Privacy policy.
What we collect, why, who sees it, how long we keep it, and the rights you have over it.
Questions about this policy? Email info@bewellhealth.co.uk or call +44 (0) 1778 560868.
Be Well Health and Nutrition Limited, Unit 20, King Street Industrial Estate, Langtoft, Market Deeping, Peterborough PE6 9NF. Company number 16726088.
Last updated: 8 October 2026 · Version 2026-10
This notice explains how Be Well Health and Nutrition Limited uses personal data when you visit immufix.com, buy from us, subscribe, or contact us. It is written for UK law: the UK General Data Protection Regulation, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003. If anything here is unclear, email us and we will explain it plainly.
Who we are.
Be Well Health and Nutrition Limited is the data controller. That means we decide what personal data is collected and why.
- Registered in England and Wales, company number 16726088.
- Registered office: Eventus, Sunderland Road, Market Deeping, Peterborough PE6 8FD.
- Office and production: Unit 20, King Street Industrial Estate, Langtoft, Market Deeping, Peterborough PE6 9NF.
- Privacy contact: info@bewellhealth.co.uk, or +44 (0) 1778 560868. We do not have a separate data protection officer; the directors handle privacy requests.
- ICO registration: [to be added once registered]
What we collect and why.
Each purpose below lists the data involved, the legal reason we rely on, and how long we keep it. We never sell personal data and we never buy lists.
| Purpose | Data | Legal reason | Kept for |
|---|---|---|---|
| Taking and delivering your order, refunds and returns | Name, email, delivery and billing address, phone number, what you ordered, payment confirmation. Card details go to the payment provider and never reach us. | Performing our contract with you. | 6 years after the end of the financial year of the order, because tax law requires it. |
| Running your subscription | The order data above, your plan, renewal dates and payment status. | Performing our contract with you. | As above. |
| Your customer account | Email, name, addresses, order history. Sign-in is handled by Shopify with a one-time code, so we hold no password. | Performing our contract with you. | While the account is open, then as above for the order records. |
| Sending our email newsletter and welcome offer | Email address, the page you signed up on, the date and time, and the offer code you were given. | Your consent. You give it by entering your email in the newsletter box or the welcome offer. You can withdraw it at any time with the unsubscribe link in any email or by emailing us. | Until you unsubscribe. We then keep only your address on a suppression list for 2 years so we do not email you again by mistake. |
| Answering your questions | Whatever you send us by email, and our reply. | Our legitimate interest in helping customers, or our contract with you if it concerns an order. | 12 months after the conversation ends, longer only if it relates to an order or a complaint. |
| Counting visits without identifying you | Page viewed, referring site, campaign tags in the link, country, device type. No cookie, no identifier. | Our legitimate interest in knowing which pages are read. Nothing here can be traced back to you. | 13 months. |
| Understanding how the site is used, with identifiers | A random visitor id and session id stored in your browser, the pages you view, scrolls, clicks on buttons, items added to the basket, plus the Google Analytics data described under cookies. | Your consent, given by pressing Accept on the cookie panel. Nothing is stored until you do. | 13 months, then deleted. Google keeps its own copy in Google Analytics; you can ask us to delete it. |
| Measuring our Facebook and Instagram ads | The Meta pixel's browser identifier, the pages you view, the buttons you press, when you add to the basket and when you start checkout, and the click id Meta adds to the link if you arrived from one of our ads. If you type your email or name into a form on the site, the pixel also sends Meta a scrambled (hashed) copy so it can match the visit to a Meta account; the readable text never leaves your browser. | Your consent, given by pressing Accept on the cookie panel. The pixel is not loaded until you do. | We hold none of it ourselves. Meta keeps it under its own policy, linked below. |
| Proving what you agreed to | The cookie choice you made, when, which version of this policy, your browser family (for example "Chrome 126") and a hashed version of your IP address that changes daily and cannot be turned back into the address. | Our legal obligation to show that consent was given, and our legitimate interest in stopping one machine flooding the record. | 2 years. |
| Preventing fraud and misuse of the money-back guarantee | Order history, account details and delivery address, checked against earlier claims. This is the check described in the fair-use section of our returns policy. | Our legitimate interest in stopping repeat or false claims. You can object; see your rights below. | As long as the order records. |
| Keeping the site secure | A daily-changing hash of your IP address, used only to rate-limit requests. The raw address is never stored by us. | Our legitimate interest in keeping the site up. | Not stored beyond the day. |
| Legal claims and complaints | Whatever is relevant to the matter. | Our legal obligations and legitimate interest in defending claims. | Until the matter is closed and any limitation period has passed. |
We do not collect special category data and we do not make automated decisions about you that have a legal or similar effect.
Cookies and similar technology.
When you first arrive we ask you to Accept or Reject. Until you answer, nothing is stored on your device except what the site needs to work. Both buttons are the same size and take one click. To change your mind later, use the Cookie preferences link in the footer of every page. Choosing Reject there deletes the Google Analytics and Meta cookies and our visitor id straight away. Your choice itself is kept in a cookie for 180 days so we do not keep asking.
| Name | Set by | What it does | Type | Lasts |
|---|---|---|---|---|
| imx_c | immufix.com | Remembers whether you accepted or rejected, and which policy version you saw. | Necessary | 180 days |
| imx_vid | immufix.com (browser storage) | Random visitor id so we can tell one visit from a return visit. Only created after you Accept. | Analytics, consent | Until you Reject or clear your browser |
| imx_sid | immufix.com (session storage) | Random id for the current visit. Only created after you Accept. | Analytics, consent | Until you close the tab |
| _ga, _ga_* | Google Analytics 4, loaded only after you Accept | Google's visitor and session identifiers. We load Google's tag with advertising storage and personalisation switched off, so it is used for measurement only. The same tag reports to Google Merchant Center for the same purpose. | Analytics, consent | 400 days |
| _fbp, _fbc | Meta pixel, loaded only after you Accept | Meta's browser identifier, and the click id from the ad you arrived on if there was one, so Meta can tell us which of our Facebook and Instagram ads led to a visit or a basket. | Advertising, consent | 90 days |
| ifx_pop, ifx_pop_n | immufix.com | Counts how many times the welcome offer has been shown so it is not shown again for a while. Contains no identifier. | Site function | Up to 90 days, and 365 days |
| ifx_claimed | immufix.com | Set when you claim the welcome offer so it is not offered twice. Contains no identifier. | Site function | 365 days |
| imx_disc | immufix.com | Holds a discount code when you arrive from a share link so it is applied at checkout. | Site function | 14 days |
| ifx-cart-v1, imx-priced-v1 | immufix.com (browser storage) | Your basket, and the price the shop last quoted for it. | Necessary | Basket until cleared; price for 20 minutes |
| Shopify checkout cookies | checkout.immufix.com | Shopify sets its own cookies to run the basket, checkout and your account, for example _shopify_y, _shopify_s and secure_customer_sig. They are described in Shopify's cookie policy. | Necessary for checkout | Set by Shopify, up to 1 year |
The fonts, images and scripts on this site are served from immufix.com itself, apart from Google's and Meta's tags, which load only after you Accept. No social media buttons or chat widgets load on our pages.
Who sees it.
We use a small number of companies to run the shop. Each acts on our instructions under a written contract and may only use the data to provide its service to us.
| Company | What it does for us | Where the data is held |
|---|---|---|
| Shopify International Limited | Checkout, payments, orders, subscriptions and customer accounts. | Ireland, Canada and the United States. |
| Railway Corporation | Hosts this website. Your requests pass through its servers. | United States. |
| Supabase Inc | Our database: visit counts, sessions, visitor ids, email sign-ups, contact messages, a copy of order records, and the consent log. | London, United Kingdom (eu-west-2). |
| Cloudflare Inc | Domain name service and network protection in front of the site. | Global network; it holds no customer records of ours. |
| Google Ireland Limited | Google Analytics 4 and Google Merchant Center measurement, only after you Accept cookies. | European Union and the United States. |
| Meta Platforms Ireland Limited | The Meta pixel, only after you Accept cookies, to measure our Facebook and Instagram ads. For the pixel data we and Meta are joint controllers; Meta's own use of it is set out in Meta's privacy policy. | European Union and the United States. |
| Payment providers | Card, PayPal, Apple Pay, Google Pay and Shop Pay payments, taken through Shopify. We never see your full card number. | As set out in each provider's own notice at checkout. |
| Delivery carriers | Receive your name, address and phone number to deliver your order. | United Kingdom. |
We may also share data where the law requires it, for example with HMRC, a court or the police, and with our accountants and legal advisers under a duty of confidence. If the business is sold, customer records may pass to the buyer, who must use them under this notice.
Sending data abroad.
Our own database is in London. Some of the companies above hold data in the United States, Ireland or Canada. Ireland is covered by the UK's adequacy regulations for the European Economic Area. For the United States we rely on the UK Extension to the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. Canada is covered by a UK adequacy decision for commercial organisations. You can ask us for a copy of the safeguards that apply.
How long we keep it.
- Order and subscription records: 6 years after the end of the financial year in which the order was placed.
- Customer account: while it is open. You can close it by emailing us.
- Email sign-ups: until you unsubscribe, then a suppression entry for 2 years.
- Visit data, sessions and visitor ids: 13 months.
- Consent log: 2 years.
- Contact messages: 12 months after the last message.
These periods are applied automatically to our database. Data that reaches the end of its period is deleted, not archived.
Your rights.
You have the right to:
- Ask for a copy of the personal data we hold about you.
- Have inaccurate data corrected.
- Have your data deleted, where we no longer need it.
- Restrict how we use it while a question is resolved.
- Object to anything we do on the basis of legitimate interests, including the fraud checks described above. We will stop unless we can show a compelling reason not to.
- Withdraw consent at any time: use the unsubscribe link for email, or the Cookie preferences link for cookies. Withdrawing does not affect what was done before.
- Receive the data you gave us in a machine-readable file.
To use any of these rights, email info@bewellhealth.co.uk or write to the office address above. We will reply within one month and will not charge you. We may ask you to confirm your identity first, usually by replying from the email address on the order.
If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk, by phone on 0303 123 1113, or by post to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
Children.
This site and our products are for adults. We do not knowingly collect data from anyone under 18, and we do not aim marketing at them. If you believe a child has given us their details, email us and we will delete them.
Security.
The site is served over HTTPS only. Our database refuses every connection that does not come from our own server, and that server holds the only key. We never store your raw IP address or your card details. Access to customer records is limited to the people who need it to fulfil orders and answer enquiries.
Changes to this notice.
When we change this notice we update the date and version number at the top. If a change affects the cookie choices you have made, the cookie panel will ask you again. If a change affects how we use data you have already given us, we will email you before it takes effect.
Questions about this policy? Email info@bewellhealth.co.uk or call +44 (0) 1778 560868.
Be Well Health and Nutrition Limited, registered office Eventus, Sunderland Road, Market Deeping, Peterborough PE6 8FD. Company number 16726088.