Your privacy,
in plain English.
We collect health data. That means we take this seriously.
Andro Prime is a UK men's health company. We sell home diagnostic kits and supplement subscriptions.
Because you share health information with us, this policy matters more than the average privacy page. We've written it to be read, not skimmed.
Who this policy covers: Anyone who visits andro-prime.com, buys a kit or supplement, or registers an account.
Who We Are
Andro Prime Ltd (trading as Andro Prime)
Registered in England and Wales
Company number: 17185839
Registered address: 128 City Road, London, EC1V 2NX, United Kingdom
Registered with the Information Commissioner's Office
Registration number: ZC172852
If you have any questions about how we handle your data, email us at [email protected]. We'll respond within five working days.
What Data We Collect
Account & Identity
- • Full name
- • Email address
- • Date of birth
- • Password (encrypted, we cannot read it)
We collect this when you register an account or check out as a guest.
Health & Biomarkers
This is the most sensitive data we hold. Depending on your kit, results may include:
- • Total testosterone, SHBG, free testosterone
- • Vitamin D, Active B12, hs-CRP, ferritin
Under UK GDPR, this is processed only on your explicit consent.
Your results are never shared with insurers, employers, or any third party for commercial purposes.
Order & Payment
- • Billing address
- • Order history
- • Payment method details (type and last 4 digits only)
Account Activity
- • Which kit you purchased
- • Results dashboard interactions
- • Active supplement subscriptions
Communications
- • Emails you send us and our replies
- • Customer support exchanges
- • Survey or feedback responses
Website Usage
- • Pages visited & time on site
- • Device type and browser
- • IP address (anonymised)
- • Referral source
How We Use Your Data
| What we use it for | Legal basis | Data used |
|---|---|---|
| Delivering your kit and processing order | Contract | Identity, order, payment |
| Displaying results in dashboard | Explicit Consent | Biomarker / health data |
| Sending results report by email | Explicit Consent | Health data, email |
| Processing supplement subscription | Contract | Identity, order, payment |
| Sending order confirmations | Contract | Identity, email |
| Managing your test bundle and sending the second kit (retest) you have paid for, including scheduling and address confirmation | Contract; plus your explicit consent (Art 9(2)(a)) where we use your first result to decide when the recheck is due (Recheck Bundle) | Identity, order, and (Recheck Bundle only) your first testosterone result |
| Recommending supplements based on results | Explicit Consent | Health data |
| Sending marketing emails (opt-in) | Consent | |
| Improving website and services | Legitimate Int. | Usage data (anonymised) |
| Complying with legal obligations (tax) | Legal Obligation | Order, identity |
| Fraud prevention | Legitimate Int. | Order, identity, IP |
We do not use automated decision-making or profiling in a way that produces legal or similarly significant effects on you.
Automated scheduling of your recheck. If you buy the Recheck Bundle, our system automatically checks whether your first testosterone reading is low in order to decide whether to send your recheck kit now or to hold it as a prepaid credit for your next recommended retest. This is an automated step, but it does not produce a legal or similarly significant effect on you: you receive the retest you have paid for either way, and you can ask us to refund the retest portion instead at any time before it is sent. If you would like a person to review this, email [email protected].
Lab Partner: Vitall
Your blood sample is analysed by Vitall (Healthy Human Labs Ltd), our UKAS-accredited laboratory partner (ISO 15189). Vitall fulfils the kit, coordinates the laboratory analysis, and returns your results to Andro Prime. For the laboratory testing, Vitall acts as a separate, independent data controller in its own right (not a processor acting on our instruction), and is responsible for its own compliance under UK GDPR.
Vitall does not use your health data for their own marketing or product development. Your results are displayed through the Andro Prime dashboard, not Vitall's portal.
Who Else Receives Your Data
We share data with the following third parties. Our payment, hosting and CRM providers act as our data processors under a data processing agreement; Vitall (above) acts as a separate, independent controller for the laboratory testing.
| Provider | Purpose | Data shared |
|---|---|---|
| Vitall | Sample analysis | Name, DOB, sample |
| Stripe | Payment processing | Billing details |
| Customer.io | Email delivery and CRM | Name, email, order data |
| Supabase | Secure database hosting | All account data |
| Hetzner | Website and application hosting (Finland) | Usage and request data |
| Cloudflare | Content delivery, DNS and security | Usage and request data |
We do not sell your data.
We never have.
We do NOT share your data with:
Data Transfers Outside the UK
Your account data and your results are held in the European Economic Area. Our database is in Ireland, our website and application servers are in Finland, and our email provider stores our data in its European Union region. Your payments are handled through our UK Stripe account.
Transfers from the UK to the European Economic Area are covered by the UK's adequacy regulations, so no additional transfer agreement is required for them.
Two of our providers, Cloudflare and Customer.io, are headquartered in the United States even though our data sits in the locations above. For those, we rely on the UK Addendum to the EU Standard Contractual Clauses, which forms part of the data processing terms we accepted with each of them.
We do not transfer your health or biomarker results outside the European Economic Area.
How Long We Keep Your Data
| Data type | Retention period | Reason |
|---|---|---|
| Account and identity data | 3 years after last activity | Operational and support purposes |
| Health / biomarker results | 3 years after last kit purchase | Retest comparison and support |
| Order and payment records | 7 years | UK tax law requirement |
| Bundle / retest scheduling records | Until sent or expires (banked retests expire 12 months after purchase), then per the order and health retention periods above | Delivering the second kit you have paid for |
| Email marketing consent | Until withdrawn | Legal obligation |
| Customer support communications | 2 years | Support and dispute resolution |
| Website usage data (anonymised) | 26 months | Analytics platform standard |
When data reaches its retention limit, we delete or anonymise it securely. You can request earlier deletion at any time (see Your Rights).
Cookies
We use cookies and similar technologies to run the site and understand how it is used.
Required for the site to work. These cannot be turned off.
Help us understand how people use the site. We use Google Analytics 4 with IP anonymisation. You can opt out via our cookie banner.
Only set if you consent via our cookie banner.
You can update your cookie preferences at any time via the cookie settings link in the footer.
Your Rights Under UK GDPR
You have the right to:
Request a copy of the data we hold about you.
Ask us to correct inaccurate or incomplete data.
Ask us to delete your data ("right to be forgotten"). Some data must be retained for legal reasons.
Ask us to pause processing your data in certain circumstances.
Receive a copy of your data in a structured, machine-readable format.
Where we rely on consent (e.g. health data), you can withdraw it at any time.
Object to processing based on legitimate interests.
To exercise any of these rights:
Email [email protected] with the subject line "Data Request". We will respond within one calendar month.
If you are unhappy with how we have handled your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO).
Security
We take the following steps to protect your data:
- All data in transit is encrypted (TLS 1.2+)
- All data at rest is encrypted in our database
- Access to health data is restricted to authorised personnel only
- Our database infrastructure (Supabase) is hosted in certified, secure data centres in Ireland
- We conduct regular access reviews
If we ever discover a breach that affects your rights and freedoms, we will notify you and the ICO within 72 hours as required by law.
Children
Our services are for adults aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe we have done so in error, contact us immediately.
Changes to This Policy
If we make material changes to how we use your data, we will notify you by email and update the "Last updated" date above. Minor updates may be made without notification.
Questions or Concerns?
Andro Prime Ltd
128 City Road
London, EC1V 2NX
United Kingdom
Company Reg: 17185839