This notice explains how Lavender Medical Limited uses personal data about people who visit lavendermedical.com and people who contact us through it. It follows our Data Protection Policy (version 2.0, September 2026). If you are a member of staff, a surgeon or hospital contact, a traveller or someone attending one of our courses or events, we give you a separate notice that covers that relationship.
Last updated: 9 October 2026
Who we are
Lavender Medical Limited, 646 Blackhorse Road, Letchworth Garden City, Hertfordshire SG6 1HD, is the controller of the personal data described here. We are registered with the Information Commissioner’s Office under reference ZA515337.
Our data protection contact is privacy@lavendermedical.com. We are not required to appoint a Data Protection Officer and have not done so; our directors are responsible for data protection.
What we collect through this website
When you send us a message. The Contact Us form and the Quick Contact tab ask for your first and last name, your email address, a telephone number (Contact Us form only) and your message. We also record which page you sent it from and, if you used the “Enquire about this product” button, which product you asked about. On the Contact Us form you can tick a box to agree to receive marketing and promotional materials; it is not ticked unless you tick it.
Please do not include information about patients or about anyone’s health in your message. We do not need it to answer an enquiry.
When you visit. Like every website, the servers that deliver our pages briefly receive technical information such as your IP address, browser type and the pages requested. This is used only to deliver the site and keep it secure.
Visit statistics. We use Vercel Web Analytics to count how many people visit and which pages they view, so we can see which products and pages are useful. It does not use cookies and does not identify you: a visit is recognised only by a code made from your request that changes every day, and we see totals, not individuals.
We do not use advertising or tracking tools, and this website does not set cookies. Site search runs in your own browser and is not recorded.
Why we use it and our lawful basis
- Answering your enquiry and following it up: our legitimate interests in responding to people who contact us and in supplying and supporting our products, or, where you are asking about buying from us, taking steps at your request before entering into a contract.
- Sending you marketing and promotional materials: your consent, given by ticking the box. You can withdraw it at any time by emailing privacy@lavendermedical.com or using the unsubscribe link in any message, without affecting anything sent before.
- Keeping the website working and secure: our legitimate interests.
- Counting visits and page views: our legitimate interests in understanding which parts of the website are useful.
Where we rely on legitimate interests we have checked that our interest is not outweighed by your rights.
Videos and 3D models on our pages
Some product pages include videos and 3D models from YouTube, Vimeo and Sketchfab. When a page with one of these loads, your browser connects to that provider, which receives your IP address and browser details. We use YouTube’s privacy-enhanced mode and Vimeo’s “do not track” setting, so they should not store cookies unless you play a video. Once you play a video or open a model, that provider’s own privacy policy applies.
Who sees your information
Messages sent through the website go to our team at info@lavendermedical.com and are handled by the people who need to answer them. We do not sell personal data.
We use service providers who process data on our behalf under written contracts that meet UK GDPR Article 28, so they may only act on our instructions and must keep the data secure:
- Vercel, which hosts this website and provides its visit statistics;
- Twilio SendGrid, which delivers the website’s form messages to our mailbox;
- Google, which provides our email.
These providers are based in or use servers in the United States. Where personal data goes outside the UK, we make sure it is protected, through the UK–US data bridge for certified companies, the ICO’s International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.
We may also share information with professional advisers, or where the law requires it.
How long we keep it
The website itself does not store your message; it is emailed to us and kept in our mailbox and systems.
- Enquiries are kept for as long as we deal with you. Surgeon and hospital contact records are reviewed after three years with no dealings, then deleted or reduced to name and history unless there is a reason to keep more.
- Customer and supplier records, orders and invoices are kept for six years after the end of the financial year.
- Marketing consent is kept until you withdraw it.
- Technical information received by the servers that deliver our pages is kept only briefly.
- Visit statistics are kept as totals (page views and visitor counts), which cannot identify you.
You can ask us to delete your data at any time.
Your rights
You have the right to be informed about how we use your data; to access it; to have it corrected; to have it erased; to restrict its use; to data portability; to object, including to direct marketing at any time; and not to be subject to decisions made solely by automated means.
To use any of these rights, email privacy@lavendermedical.com. We will confirm your identity and respond within one month, free of charge.
Complaints
If you are unhappy with how we have used your data, please contact privacy@lavendermedical.com first so we can try to put it right. You also have the right to complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint, telephone 0303 123 1113.
Changes to this notice
We review this notice with our Data Protection Policy every year and when the way we use personal data changes. The date at the top shows when it was last updated.