Privacy policy.

Bloom Prosthetics(“Bloom”, “we”, “us”) operates this website and shop, including all related information, content, features, products and services (the “Services”). This Privacy Policy describes how we collect, use and share your personal information when you visit the Services, buy from us, or get in touch. If there is a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy applies to how your personal information is handled.

We know that what you share with Bloom can be personal in a way most shopping is not. We collect as little as we need, use it only to make and send your order and to reply to you, and never sell it.

For the purposes of UK data protection law, including the UK GDPR and the Data Protection Act 2018, we are the controller of your personal information.

Personal information we collect

Depending on how you use the Services, we may collect:

• Contact details: your name, email address, phone number if you give one, and delivery address when something is posted to you.
• Order information: what you ordered, the choices you made for it (such as shade, size, projection and feel), any notes you added, gift voucher details including a recipient’s name, email and your message, and any voucher or credit code you used.
• Payment information: confirmation that you have paid, the amount and the payment method type. Your full card details are entered directly with our payment provider and are never seen or stored by us.
• Messages: what you tell us when you contact us, and anything you tell us when we arrange the mould for Mould and Mirror.
• Mailing list: your email address, if you choose to join it.
• Technical information: your IP address and basic information about your browser and device, which our hosting provider records in server logs to keep the Services running and secure.

Information about your health

The notes you add to an order, what you tell us at a fitting, and the messages you send us may reveal information about your health or your body, for example that you have had surgery. The law treats this as special category data, and so do we.

• We use it only to make your order and to reply to you.
• We rely on your explicit consent to process it. The checkout asks for that consent before any notes are sent to us, and you can withdraw it at any time by emailing [email protected]. Withdrawing consent does not affect anything we did before you withdrew it, though we may not be able to make a bespoke piece without the details it needs.
• We never use it for marketing, and never share it with anyone for their own use.

How we use your personal information

• To make and deliver your order: taking payment, making your Bloom, posting it, arranging fittings and moulds, issuing gift vouchers and credit codes, and sending you emails about your order.
• To communicate with you: replying to your messages and helping with anything about your order.
• To send you news: only if you have joined the mailing list.
• Security and fraud prevention: protecting the Services, our customers and us.
• Legal reasons: keeping the records the law requires, and responding to valid legal requests.

Our legal bases

We process order information because it is necessary to perform the contract you entered into when you ordered. We process messages and security information on the basis of our legitimate interests in replying to you properly and keeping the Services safe. We keep financial records because the law requires it. We send mailing list emails with your consent. Health information is processed with your explicit consent, as described above.

The providers behind this shop

Rather than list categories alone, here are the services that actually handle your information:

• Railway hosts this website and the database that holds your orders, delivery details and order history.
• Stripe processes payments. Your card details go straight to Stripe and are never seen or stored by us.
• Klarna, if you choose to pay with it at checkout. Klarna carries out its own checks and acts under its own privacy notice for them, which it shows you before you agree.
• Resend delivers our emails: order confirmations, dispatch notices, gift vouchers, replies to your messages, and mailing list sign ups to our inbox.
• Royal Maildelivers posted orders. Through its Click & Drop service we share your name, delivery address, email address, your phone number if you gave one, and a description of what is in the parcel, so it can produce the postage label and send you tracking updates.
• Mapbox draws the map on our fitting page. Loading that map tells Mapbox your approximate location and browser, and Mapbox keeps a small usage record in your browser. It only loads on the page that shows the map.

Each of these processes your information on our instructions and under contract, except where they act under their own privacy notice as stated above. We may also disclose information where the law requires it, to protect our rights or those of others, or as part of a sale or transfer of our business.

Your basket, cookies and tracking

Your basket is stored in your own browser, using its local storage, and does not leave your device until you check out. The sales admin uses a cookie to keep its owner signed in, which is never set for customers. Our payment provider may use cookies it needs to take payment securely, and Mapbox keeps a small usage record in your browser when you open the map on our fitting page.

If you arrive through a link shared by one of our affiliates, we set one cookie, for 30 days, naming that link, so that they can be credited if you order. It holds nothing about you, is only read by us when you check out, and is never shared. The affiliate sees that a sale was made through their link, its date and its value, never who you are or what you bought.

We do not use analytics cookies, advertising cookies or tracking pixels, so there is nothing to accept or decline.

Affiliates

If you are one of our affiliates, we keep your name, email address and the sales made through your links, to pay you what you have earned. We email you a link to sign in, and a cookie keeps you signed in for 30 days.

The mailing list

If you join the mailing list, in the footer or in the pop up that offers a discount code, your email address is sent to the Bloom inbox through Resend, and the pop up emails you the code. We use your address only to send you news from Bloom. You can ask to be removed at any time by replying to any email from us or writing to [email protected].

Before you Bloom

If you order a Bloom, we email you two short forms: one before your Bloom, and one four weeks after it reaches you. Taking part is optional. If you do, we keep your answers with your order. They describe how you feel about your body, which is health information, so we only keep them with your explicit consent, given by the tick box on the form. We use them to understand the difference Bloom makes, and share them only as anonymous totals, for example with funders and partners, never with your name or anything that could identify you. Anything you write is quoted only if you tick the box that allows it, and then without your name. You can ask us to delete your answers at any time by writing to [email protected].

Refer a friend

Your refer a friend code is linked to your email address so we can thank you when a friend uses it. We do not tell you who used it, and we do not tell them who you are.

How long we keep it

Order records are kept for six years, because UK tax law requires it. Correspondence is kept for two years. Anything else is deleted when it is no longer needed for the reason it was collected, or to meet our legal obligations, resolve disputes or enforce our terms.

Security

We take care to protect your information, and our providers do the same. No system is perfectly secure, though, so please do not send us card details or anything else sensitive by email.

Children

The Services are not intended for children, and we do not knowingly collect personal information from anyone under 18. If you believe a child has given us their information, contact us and we will delete it.

International transfers

Some of our providers may process your information outside the UK. Where they do, we rely on recognised safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the European Commission’s Standard Contractual Clauses, unless the country has been found to provide an adequate level of protection.

Your rights

Under UK data protection law you have the right to:

• ask for a copy of the personal information we hold about you;
• ask us to correct anything that is wrong;
• ask us to delete your information, where we have no reason to keep it;
• ask us to restrict or object to how we use it;
• receive your information in a portable form; and
• withdraw your consent at any time, where we rely on it.

To use any of these rights, email [email protected]. We may need to confirm your identity first, and we will reply within one month.

Complaints

If you are unhappy with how we have handled your information, please tell us first so that we can put it right. You also have the right to complain to the Information Commissioner’s Office, the UK’s data protection regulator, at ico.org.uk.

Changes to this policy

We may update this Privacy Policy from time to time. We will post the new version here, change the date at the top, and tell you directly where the law requires it.

Contact

For any question about your privacy, or to use any of your rights, email us at [email protected].