Privacy notice
How Matrix Health And Wellness Ltd collects and uses personal data when you use matrixhealthuk.com, place a research-supply order, or contact us.
Last updated (draft): 1 September 2026. This version is for internal approval and must not be treated as the live notice until the draft banner is removed.
1. Who we are
Matrix Health And Wellness Ltd (“we”, “us”, “our”) operates the website at https://matrixhealthuk.com and sells research-use-only (RUO) peptides and laboratory supplies to qualified researchers in the United Kingdom.
We are the data controller for personal data collected through this website, our contact form, WhatsApp order channel, customer accounts, and order fulfilment. Questions about this notice, or any request to exercise your rights, should be sent to admin@matrixhealthuk.com.
This notice is written for a small e-commerce operation. It is not a medical-privacy notice. We do not provide healthcare, clinical advice, or regulated medicines, and we do not process patient records.
2. The data we collect
We only collect what we need to run the shop, answer enquiries, and keep the site secure.
| Source | Typical data | Why we use it |
|---|---|---|
| Contact form (homepage and contact.html) | Name, email address, subject, message content | To reply to order, product, CoA, wholesale, or general questions. Messages are sent to admin@matrixhealthuk.com. |
| WhatsApp orders and chat | Mobile number, WhatsApp profile name, message history, order contents, delivery name and UK address, payment confirmation you send us | To take and confirm orders, arrange dispatch, and answer questions. The public number is +44 7347 653219. We aim to respond 9am–9pm UK time, every day. |
| Customer accounts (Supabase) | Email address, password hash (we do not store your password in plain text), sign-in timestamps, order history linked to your account | To let you create an account, sign in, and view “My Orders”. |
| Checkout and fulfilment | Billing/delivery name, UK delivery address, email, phone if provided, basket contents, order reference, shipping preference | To fulfil UK research-supply orders, calculate shipping (£5, free over £75), and handle after-sales queries. |
| Bank / Wise payments | Payer name, payment reference, amount, date, and the limited payment metadata our bank or Wise shows us | To match your payment to an order and keep accounting records. We never ask you to publish bank details in a public webpage. |
| Cryptocurrency payments | Public blockchain transaction ID, asset (BTC, USDT, or LTC), amount, and the time we received it | To confirm payment. Blockchain records are public and we cannot make them private after you send a transaction. |
| Card payments (Stripe) | Not currently collected. Card, Apple Pay, and Google Pay are disabled on the live checkout. If Stripe is later enabled, card numbers would be handled by Stripe, not stored on our servers. | There is no live card processing today. This row is here so the notice stays accurate if that changes — we will update this page first. |
| Reseller applications (resellers.html) | Name, business name, email, phone, website, business type, volume, and the description you submit | To review wholesale / reseller applications. Use admin@matrixhealthuk.com for these, not a personal mailbox. |
| Cloudflare (hosting, security, analytics) | IP address, browser and device type, pages requested, approximate location derived from IP, security/challenge events, and aggregated traffic statistics | To serve the site, absorb abuse, obfuscate email addresses, and understand aggregate use of the public pages. We do not use this to build marketing profiles of individual researchers. |
| Cookies and local storage | See section 7 | Basket, theme, sign-in session, security challenges, and (if enabled) Cloudflare analytics. |
Please do not send us special-category data (for example health, genetic, or biometric data) or anyone else’s personal data in a contact form or WhatsApp message. If you do, we will delete it unless we must keep it to deal with a legal complaint.
3. Contact form
The homepage form and the form on contact.html collect name, email, and message (contact.html also asks for a subject). Submissions are used only to answer you. We keep enquiry emails for as long as needed to finish the conversation and for a short period afterwards in the mailbox, then delete or archive them with other business correspondence.
Legal basis: legitimate interests (Art. 6(1)(f) UK GDPR) in responding to people who contact a small supplier; or steps prior to a contract (Art. 6(1)(b)) if the message is about an order.
4. WhatsApp orders
You can message us on WhatsApp at +44 7347 653219. We use WhatsApp to take order details, send payment instructions, confirm dispatch, and answer research-supply questions. Hours stated on the site are 9am–9pm UK time, every day; messages outside those hours are read when we next open the inbox.
WhatsApp is a Meta service. When you use it, Meta also processes your data under its own terms. Do not send identity documents, card numbers, or seed phrases over WhatsApp. Send only what we need to pack and post the order.
Legal basis: contract (Art. 6(1)(b)) for order handling; legitimate interests (Art. 6(1)(f)) for general chat.
5. Accounts (Supabase)
If you create an account, authentication and account records are hosted with Supabase. We use this so you can sign in and view orders on orders.html. We store your email and a hashed password; we do not see your password. Session tokens may be stored in cookies or browser storage so you stay signed in.
You can ask us to close the account by emailing admin@matrixhealthuk.com. We will delete or anonymise the login, except for order records we must keep for tax and accounting.
Legal basis: contract (Art. 6(1)(b)); legitimate interests in securing the account (Art. 6(1)(f)).
6. Payments — Wise / bank and crypto
We currently accept Faster Payments / bank transfer (including Wise where you choose to pay that way) and cryptocurrency (Bitcoin, USDT, and Litecoin, as shown in the site footer). Card payments through Stripe are not enabled.
Bank and Wise payments show us the name and reference attached to the transfer. We use that only to reconcile the order. Cryptocurrency payments are confirmed on the relevant public ledger. Those ledgers are permanent; we cannot erase a broadcast transaction. We do not publish wallet addresses on this privacy page.
Legal basis: contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) for records we must keep under UK tax and company law (generally six years for accounting records).
7. Cookies, local storage, and analytics
We use a small set of cookies and similar storage. The site is a custom static HTML/JS shop on Cloudflare, not a large marketing stack.
| Type | Examples | Purpose |
|---|---|---|
| Strictly necessary | Shopping-basket storage, checkout/order reference storage, Cloudflare security/challenge cookies, research-use acknowledgement | Make the shop work, keep the basket, and protect the site. These do not require consent. |
| Account | Supabase session / email cookies or local storage used to keep you signed in | Remember your login on return visits. Set only if you create or use an account. |
| Preference | Light/dark theme toggle | Remember display choice. Functional; low privacy impact. |
| Analytics / performance | Cloudflare analytics or equivalent Cloudflare traffic metrics | Aggregate page performance and visit counts. We do not sell this data or use it for advertising. If we add a non-essential analytics cookie that is not strictly necessary, we will ask before setting it. |
You can clear cookies and site storage in your browser. The basket and sign-in will reset if you do. We do not currently run advertising pixels, Google Analytics, or Meta Pixel on the public shop.
8. Cloudflare
The site is served through Cloudflare. Cloudflare provides content delivery, TLS, DDoS and bot protection, email-address obfuscation, and traffic analytics. That means Cloudflare processes IP addresses and request logs as an independent controller or as our processor, depending on the product. See Cloudflare’s own privacy notice for the detail of those services. We use Cloudflare because a small shop cannot reasonably self-host equivalent security.
9. Who we share data with
We do not sell personal data. We share it only with the people and processors needed to run the business:
- Cloudflare — hosting, security, analytics, as above.
- Supabase — account authentication and related database storage.
- WhatsApp / Meta — if you choose to message us there.
- Our bank and Wise — if you pay by bank transfer.
- Blockchain networks — if you pay in crypto (public by design).
- Royal Mail or the courier we use to send your parcel — name, UK address, and contact number if needed for delivery.
- Professional advisers (accountant, solicitor) and HMRC — where required to keep proper records or respond to a lawful request.
- Law enforcement or regulators — only if the law requires it.
We do not share customer lists with other peptide vendors or marketing lists.
10. International transfers
Some processors (including Cloudflare, Supabase, Meta/WhatsApp, and Wise) may process data outside the United Kingdom. Where that happens we rely on the UK-US data bridge where it applies, or on the UK International Data Transfer Agreement / UK Addendum to the EU Standard Contractual Clauses, plus the processor’s own safeguards. Crypto networks have no single country of processing.
11. How long we keep data
- Enquiries with no order: usually up to 12 months after the last reply, unless needed longer for a dispute.
- Orders, invoices, and payment records: at least six years after the end of the tax year, as required for UK accounting.
- Account logins: for as long as the account is open, then deleted or anonymised on request except where an order record must remain.
- WhatsApp chats: for the life of the order plus a short operational period, then cleared from the device/inbox in line with how we manage other correspondence.
- Cloudflare security logs: according to Cloudflare’s retention for the plan we use, typically a short rolling window of traffic logs plus aggregated analytics.
12. Your rights
Under UK GDPR you can ask us to: access your data; correct it; delete it (where we have no legal need to keep it); restrict or object to certain processing; and receive a copy in a portable format where the legal basis is consent or contract and the processing is automated. You can also complain to the Information Commissioner’s Office at ico.org.uk, or by writing to the ICO, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
To use these rights, email admin@matrixhealthuk.com from the address we hold for you. We may need to verify it is you. We will answer within one month, or tell you if we need more time.
We have not appointed a Data Protection Officer. For a company of this size that role is not required. The director, Andrew James Mowles, is the person responsible for privacy queries, via the email above.
13. Age and research-use context
The shop is for qualified researchers aged 18 or over. We do not knowingly collect data from children. Research chemicals sold on this site are for in vitro and laboratory research only — not for human or veterinary consumption — so we do not use this site to collect clinical or dosing information about you.
14. Automated decisions
We do not use automated decision-making or profiling that produces legal or similarly significant effects. Basket, promo-code, and shipping totals are simple price calculations.
15. Changes
If we change how we use data in a material way (for example enabling Stripe, adding a new analytics tool, or appointing a DPO), we will update this page and change the “Last updated” date. Continued use of the site after that date is the notice of the new version.
16. How to contact us
Email: admin@matrixhealthuk.com
WhatsApp: +44 7347 653219 (9am–9pm UK time)
Registered office: 71–75 Shelton Street, Covent Garden, London WC2H 9JQ
Dispatch / operations are described on the site as Camden, London, United Kingdom.
Please use admin@matrixhealthuk.com for privacy requests. Do not send them to a personal iCloud or Gmail address.