Privacy Policy

Russell's Medical Ltd ('we', 'us', 'our') is a company registered in England and Wales. Our registered office is at 167-169 Great Portland Street, 5th Floor, London, W1W 5PF. We operate as a B2B intermediary in the medicinal cannabis pharmaceutical supply sector and do not provide services directly to patients or members of the public.

For the purposes of UK data protection law, Russell's Medical Ltd is the data controller in respect of personal data collected through this website and in the course of our business activities.

If you have any questions about this policy or wish to exercise your rights, please contact us at: Info@russellsmedical.com

We collect personal data only where it is necessary for a legitimate business purpose. The categories of personal data we may collect include:

Contact and identity information: your name, job title, business email address, and the name and country of your organisation, provided when you submit an enquiry through our website contact form.

Communications data: the content of messages, emails or other correspondence you send to us in connection with a potential or existing business relationship.

Technical data: your IP address, browser type and version, operating system, and pages visited on our website, collected automatically via server logs and, where applicable, analytics tools. This data is used in aggregated, anonymised form and is not used to identify individuals.

We do not collect sensitive personal data (special category data) through this website. We do not collect personal data from patients or members of the public, and our services are directed exclusively at business professionals.

We use personal data collected through our website contact form to respond to your enquiry and to assess whether a business relationship may be appropriate. The legal basis for this processing is our legitimate interests in developing and managing commercial partnerships (Article 6(1)(f) UK GDPR), or, where you have taken a clear step to initiate contact with a view to entering a contract, the steps taken at your request prior to entering a contract (Article 6(1)(b) UK GDPR).

We use technical data to maintain the security and performance of our website, to diagnose technical issues, and to understand how our site is used at an aggregate level. The legal basis for this processing is our legitimate interests in operating a secure and effective online presence.

We do not use your personal data for automated decision-making or profiling. We do not use your personal data for direct marketing without your explicit consent.

We do not sell, rent or trade personal data. We may share personal data with trusted third-party service providers who process data on our behalf and under our instruction, including:

Email and communications infrastructure providers, for the purpose of delivering and receiving correspondence.

Website hosting and technology providers, for the purpose of operating and maintaining this website.

All third-party processors are required to handle personal data in accordance with UK GDPR and are bound by appropriate data processing agreements. We do not transfer personal data outside the United Kingdom or the European Economic Area unless adequate safeguards are in place in accordance with UK GDPR Chapter V.

We may disclose personal data where required to do so by law, by a court order, or by a regulatory authority with jurisdiction over our business.

We retain personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law.

Enquiry and correspondence data is retained for a period of up to three years from the date of last contact, to allow us to manage ongoing or potential business relationships and to comply with any applicable legal obligations.

Technical and server log data is retained for a period of up to 12 months for security and diagnostic purposes.

Where a business relationship is established, we may retain relevant personal data for longer periods in accordance with our contractual and legal obligations, including applicable record-keeping requirements under company law and financial regulation.

Under UK GDPR and the Data Protection Act 2018, you have the following rights in relation to your personal data:

Right of access: you may request a copy of the personal data we hold about you.

Right to rectification: you may ask us to correct inaccurate or incomplete personal data.

Right to erasure: you may ask us to delete your personal data where there is no longer a lawful basis for us to hold it.

Right to restriction: you may ask us to restrict the processing of your personal data in certain circumstances.

Right to object: you may object to processing based on legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.

Right to data portability: where processing is based on consent or contract and carried out by automated means, you may request your data in a structured, commonly used and machine-readable format.

To exercise any of these rights, please contact us at Info@russellsmedical.com. We will respond within one calendar month. We may need to verify your identity before processing your request. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

Our website uses a limited number of cookies and similar technologies to support its operation.

Strictly necessary cookies are required for the website to function correctly. They do not collect personal data for marketing purposes and do not require your consent.

Analytics cookies, where used, collect anonymised information about how visitors use our website, such as which pages are visited most frequently. This data is used solely to improve the website and is not linked to any individual. Where analytics tools are in use, we ensure they are configured to anonymise IP addresses and to comply with UK GDPR.

We do not use advertising, tracking or third-party marketing cookies. You can control and delete cookies through your browser settings. Disabling strictly necessary cookies may affect the functionality of the website.

We take appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction or damage. These measures include the use of encrypted data transmission (TLS/HTTPS), access controls, and regular review of our security practices.

Whilst we take reasonable steps to protect your personal data, no method of transmission over the internet is entirely secure. If you have reason to believe that your interaction with us is no longer secure, please contact us immediately at Info@russellsmedical.com.

Our website may contain links to third-party websites. We are not responsible for the privacy practices or content of those websites. We encourage you to review the privacy policies of any third-party sites you visit.