KYZN Shop Privacy Policy

Last updated: 22 September 2026

1. Introduction

KYZN Shop respects your privacy and is committed to protecting your personal information.

This Privacy Policy explains how we collect, use, disclose, retain and protect personal information when you:

Visit or use shop.kyzn.co.uk;
Create or use a customer account;
Purchase or enquire about our products;
Join our mailing list;
Contact our customer service team;
Submit a review or participate in a promotion; or
Otherwise interact with KYZN Shop.

This policy also explains your rights under the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (“PECR”).

2. Who we are

KYZN Shop is operated by Stem Cell Clinics Ltd, trading as KYZN Clinics and KYZN Shop.

Company number: 10892393

Registered and trading address: 13 Lichfield Road, Stafford, England, ST17 4JX

Email: clinic@kyzn.co.uk

Telephone: 0121 769 0567

Website: shop.kyzn.co.uk

Stem Cell Clinics Ltd is the data controller responsible for deciding how and why your personal information is used in connection with KYZN Shop.

References in this policy to “KYZN”, “KYZN Shop”, “we”, “us” or “our” mean Stem Cell Clinics Ltd.

Questions about this policy or the use of your personal information should be directed to our Privacy Lead using the contact details above.

3. The personal information we collect

Depending on how you use KYZN Shop, we may collect the following information.

3.1 Identity and contact information

This may include your:

Name;
Billing address;
Delivery address;
Email address;
Telephone number;
Customer account details; and
Preferred method of communication.

3.2 Order and transaction information

This may include:

Products viewed, placed in your basket, saved to your wishlist or purchased;
Order numbers and order history;
Delivery instructions;
Payment status;
Refund, cancellation and return information;
Promotional codes or discounts used; and
Correspondence concerning an order.

3.3 Payment information

Payments may be handled by a specialist payment service provider.

We may receive limited payment-related information, such as:

The payment method used;
The last four digits of a payment card;
Payment confirmation;
Transaction identifiers;
Billing information; and
Whether a payment was accepted or declined.

Full payment-card details are normally entered directly into the payment provider’s secure system and are not stored by KYZN Shop.

The payment provider displayed during checkout will process payment information in accordance with its own privacy notice and security standards.

3.4 Account information

If you create a KYZN Shop account, we may process:

Your login identifier;
An encrypted or securely protected password;
Account preferences;
Saved addresses;
Wishlist items;
Order history; and
Account activity.

You are responsible for keeping your login details confidential and should contact us promptly if you believe that your account has been accessed without permission.

3.5 Communications and customer-service information

We may retain information contained in:

Emails;
Website enquiries;
Telephone enquiries;
Complaints;
Return and refund requests;
Product questions;
Social-media or messaging communications; and
Other correspondence with KYZN Shop.

Telephone calls are not routinely recorded. If call recording is introduced, callers will be informed before recording begins.

3.6 Marketing information

This may include:

Your newsletter subscription;
Marketing preferences;
Consent records;
Responses to promotions;
Email engagement information, such as whether a message was delivered, opened or selected; and
The date and method by which you subscribed or unsubscribed.

3.7 Reviews and user-generated content

If you submit a product review, testimonial, photograph or other content, we may process:

Your name or chosen display name;
Your rating and comments;
Images or other content you submit;
Your order-verification status; and
Technical information used to detect fraudulent reviews.

Reviews may be displayed publicly on KYZN Shop. You should not include medical records, contact details or other sensitive information in a public review.

3.8 Technical and usage information

When you visit the shop, we may automatically collect:

Internet Protocol address;
Browser type and version;
Device type;
Operating system;
Approximate location derived from an IP address;
Referral source;
Pages and products viewed;
Date, time and duration of visits;
Shopping-basket and session information;
Error, security and diagnostic logs; and
Cookie and similar-technology identifiers.

3.9 Health information

Information about physical or mental health is special-category personal data and receives additional legal protection.

Purchasing a particular wellness product does not necessarily establish that you have a medical condition. However, your order history, product enquiry or correspondence may reveal or suggest information about your health.

Please do not send KYZN Shop medical records or detailed health information unless it is necessary for us to respond to your enquiry.

Where we intentionally process health information, we will identify both:

A lawful basis under Article 6 UK GDPR; and
An additional condition under Article 9 UK GDPR.

Depending on the circumstances, this may be:

Your explicit consent;
The provision or management of healthcare by an appropriately qualified professional subject to confidentiality obligations;
The establishment, exercise or defence of legal claims; or
Another condition permitted by applicable law.

We will not use health information to target you with advertising without your explicit consent.

Clinical consultations, diagnoses, treatments and medical records are subject to the separate privacy information provided by KYZN Clinics. This KYZN Shop policy principally concerns online retail activity.

4. How we obtain personal information

We collect information:

Directly from you when you order, register, subscribe or contact us;
Through your use of the website;
From payment processors when they confirm a transaction;
From delivery companies when they provide tracking or delivery information;
From suppliers that dispatch a product directly to you;
From fraud-prevention, identity-verification or security providers;
From publicly available sources where appropriate;
From another person placing an order for you; and
From cookies and similar technologies, subject to applicable consent requirements.

If you provide another person’s information, such as their name and delivery address, you must have authority to do so and should make them aware of this policy.

5. How and why we use personal information

We use personal information only where we have a lawful basis.

5.1 Orders and pre-contract enquiries

We use identity, contact, account, order and transaction information to:

Provide product information;
Process and accept orders;
Take payment;
Send order confirmations;
Arrange delivery;
Manage customer accounts;
Process cancellations, returns and refunds; and
Respond to order-related enquiries.

Our lawful basis is that processing is necessary to enter into or perform our contract with you.

5.2 Legal and regulatory obligations

We use and retain information where necessary to:

Maintain accounting and tax records;
Comply with consumer-protection requirements;
Respond to lawful requests from regulators, courts or public authorities;
Manage product recalls and safety notices;
Investigate suspected fraud or unlawful activity; and
Comply with other legal obligations.

Our lawful basis is compliance with a legal obligation.

5.3 Customer service and business administration

We use personal information to:

Answer questions and manage complaints;
Verify customer and order information;
Operate and improve the website;
Maintain business records;
Train and supervise staff;
Protect our legal rights;
Manage suppliers and service providers; and
Understand the performance of our shop.

Our lawful basis is our legitimate interest in operating a safe, efficient and customer-focused retail business. Where processing is necessary for an order, we may instead rely on contract.

5.4 Website security and fraud prevention

We use account, transaction and technical information to:

Authenticate users;
Secure customer accounts;
Detect suspicious activity;
Prevent fraud and misuse;
Investigate security incidents;
Enforce our terms; and
Maintain the reliability of the website.

Our lawful bases are our legitimate interests in protecting customers, our systems and our business, and compliance with legal obligations where applicable.

5.5 Product reviews

We may use reviews to inform customers about products, verify genuine purchases and improve our service.

Our lawful basis is our legitimate interest in providing reliable product information and obtaining customer feedback. Where we seek separate permission to use a review, name or image in wider advertising, we will rely on consent.

5.6 Direct marketing

If you subscribe to our newsletter, we may email you about KYZN products, offers, giveaways and news.

We rely on:

Your consent where PECR requires it; or
The limited “soft opt-in” permitted by PECR for marketing similar products to an existing customer, where we obtained the contact details during a sale or sale negotiation and offered an opportunity to opt out.

You can unsubscribe at any time by:

Selecting the unsubscribe link in a marketing email;
Changing any available account preference; or
Contacting clinic@kyzn.co.uk.

Unsubscribing will not prevent us from sending service communications needed to administer an order, account, recall, safety notice or legal matter.

We do not sell, rent or disclose our marketing list to unrelated organisations for their own marketing.

5.7 Cookies and similar technologies

We use strictly necessary technologies to operate functions such as:

Shopping baskets;
Checkout;
Login and authentication;
Security;
Session management; and
Remembering privacy choices.

Where we use analytics, advertising or other non-essential cookies or similar technologies, we will request consent before placing or accessing them, unless the law permits otherwise.

Further information appears in section 12.

6. When we share personal information

We may share only the information reasonably necessary with:

6.1 E-commerce and technology providers

The shop is powered by Kubershop, which provides e-commerce technology and related services.

We may also use website-hosting, content-delivery, cloud-storage, cybersecurity, maintenance, communications and technical-support providers.

6.2 Payment providers

Payment providers process payments, carry out security checks and help prevent fraud. They may act as our processor, as a separate controller or in both capacities, depending on the activity.

6.3 Delivery and fulfilment partners

We share names, delivery addresses, contact details and order information with postal operators, couriers, warehouses, manufacturers or suppliers where required to deliver an order or manage a return.

6.4 Professional advisers

We may disclose information to accountants, auditors, insurers, solicitors and other professional advisers where reasonably necessary.

6.5 Regulators and public authorities

We may disclose information where required or permitted by law, including to HM Revenue & Customs, the police, courts, regulators, trading-standards authorities or other competent bodies.

6.6 Business transfers

If our business or assets are sold, reorganised, financed or transferred, personal information may be disclosed to prospective and actual purchasers, investors or advisers, subject to appropriate confidentiality and data-protection safeguards.

6.7 Protecting rights and safety

We may disclose information where reasonably necessary to prevent fraud, protect a person’s safety, investigate wrongdoing or establish, exercise or defend legal claims.

All service providers handling personal information on our behalf must process it only for authorised purposes, keep it secure and comply with applicable data-protection requirements.

We do not sell personal information.

7. International transfers

Some technology, payment, communications or support providers may process information outside the United Kingdom.

Where personal information is transferred internationally, we will ensure that an appropriate safeguard applies. This may include:

A UK adequacy regulation;
The UK International Data Transfer Agreement;
The UK Addendum to the European Commission’s standard contractual clauses; or
Another lawful transfer mechanism.

We will also carry out any required transfer-risk assessment and adopt supplementary safeguards where appropriate.

You may contact us for further information about the safeguards applying to a relevant transfer.

8. How long we keep personal information

We retain information only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting, safety and dispute-management requirements.

Our usual retention periods are:

Order, payment, invoicing, refund and tax records: six years after the end of the financial year in which the transaction was completed;
Customer-account information: while the account remains active and for up to two years after closure or the customer’s last activity, except where information forms part of an order record retained for longer;
Customer-service correspondence and complaints: three years after the matter is closed, or longer where a dispute or legal claim is reasonably anticipated;
Product recall and safety records: for the period reasonably necessary to manage the product’s expected lifecycle and any legal or regulatory requirements;
Marketing records: until consent is withdrawn, the individual objects, or there has been no meaningful engagement for two years;
Marketing suppression records: for as long as necessary to ensure that an unsubscribe request continues to be respected;
Website security and technical logs: normally up to twelve months, unless longer retention is required to investigate a security incident or legal issue;
Uncompleted baskets and related session information: normally no longer than ninety days;
Unsuccessful or abandoned payment information received by us: normally no longer than thirteen months;
Competition and promotion records: up to twelve months after completion, unless the relevant rules or a legal obligation require longer retention; and
Unsolicited health information submitted to the shop: only for as long as necessary to address the enquiry safely, normally no longer than twelve months unless it becomes part of a clinical record, complaint or legal claim.

When information is no longer required, it will be deleted, anonymised or securely destroyed.

9. Data security

We use appropriate technical and organisational measures designed to protect personal information from accidental or unlawful destruction, loss, alteration, disclosure or access.

Measures may include:

Encryption in transit;
Password and access controls;
Restricted staff permissions;
Secure payment processing;
System monitoring;
Security updates;
Backup and recovery arrangements;
Staff confidentiality requirements; and
Supplier due diligence and contractual controls.

No website or electronic transmission can be guaranteed completely secure. You should use a unique password, keep it confidential and avoid sending sensitive information through insecure channels.

If we become aware of a personal-data breach, we will investigate it and notify the Information Commissioner’s Office and affected individuals where required by law.

10. Your data-protection rights

Subject to legal conditions and exemptions, you may have the right to:

Access: obtain confirmation that we process your information and receive a copy;
Rectification: have inaccurate or incomplete information corrected;
Erasure: ask us to delete information in certain circumstances;
Restriction: ask us to limit how information is used;
Data portability: receive certain information in a structured, commonly used and machine-readable format;
Object: object to processing based on legitimate interests;
Object to direct marketing: require us to stop using your information for direct marketing at any time;
Withdraw consent: withdraw consent at any time where consent is the basis for processing; and
Challenge automated decisions: request human intervention where a decision producing legal or similarly significant effects is made solely by automated means.

KYZN Shop does not currently make solely automated decisions that produce legal or similarly significant effects on customers.

Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

To exercise a right, contact clinic@kyzn.co.uk or write to:

Privacy Lead

KYZN Shop

13 Lichfield Road

Stafford

ST17 4JX

Please describe your request clearly. We may ask for reasonable proof of identity before disclosing or changing personal information.

We will normally respond within one month. We may extend this period by up to two additional months for a particularly complex request, in which case we will explain the reason.

We do not normally charge a fee. A reasonable fee may be charged, or a request may be refused, where it is manifestly unfounded or excessive.

11. Complaints

Please contact us first if you have concerns about how we use your information. We will investigate and try to resolve the issue.

You also have the right to complain to the UK supervisory authority:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

Telephone: 0303 123 1113

Website: ico.org.uk

You may complain to the ICO without first contacting us, although the ICO may recommend that you raise the matter with us initially.

12. Cookies and similar technologies

Cookies are small text files stored on a device. We may also use local storage, session storage and similar technologies.

12.1 Strictly necessary technologies

These are required for the shop to function and may support:

Navigation;
Shopping baskets;
Checkout;
Fraud prevention;
Security;
Login sessions;
Customer accounts;
Website availability; and
Privacy preferences.

These technologies do not require consent where they are strictly necessary to provide a service requested by the user.

12.2 Preference technologies

These remember choices such as display preferences or other settings. Where they are not strictly necessary, they will be used only with consent.

12.3 Analytics technologies

Analytics technologies help us understand how visitors use the shop, identify errors and improve performance. Non-essential analytics technologies will be used only with consent.

12.4 Marketing technologies

Marketing technologies may measure advertising, limit repeated advertisements or help present more relevant promotions. They will not be used without the consent required by PECR.

We will not use health information, or information intended to infer a medical condition, for targeted advertising without explicit consent.

12.5 Third-party website services

The shop may use third-party infrastructure and content services, including Kubershop, cloud and content-delivery services, and externally supplied web fonts.

These providers may receive technical information such as an IP address, browser information and request logs when their resources are delivered to a device.

12.6 Managing cookies

Where a cookie-preference tool is available, you can use it to accept, reject or change non-essential choices.

You can also control cookies through your browser. Blocking strictly necessary technologies may prevent the basket, checkout, account or other shop functions from operating correctly.

Withdrawing consent does not affect processing that occurred before withdrawal.

13. Links to other websites

KYZN Shop may link to manufacturers, social-media platforms, payment providers, delivery providers or other third-party websites.

Those organisations are responsible for their own websites and privacy practices. You should read their privacy notices before providing personal information.

A link does not mean that KYZN Shop endorses or controls the third party’s handling of personal information.

14. Social media and messaging services

If you contact or interact with us through Instagram, Facebook, WhatsApp or another external platform, that platform may also process your information as a separate controller.

Your use of those services is governed by the platform’s own privacy terms. Please avoid sending payment-card details, passwords or unnecessary health information through social media or messaging services.

15. Children

KYZN Shop is intended for adults aged 18 and over. A person must be at least 18 to create an account or place an order.

We do not knowingly collect information directly from children through the shop. If we learn that a child has provided personal information without appropriate authority, we will take reasonable steps to delete it.

A parent or guardian who believes that a child has provided information should contact clinic@kyzn.co.uk.

16. Medical and product enquiries

Information published by KYZN Shop is intended for general information and does not replace advice from a GP, pharmacist or other qualified healthcare professional.

If you ask whether a product is suitable for you, we may need limited information about medication, allergies, pregnancy or relevant medical conditions. We will use only the information necessary to respond safely and may recommend that you consult an appropriately qualified healthcare professional.

We do not use health enquiries to make unrelated marketing decisions.

In an emergency, call 999. For urgent medical advice that is not an emergency, contact NHS 111.

17. Changes to this policy

We may update this Privacy Policy when:

Our products, systems or suppliers change;
We introduce new uses of personal information;
Data-protection law or regulatory guidance changes; or
Further clarification is required.

The latest version will be published on shop.kyzn.co.uk with its revision date.

Material changes may also be brought to your attention by email, an account notice or a prominent website notice where appropriate.

18. Contact us

For privacy questions, objections, withdrawal of consent or requests concerning your personal information, contact: