Your privacy,
in plain English.
We collect health data. That means we take this seriously.
Andro Prime is a UK men's health company. We sell home diagnostic kits and supplement subscriptions, and we operate a founding-member list (a non-cash email opt-in) for men who want to be contacted about our future clinical TRT service when it launches.
Because you share health information with us, this policy matters more than the average privacy page. We've written it to be read, not skimmed.
Who this policy covers: Anyone who visits andro-prime.com, buys a kit or supplement, registers an account, or joins our founding-member list (non-cash email opt-in).
Who We Are
Andro Prime Ltd (trading as Andro Prime)
Registered in England and Wales
Company number: 17185839
Registered address: 128 City Road, London, EC1V 2NX, United Kingdom
Registered with the Information Commissioner's Office
Registration number: ZC172852
If you have any questions about how we handle your data, email us at [email protected]. We'll respond within five working days.
What Data We Collect
Account & Identity
- • Full name
- • Email address
- • Date of birth
- • Password (encrypted, we cannot read it)
We collect this when you register an account or check out as a guest.
Health & Biomarkers
This is the most sensitive data we hold. Depending on your kit, results may include:
- • Total testosterone, SHBG, free testosterone
- • Vitamin D, Active B12, hs-CRP, ferritin
Under UK GDPR, this is processed only on your explicit consent.
Your results are never shared with insurers, employers, or any third party for commercial purposes.
Order & Payment
- • Billing address
- • Order history
- • Payment method details (type and last 4 digits only)
Account Activity
- • Which kit you purchased
- • Results dashboard interactions
- • Active supplement subscriptions
- • Founding-member list membership (email + opt-in timestamp — no payment data)
Communications
- • Emails you send us and our replies
- • Customer support exchanges
- • Survey or feedback responses
Website Usage
- • Pages visited & time on site
- • Device type and browser
- • IP address (anonymised)
- • Referral source
How We Use Your Data
| What we use it for | Legal basis | Data used |
|---|---|---|
| Delivering your kit and processing order | Contract | Identity, order, payment |
| Displaying results in dashboard | Explicit Consent | Biomarker / health data |
| Sending results report by email | Explicit Consent | Health data, email |
| Processing supplement subscription | Contract | Identity, order, payment |
| Sending order confirmations | Contract | Identity, email |
| Sending you confirmation that you've joined the founding-member list | Consent | |
| Recommending supplements based on results | Explicit Consent | Health data |
| Sending marketing emails (opt-in) | Consent | |
| Improving website and services | Legitimate Int. | Usage data (anonymised) |
| Complying with legal obligations (tax) | Legal Obligation | Order, identity |
| Fraud prevention | Legitimate Int. | Order, identity, IP |
We do not use automated decision-making or profiling in a way that produces legal or similarly significant effects on you.
Lab Partner: Vitall
Your blood sample is analysed by Vitall (Healthy Human Labs Ltd), our UKAS-accredited laboratory partner (ISO 15189). Vitall fulfils the kit, coordinates the laboratory analysis, and returns your results to Andro Prime. For the laboratory testing, Vitall acts as a separate, independent data controller in its own right (not a processor acting on our instruction), and is responsible for its own compliance under UK GDPR.
Vitall does not use your health data for their own marketing or product development. Your results are displayed through the Andro Prime dashboard, not Vitall's portal.
Who Else Receives Your Data
We share data with the following third parties. Our payment, hosting and CRM providers act as our data processors under a data processing agreement; Vitall (above) acts as a separate, independent controller for the laboratory testing.
| Provider | Purpose | Data shared |
|---|---|---|
| Vitall | Sample analysis | Name, DOB, sample |
| Stripe | Payment processing | Billing details |
| Customer.io | Email delivery and CRM | Name, email, order data |
| Supabase | Secure database hosting | All account data |
| Vercel | Website hosting | Usage/request data |
We do not sell your data.
We never have.
We do NOT share your data with:
Data Transfers Outside the UK
Some of our service providers are based outside the UK or process data on servers outside the UK. Where this applies, we ensure appropriate safeguards are in place, including UK IDTA-standard contractual clauses or adequacy decisions.
How Long We Keep Your Data
| Data type | Retention period | Reason |
|---|---|---|
| Account and identity data | 3 years after last activity | Operational and support purposes |
| Health / biomarker results | 3 years after last kit purchase | Retest comparison and support |
| Order and payment records | 7 years | UK tax law requirement |
| Email marketing consent | Until withdrawn | Legal obligation |
| Customer support communications | 2 years | Support and dispute resolution |
| Website usage data (anonymised) | 26 months | Analytics platform standard |
When data reaches its retention limit, we delete or anonymise it securely. You can request earlier deletion at any time (see Your Rights).
Cookies
We use cookies and similar technologies to run the site and understand how it is used.
Required for the site to work. These cannot be turned off.
Help us understand how people use the site. We use Google Analytics 4 with IP anonymisation. You can opt out via our cookie banner.
Only set if you consent via our cookie banner.
You can update your cookie preferences at any time via the cookie settings link in the footer.
Your Rights Under UK GDPR
You have the right to:
Request a copy of the data we hold about you.
Ask us to correct inaccurate or incomplete data.
Ask us to delete your data ("right to be forgotten"). Some data must be retained for legal reasons.
Ask us to pause processing your data in certain circumstances.
Receive a copy of your data in a structured, machine-readable format.
Where we rely on consent (e.g. health data), you can withdraw it at any time.
Object to processing based on legitimate interests.
To exercise any of these rights:
Email [email protected] with the subject line "Data Request". We will respond within one calendar month.
If you are unhappy with how we have handled your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO).
Security
We take the following steps to protect your data:
- All data in transit is encrypted (TLS 1.2+)
- All data at rest is encrypted in our database
- Access to health data is restricted to authorised personnel only
- Our database infrastructure (Supabase) is hosted in certified, secure data centres
- We conduct regular access reviews
If we ever discover a breach that affects your rights and freedoms, we will notify you and the ICO within 72 hours as required by law.
Children
Our services are for adults aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe we have done so in error, contact us immediately.
Changes to This Policy
If we make material changes to how we use your data, we will notify you by email and update the "Last updated" date above. Minor updates may be made without notification.
Questions or Concerns?
Andro Prime Ltd
128 City Road
London, EC1V 2NX
United Kingdom
Company Reg: 17185839