CPAP Store London – Privacy Policy

Effective Date: 1 June 2019
Last Updated: August 12, 2026

CPAP Store London is committed to protecting your privacy and processing your personal data responsibly and in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).

This policy explains how we collect, use, store, and protect your personal data when you visit our retail store or use our website.

1. Who We Are

CPAP Store London is a medical equipment retailer offering CPAP/BiPAP machines, masks, and accessories to customers in the UK.
If you have any questions about this policy or how we handle your data, you may contact us at:

Email: info@cpapstorelondon.co.uk

2. What Information We Collect

We may collect the following types of personal data:

  • Name, phone number, email address, and delivery address

  • Payment information (processed securely through third-party providers)

  • Device/browser information and IP address

  • Sleep-test registration information, medical/health questionnaires, sleep-study data,
    test results, reports, prescriptions and information provided to or received from healthcare professionals.

  • Order history, communication preferences, and support requests

3. How We Use Your Data

We may use your personal data to:

  • Process and fulfill orders and arrange product delivery;
  • Respond to enquiries and provide customer service and support;
  • Send order confirmations, delivery updates, and other service-related communications;
  • Provide marketing communications where you have chosen to opt in;
  • Operate, maintain, secure, and improve our website, products, services, and customer experience;
  • Meet applicable legal, regulatory, financial, accounting, fraud-prevention, and security obligations;
  • Arrange and facilitate home sleep testing services, including registering tests with the applicable sleep-testing platform or diagnostic service provider;
  • Provide information necessary for the applicable sleep-testing, diagnostic, or clinical provider to process and interpret the sleep study;
  • Receive completed sleep-test reports from the applicable diagnostic or clinical provider and securely provide those reports to customers;
  • Where applicable and requested as part of the service, facilitate review by an appropriately qualified healthcare professional and provide resulting clinical documentation or prescriptions to the customer;
  • Share sleep-test reports or relevant health information with an appropriate referring or treating healthcare professional involved in the customer’s care, where applicable and permitted by law; and
  • Maintain appropriate records relating to the products and services we provide.

CPAP Store London does not itself interpret sleep-study data, provide a medical diagnosis, or independently issue prescriptions. Sleep-study interpretation, medical evaluation, diagnosis, and prescribing, where applicable, are performed by the relevant diagnostic provider or appropriately qualified healthcare professional.

4. Legal Basis for Processing

Under the UK GDPR, we process personal data only where we have a lawful basis for doing so. Depending on the circumstances, our legal bases may include:

  • Contractual necessity – where processing is necessary to process an order, provide a purchased service, arrange delivery, administer a home sleep test, or otherwise fulfil our contractual obligations to you.
  • Legal obligation – where processing is necessary to comply with applicable legal, regulatory, tax, accounting, fraud-prevention, or record-keeping requirements.
  • Legitimate interests – where necessary for our legitimate business interests, including providing customer support, maintaining the security and operation of our services, preventing fraud, and improving our services, provided those interests are not overridden by your rights and interests.
  • Consent – where we rely on your consent for a particular purpose, such as certain marketing communications. You may withdraw your consent at any time.

Health and Special Category Data

Information concerning your health is considered special category personal data under the UK GDPR and is subject to additional protections.

When you purchase or use our home sleep testing services, we may process health information including information you provide in connection with the test, relevant medical information, prescriptions, sleep-test data, test results, reports, and related communications.

Where required, in addition to having a lawful basis under Article 6 of the UK GDPR, we will identify an applicable condition under Article 9 of the UK GDPR for processing health information.

Depending on the circumstances and the nature of the service, this may include your explicit consent under Article 9(2)(a). Where we rely on explicit consent, we will request it separately and clearly and explain the purposes for which your health information will be processed.

Where applicable and legally permitted, health information may also be processed for purposes connected with medical diagnosis, health care, or treatment in accordance with Article 9(2)(h) of the UK GDPR and applicable UK law, including where processing is carried out by or under the responsibility of an appropriately qualified healthcare professional or otherwise meets the applicable legal requirements.

Health information will only be used for specified and legitimate purposes and will be subject to appropriate technical and organisational safeguards.

5. How We Share Your Data

We may share personal data only where necessary and appropriate for the purposes described in this Privacy Policy, including with:

  • Healthcare professionals involved in reviewing, interpreting, or providing clinical services in connection with a home sleep test;
  • Sleep-testing laboratories, diagnostic service providers, medical-device providers, and other healthcare service providers involved in administering or processing a home sleep test or producing a sleep-test report;
  • A referring, treating, or other healthcare professional involved in your care, where appropriate and permitted by applicable law;
  • Trusted service providers, including couriers, payment processors, and fulfilment providers;
  • IT, cloud hosting, email, security, and other technology providers that support our systems and services;
  • Professional advisers, regulators, courts, law-enforcement agencies, or other authorities where disclosure is required or permitted by law.

Where third parties process personal data on our behalf, we require appropriate contractual, confidentiality, security, and data-protection safeguards where required by applicable law.

We do not sell your personal data or health information to third parties.

6. International Data Transfers

CPAP Store London uses service providers and business systems that may operate or store, access, or process personal data outside the United Kingdom.

As a result, your personal data, including information associated with home sleep testing where applicable, may be transferred to, stored in, or accessed from countries outside the UK, including the United States.

Where UK data protection law treats such processing as a restricted international transfer, we take steps designed to ensure that an appropriate transfer mechanism and safeguards are in place.

Depending on the recipient and circumstances, these measures may include:

  • UK adequacy regulations, including the UK Extension to the EU-U.S. Data Privacy Framework where the U.S. recipient is eligible and appropriately certified;
  • the UK International Data Transfer Agreement (IDTA);
  • the UK International Data Transfer Addendum to the European Commission’s Standard Contractual Clauses; or
  • another transfer mechanism or exception permitted under applicable UK data protection law.

Where required, we also assess the circumstances of the transfer and the protections applicable to the personal data being transferred.

We require service providers handling personal data on our behalf to protect that information appropriately and to process it only for authorised purposes and in accordance with applicable contractual and legal requirements.

You may contact us at info@cpapstorelondon.co.uk if you would like further information regarding the safeguards used for international transfers of your personal data.

7. Marketing & Communications

You will only receive marketing emails or SMS if you’ve provided consent. You can unsubscribe at any time by:

8. Your Rights Under UK GDPR

As a UK resident, you have the right to:

  • Access the personal data we hold about you

  • Request correction of inaccurate data

  • Request deletion (the “right to be forgotten”)

  • Object to or restrict processing

  • Withdraw consent to marketing

  • Lodge a complaint with the Information Commissioner’s Office (ICO)

To exercise your rights, email us at info@cpapstorelondon.co.uk.

9. Cookies & Analytics

We use cookies to improve site performance and personalise content.
On your first visit, a banner allows you to accept or manage cookie preferences in accordance with PECR.

We may use tools such as Google Analytics to monitor site usage, but no personally identifiable information is collected without your consent.

10. Data Retention

We retain your data only as long as necessary for:

  • Order fulfillment and support (7 years for financial compliance)

  • Marketing (until consent is withdrawn)

  • Support and communication records (up to 3 years)

11. Data Security

We implement technical and organizational measures to keep your data safe, including encryption, secure payment gateways, access controls, and regular monitoring.

12. Automated Decision-Making

We do not use automated decision-making that produces legal or similarly significant effects. If this changes, we will notify you and offer the right to request human review.

13. Updates to This Policy

We may update this privacy policy to reflect changes in regulation or our practices. The latest version will always be available on our website. Material changes will be highlighted clearly.

14. Contact Details

If you have questions, concerns, or would like to exercise your data rights:

CPAP Store London
Email: info@cpapstorelondon.co.uk