Privacy policy
Sefam Medical Ltd — sefam.co.uk Last updated: 11th August 2026
This policy explains what personal information we collect when you visit or buy from sefam.co.uk, why we collect it, who we share it with, how long we keep it, and what rights you have.
Sefam Medical Ltd is the data controller for the information described here.
1. Who we are and how to contact us
Sefam Medical Ltd Unit 6, Blackthorn Way, Five Mile Business Park, Lincoln, LN4 1BF, United Kingdom Company number: 13500192
Email: customerserviceuk@sefam-medical.com
If you have a question about this policy, want to exercise your rights, or wish to make a complaint, please email us using the address above.
2. Information we collect and why
| What we collect | Why | Our lawful basis |
|---|---|---|
| Order information — name, billing and delivery address, email address, telephone number, order contents | To take and fulfil your order, arrange delivery, issue confirmations and invoices, and handle returns | Performance of our contract with you |
| Payment information — processed by our payment providers; we do not store full card details | To take payment and to check for fraud | Performance of our contract; our legitimate interests in preventing fraud |
| VAT relief declaration — your confirmation that you are chronically sick or disabled and that the goods are for personal use | To supply goods free of VAT and to keep the record HMRC requires | See section 3 |
| Correspondence — emails you send us and our replies, including any sizing or product queries | To answer your question and keep a record of what was agreed | Performance of our contract; our legitimate interests in running a support service |
| Device and usage information — IP address, browser type and version, time zone, pages and products viewed, search terms, referring site | To load the site correctly, keep it secure, and understand how it is used so we can improve it | Our legitimate interests in operating and improving the site; your consent where cookies are not strictly necessary |
| Review invitations — name, email address and order reference | To invite you to review your purchase | Our legitimate interests in obtaining genuine customer feedback |
We do not buy personal information from third parties, and we do not sell your personal information.
3. Health information and your VAT relief declaration
3.1 Because of what we sell, some of the information you give us concerns your health. Information about health is "special category data" under the UK GDPR and receives additional protection.
3.2 Specifically:
- when you complete the VAT relief declaration in your basket, you tell us that you are chronically sick or disabled, or are buying for someone who is
- the fact that you have bought CPAP therapy products may itself indicate that you or someone in your household has obstructive sleep apnoea
- if you contact us for sizing or product help, you may choose to tell us about your condition or your therapy
3.3 Our lawful basis. We process this information on the basis of your explicit consent, given when you complete the declaration at checkout (UK GDPR Article 9(2)(a)). You do not have to make the declaration — but we cannot supply goods free of VAT without it.
3.4 How we use it. We use your declaration solely to establish your entitlement to VAT relief and to keep the record HMRC requires of us. We do not use it for marketing, we do not use it to build a profile of you, and we do not share it with anyone other than HMRC or our accountants and auditors where required.
3.5 How we protect it. Access is restricted to staff who need it to process orders or to meet our accounting and tax obligations.
3.6 Withdrawing consent. You may withdraw your consent at any time by emailing us. Withdrawal does not affect processing that has already taken place, and we may still need to keep your declaration to meet our legal obligations to HMRC — see section 6.
3.7 We are not your healthcare provider and we do not hold clinical records about you. For anything relating to your diagnosis, prescription or therapy settings, please contact your sleep clinic or treating clinician.
4. Who we share your information with
We share personal information with the following categories of recipient, and only where they need it:
4.1 Shopify — our online store platform, which processes orders and hosts the site on our behalf. Shopify's privacy policy: shopify.com/legal/privacy
4.2 Payment providers — to process your payment securely. Card details are handled by the payment provider, not by us.
4.3 Delivery carriers — your name, delivery address and, where relevant, contact details, so your order can be delivered.
4.4 Trustpilot — where we invite you to leave a review, we share your name, email address and order reference with Trustpilot for that purpose only. Trustpilot's privacy policy is available on their website.
4.5 Analytics and advertising providers — where you have consented to non-essential cookies, information about your use of the site may be shared with providers such as Google. See sections 5 and 7.
4.6 Professional advisers — our accountants, auditors and, where necessary, legal advisers.
4.7 HMRC and other authorities — where we are required to do so by law, including our VAT record-keeping obligations, or to establish or defend legal claims.
5. Cookies and similar technologies
5.1 A cookie is a small file placed on your device when you visit a website. We use cookies in the following categories:
- Strictly necessary — required for the site to function: keeping your basket, processing checkout, keeping your session secure, and remembering your cookie preferences. These do not require your consent.
- Analytics — helps us understand how the site is used so we can improve it.
- Advertising — used to measure the performance of our advertising and, in some cases, to show you relevant ads on other sites.
5.2 We ask for your consent before setting analytics or advertising cookies. You can change or withdraw your preferences at any time using the cookie settings on our site.
5.3 You can also block or delete cookies through your browser settings. Blocking strictly necessary cookies will stop parts of the site working, including the basket and checkout.
5.4 A current list of the cookies used by our store platform is maintained by Shopify and is available in their documentation. We have not reproduced it here because it changes over time and a copied list would quickly become inaccurate.
5.5 Do Not Track. There is no agreed industry standard for responding to browser "Do Not Track" signals, and we do not currently alter our practices in response to them. You can control non-essential cookies using our cookie settings instead.
6. How long we keep your information
| Information | Retention period |
|---|---|
| Order records, invoices and VAT relief declarations | 6 years from the end of the financial year in which the order was placed, to meet HMRC record-keeping requirements |
| Customer service correspondence | 2 years from the end of the enquiry, unless it relates to a dispute, in which case until the matter is resolved and any limitation period has expired |
| Account information, where you create an account | Until you ask us to delete it, or after a prolonged period of inactivity |
| Analytics information | As set by our analytics provider, ordinarily no more than 14 months |
| Review invitation records | For as long as needed to send the invitation and handle any follow-up |
Where we no longer need your information, we delete it or anonymise it so it can no longer be linked to you.
7. Analytics and advertising
7.1 We use analytics tools to understand how visitors use our site so we can improve it. Where those tools rely on non-essential cookies, we only use them with your consent.
7.2 We may advertise our products online, including through Google. Where you have consented, our advertising providers may use cookies to measure whether an advert led to a visit or a purchase, and to show our adverts to people who have visited our site.
7.3 We do not use information about your health, or your VAT relief declaration, for advertising or audience targeting of any kind.
7.4 You can opt out of personalised Google advertising at myadcenter.google.com, and manage broader opt-outs through the Digital Advertising Alliance at optout.aboutads.info and the Network Advertising Initiative at optout.networkadvertising.org.
8. International transfers
8.1 Some of our service providers, including Shopify, process personal information outside the United Kingdom.
8.2 Where information is transferred outside the UK, we rely on one of the safeguards permitted by UK data protection law — either the country having UK adequacy status, or contractual protections such as the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
8.3 You can ask us for more information about the safeguards applying to a particular transfer by emailing us.
9. Your rights
9.1 Under the UK GDPR you have the right to:
- be informed about how we use your information — this policy
- access the personal information we hold about you
- have inaccurate information corrected
- have your information erased, where we have no continuing lawful reason to keep it
- restrict how we use your information while a concern is being resolved
- object to processing based on our legitimate interests
- receive your information in a portable format, or have it transferred to another provider (data portability)
- withdraw consent at any time, where we rely on consent
9.2 To exercise any of these rights, email customerserviceuk@sefam-medical.com. We will respond within one month. There is no charge, and we may ask you to confirm your identity first.
9.3 Some rights are not absolute. For example, we may not be able to erase order records or VAT relief declarations that we are legally required to retain.
10. Children
The site is intended for adults aged 18 or over and we do not knowingly collect information from children. If you believe a child has provided us with personal information, please email us and we will delete it.
11. Automated decision-making
11.1 We do not make decisions about you by fully automated means that have a legal or similarly significant effect.
11.2 Our platform provider applies limited automated checks to prevent fraud, such as temporarily blocking IP addresses or payment cards associated with repeated failed transactions. These checks are short-lived and do not have a legal or similarly significant effect on you. If an order of yours is declined and you believe this is wrong, contact us and a person will look at it.
12. Security
We take appropriate technical and organisational measures to protect your information, including encrypted connections to our site and checkout, restricted staff access, and the use of reputable processors. No system can be completely secure, but if a breach occurred that was likely to result in a risk to your rights, we would notify the Information Commissioner's Office and, where required, you.
13. Changes to this policy
We may update this policy to reflect changes in our practices or for legal or regulatory reasons. The date at the top shows when it was last revised. Where changes are significant, we will take reasonable steps to bring them to your attention.
14. Complaints
14.1 If you are unhappy with how we have handled your information, please contact us first at customerserviceuk@sefam-medical.com so we have the chance to put it right.
14.2 You also have the right to complain to the UK's data protection regulator:
Information Commissioner's Office Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF Helpline: 0303 123 1113 ico.org.uk/make-a-complaint
