1. Who we are
BionicMed Ltd is a company registered in England and Wales. Companies House number: 15625674. Our registered office and main trading address:
BionicMed Ltd68 St Margarets Road
Edgware, London HA8 9UU
United Kingdom
For the purposes of UK GDPR and EU GDPR, BionicMed Ltd is the data controller of personal data collected through this website (bionicmed.eu) and in the course of our business activities.
To contact us about data protection matters, our contact form
2. Data we collect
We collect personal data in the following ways:
2.1 Data you provide directly
- Contact enquiries: name, company, email address, job title, and the content of your message when you use our contact form.
- Business correspondence: contact details and communication history when you email, call, or otherwise communicate with us.
- Partnership and commercial discussions: professional details, company information, and negotiation records.
2.2 Data collected automatically
- Usage data: IP address (anonymised), browser type and version, pages visited, time spent, referring URL, and device type — collected via Google Analytics 4 only with your consent.
- Technical data: your cookie preferences and accessibility settings, stored locally in your browser (localStorage). This data never leaves your device.
2.3 Data we do not collect
BionicMed Ltd does not collect or process:
- Health, medical, or clinical data of any individual through this website.
- Special categories of personal data as defined in UK GDPR Article 9.
- Payment card or banking information.
- Data from children under 16 years of age.
3. How we use your data
We use personal data for the following purposes:
| Purpose | Data used | Legal basis |
|---|---|---|
| Responding to your contact form submission or enquiry | Name, email, company, message | Legitimate interests / Pre-contractual steps |
| Managing business relationships and commercial discussions | Professional contact details, correspondence | Legitimate interests / Contract performance |
| Understanding how visitors use our website and improving it | Anonymised usage data (GA4) | Consent |
| Complying with legal obligations (e.g. tax, company law) | Business records | Legal obligation |
| Protecting our legal rights | Relevant correspondence and records | Legitimate interests |
4. Legal bases for processing
Under UK GDPR Article 6, we rely on the following legal bases:
- Legitimate interests (Article 6(1)(f)): For responding to business enquiries, managing commercial relationships, and maintaining website security. We have balanced our interests against yours and concluded our processing does not override your rights and freedoms.
- Pre-contractual steps (Article 6(1)(b)): When you enquire about our services and we respond in preparation of a potential contract.
- Legal obligation (Article 6(1)(c)): Where we are required to retain records under UK company, tax, or employment law.
- Consent (Article 6(1)(a)): For optional analytics cookies (Google Analytics 4). You may withdraw consent at any time via the Cookie Settings link in our footer.
6. International transfers
Our primary operations are in the United Kingdom. Where we transfer personal data to processors located in countries outside the UK or EEA (for example, to Google LLC in the United States), we ensure appropriate safeguards are in place:
- UK adequacy decisions under the Data Protection Act 2018, section 17A.
- EU-US Data Privacy Framework where applicable.
- UK International Data Transfer Agreements (IDTAs) or UK Addendum to EU Standard Contractual Clauses where adequacy does not apply.
You may request details of the specific safeguards applicable to any transfer via our contact form.
7. Data retention
We retain personal data only as long as necessary for the purpose for which it was collected, or as required by law:
- Contact form submissions / business enquiries: Up to 3 years from last contact, unless a commercial relationship develops (in which case, see below).
- Commercial/contractual records: 7 years from the end of the relevant financial year, in accordance with UK Companies Act 2006 and HMRC requirements.
- Analytics data (GA4): 14 months (Google Analytics default retention period, applied where analytics consent is given).
- Cookie preferences / accessibility settings: Stored locally in your browser until cleared. Never transmitted to our servers.
When data is no longer required, it is securely deleted or anonymised.
8. Your rights
Under UK GDPR (and EU GDPR for EEA residents), you have the following rights:
- Right of access (Article 15): You may request a copy of the personal data we hold about you and information about how we process it.
- Right to rectification (Article 16): You may ask us to correct inaccurate or incomplete personal data.
- Right to erasure (Article 17): You may ask us to delete your personal data in certain circumstances, including where it is no longer needed for the original purpose.
- Right to restriction of processing (Article 18): You may ask us to restrict how we process your data while a dispute is resolved.
- Right to data portability (Article 20): Where processing is based on consent or contract and carried out by automated means, you may receive your data in a structured, machine-readable format.
- Right to object (Article 21): You may object to processing based on legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.
- Rights related to automated decision-making (Article 22): We do not carry out solely automated decision-making that produces legal or similarly significant effects on individuals.
- Right to withdraw consent: Where processing is based on your consent (analytics cookies), you may withdraw it at any time via our Cookie Settings without affecting the lawfulness of prior processing.
How to exercise your rights
Submit requests via our contact form. We will respond within one calendar month (extendable by two further months for complex requests, with notice). We may ask you to verify your identity before fulfilling a request.
Right to complain
If you believe we have not handled your data lawfully, you have the right to lodge a complaint with the supervisory authority:
- UK: Information Commissioner's Office (ICO) — ico.org.uk — 0303 123 1113
- EU: The data protection authority in your EU member state of residence.
We would, however, appreciate the opportunity to address any concern before you approach a regulator.
10. Security
We implement appropriate technical and organisational measures to protect your personal data against accidental loss, unauthorised access, disclosure, or destruction. These include:
- HTTPS encryption for all data in transit.
- Access controls limiting data access to authorised personnel only.
- Regular review of our security practices.
No method of transmission over the internet is 100% secure. In the unlikely event of a personal data breach that poses a risk to your rights and freedoms, we will notify the ICO within 72 hours and, where required, notify you directly.
11. Children
This website is directed at business professionals and is not intended for individuals under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please use our contact form and we will delete it promptly.
12. Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, or legal requirements. We will update the "Last updated" date at the top of this page and, for material changes, draw your attention to the revision on our website. Your continued use of the website after any update constitutes acceptance of the revised policy.
Previous versions of this policy are available on request.
13. Contact us
For any questions, requests, or concerns relating to this Privacy Policy or our data processing activities:
BionicMed Ltd — Data PrivacyUse our contact form →
Please select Data Privacy as the subject.
We aim to acknowledge all privacy enquiries within 5 business days and resolve them within one calendar month.