Privacy Notice
This notice explains what personal information Pamvita collects, why, who we share it with, how long we keep it, and the rights you have. Please read it alongside our Terms & Conditions and Cookie Policy.
Draft — awaiting approval
This document is being reviewed by Pamvita and its advisers before launch. It may change before it applies to you.
Version 2.0 · Effective from 2026-09-12
Who we are and how to contact us
Pamvita is a trading name of Pamirian Pharma Ltd, a company registered in England and Wales (company number 15734399) with its registered office at Office 121, Unit 1, Watling Gate, 297–303 Edgware Road, London NW9 6NB ("Pamvita", "we", "us").
We are the "controller" of the personal information described in this notice under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Questions, requests and complaints about your personal information: privacy@pamvita.com, or write to the registered office above. We have a complaints procedure (see section 12).
The information we collect
What we collect depends on how you use Pamvita:
- Account details — your name, email address, password (stored only as a secure hash), and, if you give them, your phone number, postcode, address and date of birth. Your date of birth is used by the partner location to confirm it is your result before it is released to you.
- Booking details — the wellness check you choose, the partner location, the appointment date and time, and the status of the booking.
- Payment details — the amount paid, the currency, and payment and refund references from our payment provider. We never see or store your card number: card details are entered on our payment provider's own secure page.
- Wellness check results — the reading recorded by the partner location's analyser for the check you booked (the value, the unit, the date it was measured and the published reference interval the partner supplies). This is information about your health and is a special category of personal data (section 4). Partners may also upload a document about your check to your account.
- Agreements and consents — a record of the terms you accepted, the consents you gave or withdrew, when, and in which version of the wording.
- Communications — messages you send through our contact form, the appointment assistant, email, or reviews you choose to submit about a partner location.
- Technical information — the information needed to keep you signed in and keep the site secure (your sign-in session, a request identifier on each response, and rate-limiting counters). If you accept optional cookies, we also collect anonymous usage analytics and which campaign brought you to the site (see the Cookie Policy). We do not use advertising or third-party tracking.
- Location — only if you press "Use my location" on the partner finder; your position is used once to sort partners by distance and is not stored.
- Partner applicants — business, contact and regulatory details (for example GPhC or CQC registration numbers), documents you upload, and the result of a Companies House check on the company number you give us.
How we use your information and our lawful bases
UK data protection law requires a lawful basis for each use. We use your information:
- To create and run your account, take and manage your bookings, take payment and issue refunds, and send you service messages (booking confirmations, reminders, result-ready notices) — performance of our contract with you.
- To keep booking and payment records for accounting and tax purposes, and to respond to lawful requests from regulators or authorities — compliance with a legal obligation.
- To keep the service secure (sign-in, fraud and abuse prevention, rate limiting, automatic sign-out after inactivity), to fix errors, and to answer your enquiries — our legitimate interests in running a safe, reliable service. We have balanced these interests against your rights.
- To improve the website using anonymous usage analytics, and to record which campaign brought you here — your consent, given through the cookie choices and withdrawable at any time via "Cookie settings" in the footer.
- To send you occasional wellness tips and offers by email — your consent, which is optional, never a condition of booking, and withdrawable at any time from Account → Consent & Privacy.
- To store your wellness check results and show them to you in your account — your explicit consent, which we ask for when you book (section 4).
Your health information (special category data)
Your wellness check result is information about your health. We only store it and show it to you with your explicit consent, which you give by ticking the health information box when you book. You can withdraw that consent at any time from Account → Consent & Privacy. If you withdraw it, we will stop showing your results in your account and will not accept new results for you until you consent again; this does not affect processing that already took place, and records we must keep for legal reasons are kept as described in section 8.
The partner location that carries out your check is run by registered health professionals (for example pharmacists) who record the result under their own professional and legal obligations, including their own record-keeping duties. Pamvita does not interpret your result, does not use it to make any decision about you, does not profile you, and does not use health information for marketing.
We do not make automated decisions about you that have legal or similarly significant effects.
Who we share your information with
We share personal information only where needed to provide the service:
- The partner location you choose — your name, contact details, appointment details and, where you have given it, your date of birth, so they can carry out your check and confirm your identity before releasing a result. Partner locations are independent businesses, responsible for the check they perform and separately responsible under data protection law for the records they keep as healthcare providers.
- Supabase — hosts our database, file storage and sign-in system (all account, booking and result data).
- Vercel — hosts the website and runs its server code; it keeps short-lived technical request logs.
- Stripe — processes card payments and refunds. Stripe receives your email address, the amount and a booking reference, and handles your card details under its own privacy notice.
- Resend — delivers our emails (your email address and the content of service emails, which never include result values).
- Anthropic — powers the appointment assistant. It receives the message you type and your upcoming appointment details (such as the check name, date and location) so it can answer your questions about them, and the assistant's replies are sent back to you. It cannot see your results and is designed to refuse health questions.
- OpenStreetMap — provides the map tiles on the partner finder (tile.openstreetmap.org). Loading the map sends your IP address to OpenStreetMap, like any image on the web.
- postcodes.io — looks up UK postcodes (using Ordnance Survey and ONS open data) when you search for a partner location. The postcode you search for is sent to it.
- PDOK — looks up Dutch postcodes and addresses when you search for a partner location in the Netherlands. The postcode you search for is sent to it.
- Firebase Cloud Messaging (Google) — delivers push notifications to our native apps, if you allow notifications. It receives your device's notification token and the notification content.
- Companies House — for partner applications only, to verify a company number.
- Our error-monitoring provider (Sentry), if enabled — receives technical error reports from which personal information and health values are removed before sending.
- Professional advisers, insurers, regulators, courts and law-enforcement bodies — where required by law, to protect our rights or safety, or to establish, exercise or defend legal claims.
- We do not sell personal information and we do not share it with advertisers.
Where your information is stored and international transfers
Our database and files — including your account, bookings and results — are hosted by Supabase in the United Kingdom (London region). Our website is hosted by Vercel. Some of our providers process limited information outside the United Kingdom, including in the United States (for example, our hosting provider's server functions and our email provider).
Where personal information leaves the UK, we rely on safeguards recognised under UK data protection law: the UK's adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework where the provider is certified) or the UK International Data Transfer Agreement or Addendum, supported by a transfer risk assessment. You can ask us for more information about the safeguard used for a particular provider.
Cookies and similar technologies
We use a small number of essential cookies to keep you signed in and secure, and optional first-party analytics only if you accept them. Our Cookie Policy lists every cookie and storage item we use and how to change your choice at any time.
How long we keep your information
We keep personal information only for as long as we need it for the purposes above. In practice:
- Account information and results — for as long as your account is open. When you ask us to delete your account, we delete your profile and login, remove your results, documents and any pharmacist notes, and remove your name and contact details from booking records.
- Booking and payment records — kept without your identity for six years after the end of the financial year they relate to, because tax and company law require us to keep accounting records.
- Consent and agreement records — kept as proof of what was agreed, including after account deletion (they are then no longer linked to an identifiable person).
- Security codes and rate-limiting counters — deleted automatically within 24 hours of expiring.
- Enquiries and support messages — kept while we deal with your enquiry and for a reasonable period afterwards in case you come back to us.
- Our full retention schedule is reviewed with our data-protection adviser; you can ask us for the current version.
Your rights
Under UK data protection law you have the right to:
- be informed (this notice);
- access your personal information — you can download a copy at any time from Account → Consent & Privacy, or ask us;
- have inaccurate information corrected — you can edit your name, phone, address and date of birth under Account → Profile, or ask us to correct anything else;
- have your information erased in certain circumstances — request this from Account → Consent & Privacy or by email;
- restrict or object to our processing in certain circumstances, including objecting to direct marketing at any time;
- data portability — your download is provided in a structured, machine-readable format;
- withdraw consent at any time where we rely on consent (marketing, analytics cookies, health information);
- complain to us and to the Information Commissioner's Office (section 12).
- We respond to requests within one month (this can be extended for complex requests, and we will tell you if so). We may need to confirm your identity first.
Security
We use technical and organisational measures designed to protect your information, including encryption in transit, hashed passwords, one-time email codes for sign-in, role-based access so partner staff see only bookings at their own location, automatic sign-out after inactivity on shared devices, audit logs of sensitive actions, and reputable infrastructure providers.
No system is completely secure. If we become aware of a personal data breach that is likely to put you at high risk, we will tell you and the ICO as the law requires.
Children
Pamvita is for adults aged 18 and over. We ask you to confirm this when you create an account, and we do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, please contact us and we will delete it.
Complaints
If you are unhappy with how we have handled your personal information, please tell us at privacy@pamvita.com. We will acknowledge your complaint within 30 days, look into it without undue delay and tell you the outcome.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator: ico.org.uk, or 0303 123 1113.
Changes to this notice
The version number and effective date at the top of this page change when we update it. Where a change materially affects you, we will tell you by email or in your account before it takes effect.