Privacy at Metabolics
Last updated: 15th September 2026
Metabolics Ltd ("Metabolics", "we", "us", "our") takes your privacy seriously. This policy explains what personal data we collect when you use www.metabolics.com, our online tools, or buy from us, how we use it, who we share it with, how long we keep it, and your rights. It applies alongside our Terms and Conditions.
We may update this policy from time to time. We will publish the new version on this page and, where a change is significant, we will tell you by email or a notice on the Site.
1. Who we are
Metabolics Ltd is the data controller of your personal data. We are registered in England and Wales (company number 2844683) with our registered office at 5 Eastcott Common, Eastcott, Devizes, Wiltshire, SN10 4PL. We are registered with the Information Commissioner's Office (ICO) under registration number Z7959510.
For anything to do with your personal data, including exercising your rights, contact our privacy lead at sales@metabolics.co.uk, telephone +44 (0) 1380 812799 (Monday to Friday, 8.30am to 5.00pm), or write to Privacy, Metabolics Ltd, at the address above.
If you are in the EU: we have appointed Prighter as our representative under Article 27 of the EU GDPR. You can contact us through Prighter at https://prighter.com/q/19354493973.
2. The personal data we collect
When you create an account or place an order: your name, email address, telephone number, billing and delivery addresses, order history, product selections and your account password (stored in encrypted form). We do not store your card details — payments are processed by our payment providers, who handle your card data under their own security standards.
When you contact us: the details of your enquiry, complaint or request and any correspondence with you, including live chat and phone call records where we tell you a call is recorded.
When you sign up for marketing: your email address and, if you choose to give it, your mobile number, together with your marketing preferences and the channel(s) you have consented to (email, SMS, WhatsApp or post).
When you take our supplements quiz or use our online tools: the answers you give, which may include information about your health, lifestyle, diet, wellbeing goals, age range and life stage, the email address you give to receive your results, and the results and product recommendations generated for you. See section 4.
When you use our online shopping assistant: the questions you ask and the conversation history, which may incidentally include information you choose to share about your health.
When you register a practitioner account: your professional qualifications, registration body and number, practice name and address, and evidence supporting your application.
When you report an adverse event: if you tell us about a health event after using one of our products, we have a legal duty to record it, which means processing information about your health.
When you visit the Site: technical data such as your IP address, browser and device type, operating system, approximate location, the pages you view, how you reached the Site (for example from a search engine or an advert), what you search for and how you interact with pages. Most of this is collected through cookies and similar technologies — see section 9.
From other sources: delivery status from our carriers; fraud-prevention checks from our payment providers; analytics and advertising data from Google and Meta; and, if you buy through a marketplace such as Amazon, the order information that marketplace passes to us to fulfil your order.
Children: The Site's account, purchasing, quiz and marketing services are intended for adults aged 18 or over. We do not knowingly collect personal data directly from anyone under 18 through these services, and we only send marketing to people who are 18 or over. If you believe a child has provided us with personal data, please contact us so that we can take appropriate action.
3. How we use your personal data and why we are allowed to
Data protection law requires us to have a lawful basis for each use of your personal data. The table below sets out what we do and the basis we rely on. Where we rely on legitimate interests we have considered the impact on you and concluded that our interests are not overridden by your rights.
|
What we use your data for |
Lawful basis |
|
Processing and delivering your orders, taking payment, handling returns and refunds, and managing your account |
Performance of our contract with you |
|
Sending service messages about your order, subscription or account by email, SMS or WhatsApp (dispatch, delivery, renewal reminders, security alerts) |
Performance of our contract with you |
|
Responding to enquiries, complaints and requests |
Legitimate interests (providing customer service) and, where relevant, our contract with you |
|
Sending you marketing by email, SMS, WhatsApp or post |
Consent, which you can withdraw at any time. For email marketing to existing customers about similar products we may rely on the "soft opt-in" under PECR, in which case you can opt out at any time |
|
Generating personalised recommendations from your quiz answers and sending your results |
Your explicit consent for health information; performance of the service you have asked for |
|
Running our online shopping assistant |
Legitimate interests (helping you find information); your explicit consent where you choose to share health information |
|
Verifying practitioner eligibility and managing practitioner accounts |
Performance of our contract with you and legitimate interests (ensuring practitioner pricing goes only to qualified practitioners) |
|
Recording and reporting adverse events |
Legal obligation (food safety and supplement regulation); processing of health data as necessary for reasons of public interest in public health |
|
Keeping accounting, tax and order records |
Legal obligation |
|
Preventing fraud, abuse and security incidents |
Legitimate interests (protecting our business and customers) and legal obligation |
|
Analysing how the Site is used and improving our products, Site and services |
Legitimate interests, and consent for non-essential cookies |
|
Showing you relevant advertising on other websites and social media, and measuring advertising performance |
Consent (via our cookie banner) |
|
Customer surveys and product research |
Consent, or legitimate interests where the survey is optional and no sensitive data is involved |
We do not sell your personal data and we do not use your health information for advertising or for building marketing profiles.
4. Our supplements quiz and online tools
When you take our quiz you answer questions about your health, lifestyle and well-being goals, and give us an email address so we can send your results. Some of your answers are information about your health, which UK data protection law treats as special category data. We only collect and use it with your explicit consent, which you give when you start the quiz, and only to generate your personalised recommendations and send them to you. If you do not wish to give this consent, you can still browse and shop on the Site without taking the quiz.
Your recommendations are generated automatically using AI-assisted software that matches your answers to our product range. They are general wellness suggestions, not medical advice or a diagnosis, and they do not take account of your medical history, medications or conditions. Please speak to your GP or a qualified practitioner before taking supplements if you are pregnant, breastfeeding, taking medication or have a medical condition. The recommendations have no legal or similarly significant effect on you and you are under no obligation to act on them.
Your quiz answers and results are stored against your Metabolics account if you have one so that you can revisit them. If you do not have an account, we keep them for 7 years and then delete them. We do not use your health answers for advertising or profiling for any other purpose, and we share them only with the providers that host our Site, quiz and email systems, who act on our instructions (see section 5). You can ask us to delete your quiz data at any time by emailing sales@metabolics.co.uk.
Receiving your results does not sign you up to marketing. If you would like to hear from us, you can tick the separate box on the results form; leaving it unticked will not affect your results.
Our other tools — such as the heart health calculator and our online shopping assistant — work in a similar way. Information you enter into the calculator is used only to produce your result. Conversations with the assistant are used to answer your questions and to improve the assistant; if you choose to share health information in a conversation, we treat it in the same way as quiz data. Please do not enter information you would not be comfortable being stored.
5. Who we share your personal data with
We share your personal data only where necessary, with:
• Service providers acting on our instructions: our e-commerce platform (Shopify); email and messaging providers (Klaviyo); the WhatsApp Business platform (Meta Platforms) for WhatsApp messages; payment providers (Shopify Payments, PayPal and the other methods shown at checkout); carriers and fulfilment partners; customer service, live chat and review platforms; our quiz and online assistant providers; analytics and advertising providers (Google, Meta); IT, hosting and security providers; and our professional advisers.
• Marketplaces: if you buy through Amazon or another marketplace, that marketplace is a separate controller of the data it holds about you under its own privacy policy.
• Regulators and authorities: food safety and medicines regulators where we are required to report an adverse event; HMRC; the police, courts or other authorities where the law requires or allows us to.
• Prospective buyers: if we sell or restructure our business, personal data may be transferred to the new owner, who will be bound by this policy.
We do not sell, rent or lease your personal data to anyone.
6. International transfers
We are based in the UK, but some of the providers we use store or process data outside the UK — in particular in the United States and the European Economic Area. Where that happens we make sure your data is protected by a mechanism recognised under UK law: an adequacy regulation (for example for the EEA, and for US providers certified under the UK Extension to the EU–US Data Privacy Framework) or the UK International Data Transfer Agreement / Addendum, together with additional safeguards where needed. In the case of a serious adverse event involving a customer outside the UK we may need to report it to the relevant regulator in that country. You can ask us for more information about the safeguards in place by contacting sales@metabolics.co.uk.
7. Marketing: email, post, SMS and WhatsApp
You can choose to receive marketing from us when you create an account, at checkout, in the quiz results form, or by signing up on the Site. We will only send you marketing by the channels you have chosen. Marketing consent is separate from your order and is never a condition of buying from us.
Email and post
If you opt in, we will send you emails about products, offers, articles and news we think you will find useful. If you have bought from us, we may also email you about similar products on the basis of the "soft opt-in", unless you told us at the time that you did not want this. You can unsubscribe at any time using the link in any email.
SMS and WhatsApp
If you give us your mobile number and tick the SMS and/or WhatsApp box, we will send you marketing messages by that channel about products, offers and content. We only send SMS or WhatsApp marketing where you have given us your explicit consent to that specific channel, and only to people aged 18 or over.
You can withdraw your consent at any time by replying STOP to any SMS, replying STOP to (or blocking) our WhatsApp number, updating your preferences in your account, or emailing sales@metabolics.co.uk. Withdrawing consent does not affect service messages we need to send about an order or subscription. Standard network charges may apply to messages you receive or send.
WhatsApp messages are delivered through the WhatsApp Business platform operated by Meta Platforms. Meta processes your number and the content of the messages in order to deliver them, and may transfer that data outside the UK under its own safeguards. Meta's privacy policy for WhatsApp Business explains how it uses that data. Our messages are sent through Klaviyo, which acts on our instructions.
We keep your mobile number for as long as you have an account or an active consent, and delete or anonymise it within 5 years of the later of those ending, unless we need to keep it for an order record.
How to stop all marketing
Click the unsubscribe link in any email, reply STOP to any SMS or WhatsApp message, update your preferences in your account, call +44 (0) 1380 812799, or email sales@metabolics.co.uk. It may take a few days for your request to take effect across all channels.
8. How long we keep your personal data
We keep your personal data only for as long as we need it for the purposes described above, and then delete or anonymise it. In summary:
|
Type of data |
How long we keep it |
|
Order, invoice and payment records |
6 years after the end of the financial year of the order (tax and accounting law) |
|
Account details |
While your account is active, and up to 7 years after your last order or login |
|
Marketing consents and preferences |
While your consent is active; a record that you opted out is kept so we do not contact you again |
|
Quiz answers and results |
While you hold an account; otherwise 7 years |
|
Online assistant conversations |
7 years |
|
Customer service correspondence |
7 years from the last contact |
|
Adverse event reports |
As long as required by the relevant regulator, typically at least 6 years |
|
Practitioner verification documents |
While your practitioner account is active and 7 year after closure |
|
Website analytics data |
Up to 26 months (Google Analytics default), or as set in our cookie tool |
9. Cookies and similar technologies
Cookies are small files placed on your device when you visit the Site. We also use similar technologies such as pixels, tags and local storage. We use them to make the Site work, to remember your preferences, to understand how the Site is used, and — with your consent — to show you relevant advertising.
When you first visit the Site, our cookie banner lets you accept or reject non-essential cookies, and you can change your choices at any time using the Cookie widget at the bottom of the page. Essential cookies cannot be switched off because the Site will not work without them. You can also block or delete cookies through your browser settings, although this may stop parts of the Site working.
We use the following categories of cookies:
|
Category |
What they do |
Examples of providers |
|
Essential |
Run the Site: your basket, checkout, login, security, country and currency selection, and remembering your cookie choices |
Shopify |
|
Functional |
Remember your preferences and enable features such as live chat, reviews, the quiz and the online assistant |
Shopify apps; Lovable |
|
Analytics |
Tell us how visitors use the Site — pages viewed, time on site, where visitors come from — so we can improve it. Data is aggregated where possible |
Google Analytics; Shopify analytics; Klaviyo |
|
Advertising |
Show you our adverts on other websites and social media based on your visit, and measure whether our advertising works |
Google Ads; Meta (Facebook and Instagram); LinkedIn; Tiktok |
A full list of the individual cookies we set, including their purpose and lifetime, is available through the cookie settings tool on the Site.
10. How we keep your personal data secure
We use appropriate technical and organisational measures to protect your personal data, including encryption of data in transit (SSL/TLS) across the Site, secure hosting, access controls so that only staff who need your data can see it, and staff training. Card payments are handled by PCI-DSS compliant payment providers; we never see or store your full card number. Health information from the quiz and adverse event reports is stored with restricted access.
No system is completely secure. If we become aware of a breach affecting your personal data that is likely to put you at risk, we will tell you and the ICO as the law requires.
11. Your rights
Under UK data protection law you have the right to:
• Access the personal data we hold about you (a subject access request), free of charge in most cases.
• Correct data that is inaccurate or incomplete.
• Delete your data in certain circumstances, for example where we no longer need it or you withdraw consent.
• Restrict how we use your data while a query or objection is being resolved.
• Object to processing based on legitimate interests, and to direct marketing at any time.
• Withdraw consent at any time where we rely on it — for example for marketing or for the quiz — without affecting the lawfulness of anything done before you withdrew it.
• Data portability: receive the data you gave us in a machine-readable format, or have it sent to another provider, where we process it by automated means on the basis of consent or contract.
• Automated decisions: our quiz and tools generate suggestions automatically, but we do not make decisions about you that have legal or similarly significant effects solely by automated means. If that changes, you will have the right to ask for human review.
To exercise any of these rights, email sales@metabolics.co.uk, call +44 (0) 1380 812799 or write to us at the address in section 1. We may need to confirm your identity first. We will respond within one month, or tell you if we need longer for a complex request.
If you are unhappy with how we have handled your personal data, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. If you are in the EU, you can contact your local supervisory authority or our EU representative, Prighter (see section 1).
12. Links to other websites
The Site contains links to other websites, including marketplaces and social media. Once you leave the Site those sites' own privacy policies apply, and we are not responsible for how they use your data.
13. Contact
Metabolics Ltd, 5 Eastcott Common, Eastcott, Devizes, Wiltshire, SN10 4PL. Telephone +44 (0) 1380 812799. General enquiries: sales@metabolics.co.uk. ICO registration Z7959510.