your personal information’ for further details.
4.2 Where necessary to comply with our LEGAL OBLIGATIONS
We will use your personal information to comply with our legal obligations:
4.3 Where necessary for us to pursue a LEGITIMATE INTEREST
We use and process your personal information where it is necessary for us to pursue our legitimate interests as a business for the following purposes:
To promote our business, brands and products and measure the reach and effectiveness of our campaigns:
To operate the administrative and technical aspects of our business efficiently and effectively:
For research studies:
As a healthcare company we have a legitimate interest in performing health and care research in accordance with the UK Policy Framework for Health and Social Care Research:
4.4 Where necessary for us to carry out PRE-CONTRACT STEPS you have requested or for the performance of our CONTRACT
We will use your personal information where this is necessary for us to perform our contract with you or to carry out any pre-contract steps you’ve asked us to so that you can enter into that contract, for the following purposes:
4.5 Where processing is in your VITAL INTERESTS
We will use your personal information where this is in your vital interests for the following purposes:
We process your personal information for direct marketing purposes on the basis that it is necessary for us to pursue our legitimate interests as a business (see above in this section for further details).
We try to tailor and personalise any marketing communications that we send to you, for example, by notifying you of products, services, offers or promotions that apply to your interests and/or location. If you do not wish to receive marketing communications from us, you can unsubscribe at any time by using the unsubscribe link inside the email or by sending an email to email@example.com or using your email settings (to unsubscribe from marketing emails).
If you unsubscribe from receiving marketing communications from us, we keep your email address on our suppression list for a defined period to ensure that we comply with your wishes. The periods for which we retain your personal information are shown in Section 6.
We do not intend to collect data from minors under the age of 16 other than in accordance with our legal obligations or for research purposes or where it is in the child’s vital interests as detailed above, for example, where a concern has been raised regarding the safety of one of our products. We recognise that children’s use of the internet, email and social media raise special concerns regarding privacy and security of information. We remind and encourage all parents to help us protect the privacy of their children by ensuring that children never send or submit personal information to us without parental permission.
When there is a legitimate interest in including children in research studies, this will be explained when agreeing to take part in the study.
We never sell your personal information to third parties. We only disclose your personal information outside our business to third parties in a limited number of circumstances. Where we share personal information, we will put in place a contract that requires recipients to protect your personal information, unless we are legally required to share that information. Any third party contractors or agents that work for us will be obliged to follow our instructions.
5.1 Group companies
We may share your personal information with other companies in our group in order to facilitate processing of orders and to process your information.
5.2 Third parties - Suppliers
We contract with third party service providers, agents and subcontractors (Suppliers) to supply products and services on our behalf, including the operation and maintenance of our websites. When we use suppliers, we ensure we only disclose to them personal information that is necessary for them to provide their services and only where we have a contract in place that requires them to keep your information safe and secure.
Our Suppliers can be categorised as follows:
|Recipient/ relationship to us||Industry sector (& sub-sector)||Location|
|Banks, payment processors and financial services providers||Finance (banking & payment processing)||EEA|
|Delivery and mailing services providers||Logistics (delivery service)||EEA|
|Facilities and technology service providers including scanning and data destruction providers||IT (data management)||EEA|
|Social media platforms||Media (social media)||EEA & USA|
|Legal, security, tax, accountancy and other professional advisers and consultants||Professional services (legal & accounting)||EEA|
|Advertising and agencies||Media (advertising & PR)||EEA|
|Market and customer research providers||Media (market research)||EEA|
|Website and data analytics platform providers||IT (data analytics)||EEA|
|Website and app developers||IT (software development)||EEA|
|Fulfilment and distribution||Logistics (delivery service)||EEA & India|
|Ecommerce website provider||IT (ecommerce services)||EEA & USA|
|Payment processing providers||IT (payment processing)||EEA & USA|
|Research partners||CROs, investigators, statisticians, universities||EEA|
|Sales and marketing partners||Sales and marketing||EEA|
5.3 Other third parties
We may disclose your personal information to other third parties as follows:
5.4 Transfer of your personal information outside of the EEA
Some of the information you provide to us may be transferred to countries outside the European Economic Area (EEA). These countries may not have similar data protection laws to the UK. The non-EEA countries to which we transfer your personal data are listed in the table above. For example, if you use our services whilst you are outside the EEA, your information will be transferred outside the EEA in order to provide you with those services.
Where we transfer your information outside of the EEA in this way, we take steps to ensure that appropriate security measures are taken with the aim of ensuring that your privacy rights continue to be protected in the ways required by data protection law as outlined in this policy. These steps include imposing contractual obligations on the recipient of your personal information or ensuring that the recipients are subscribed to ‘international frameworks’ such as EU/US Privacy Shield that aim to ensure adequate protection. Please contact us using the details at the end of this policy for more information about the protections that we put in place.
We will not hold your personal information in an identifiable format for any longer than is required for the purposes for which we collected it. We retain your personal information for the following periods:
|Type of personal information||When do we receive your personal information?||How long do we keep your personal information after we receive it?|
|Name, email address, telephone number, postal address, date of birth, names and ages of your friends and family, your marketing preferences||When you place an order for one of our products via one of our relevant websites||5 years from the date of order|
|Social media handles||When you follow our social media account or page||Until you stop following our social media account or page|
|Location and frequency of your orders for products placed||When you sign up for our apps or register with us for an account||5 years from the date you sign up if you are an inactive app user, indefinitely if you are an active app user|
|Information included in any correspondence to us via email, telephone, letter, our websites through our contact us form, via our apps or social media pages||When we receive the correspondence||
Indefinitely if necessary to establish or defend legal claims.
Please note, depending on the nature of the possible concern raised, for example, where there appears to have been a complaint made on behalf of a child, the personal information will be retained for longer.
|Details of your orders||When our systems record your order||25 years|
|Where you are a healthcare professional, confirmation and information relating to and confirming your status and registration in the UK||When we receive a submitted form via our website, or where you return a Reply Pay Card, or otherwise provide the information to us||5 years|
|Health and care information about you||When you take part in research studies||Information about you will be kept indefinitely.|
The only exceptions to the periods mentioned above are where:
We take the security of your personal information seriously and use a variety of measures based on good industry practice to keep it secure. We and our business partners and service providers have implemented technical, administrative and physical procedures designed to protect personal information from access by unauthorised persons and unlawful processing, accidental loss, destruction and damage.
When we have provided (or you have chosen) a password or pin allowing you access to certain parts of our websites or our apps, you are responsible for safeguarding it and keeping it confidential and you promise not to allow it to be used by third parties. Unfortunately, the transmission of information via the internet is not completely secure. Although we will do everything reasonably possible to protect your personal information, we cannot guarantee the security of any personal information during its transmission to us online. You accept the inherent security implications of using the internet and will not hold us responsible for any breach of security unless we are at fault.
Where you provide us with any personal data through the private messaging function on these social media platforms, we will collect and process that data in accordance with this policy.
Under data protection law, you have a number of rights in relation to your personal information. Please note, in relation to certain rights, we may ask you for information to verify your identity and, where applicable, to help us to search for your personal information. Except in rare cases, we will respond to you within 30 days after we have received this information or, where no such information is required, after we have received full details of your request.
You have the following rights:
To exercise these rights, please contact us using the details at the end of this policy.
It is important for you to be aware that if you are taking part in research, or information about you is used for research, your rights to access, change or move information about you are limited. This is because researchers need to manage your information in specific ways in order for the research to be reliable and accurate. If you withdraw from a study, we will keep the information about you that has already been obtained.
You have the right to lodge a complaint with a data protection regulator in Europe, in particular in a country you work or live or where your legal rights have been infringed. The contact details for the Information Commissioner’s Office (ICO), the data protection regulator in the UK, are available on the ICO website, where your personal information has or is being used in a way that you believe does not comply with data, however, we encourage you to contact us before making any complaint and we will seek to resolve any issues or concerns you may have.
If you have any questions or concerns regarding the data we hold about you, the way in which you believe that data is being used or this policy or to exercise any of your rights in relation to your personal information, please contact us by emailing firstname.lastname@example.org.
For anything else, including general enquiries, please contact us by post addressing your correspondence to the relevant Diomed Group company from the list below at:
Preston Road, Gosmore
Diomed Group Companies:
Diomed Developments Ltd
Dermal Laboratories Ltd
Diomed Direct Ltd
Diomed Pharmaceuticals Ltd
Aeropak (Chemical Products) Ltd