Privacy Policy

Who we are

Recovery Kit Ltd ("we", "us", "our") is a company registered in England and Wales (Company No. 16616710), with its registered address at Fulford House, Newbold Terrace, CV32 4EA. Our VAT number is 514 7044 13.

We are the data controller for the personal data we collect through this website. If you have any questions about how we handle your data, please contact us at hello@recoverykit.co.uk.

What data we collect

We collect the following personal data when you use our services:

• Contact information — name, email address, phone number, and delivery address, provided when you place an order or contact us
• Order information — details of products hired, purchased, or subscribed to, including dates, machine codes, wrap selections, and Incrediwear product, size and variant selections
• Payment information — processed securely by Stripe. We do not store your card details on our servers
• Medical information — if you tick the consent box at checkout, we collect the nature of the surgery you are recovering from, your surgeon name, surgery date, and hospital name, to time your delivery and prepare your kit. Every field is optional, and you can withdraw your consent at any time
• Referral information — how you heard about us (e.g. surgeon, physio, word of mouth)
• Terms acceptance record — your IP address and browser information at the moment you accept our Terms & Conditions, captured as contract evidence in case of dispute
• Contact form messages — any information you provide when contacting us through the website
• Security data — your IP address is checked against our rate limits when you submit a form or start a checkout, to prevent spam and abuse. It is converted to an irreversible code before it reaches the service that does this, and is discarded within minutes
• Website analytics — anonymised usage data collected by Vercel Analytics to help us improve the website

Why we collect it

We use your personal data for the following purposes:

• Fulfilling orders — to process, deliver, and manage your hire, purchase, or subscription
• Communication — to send order confirmations, delivery updates, automated end-of-hire emails with self-service options, and extension or return confirmations
• Customer support — to respond to your enquiries and provide assistance
• Business operations — internal administration, invoicing, and managing our fleet of machines
• Legal compliance — to comply with our legal and regulatory obligations, including VAT reporting

Our legal basis for processing your data is:

• Contract performance — processing necessary to fulfil your order
• Legitimate interests — internal business operations, fraud prevention, and improving our services
• Legal obligation — tax and accounting requirements
• Explicit consent — for processing health-related information (surgery details), which you provide voluntarily at checkout. You can withdraw this consent at any time by contacting us.

How long we keep it

We retain your personal data for as long as necessary to fulfil the purposes set out above. Specifically:

• Order and booking data — retained for 6 years after the end of the hire, purchase, or subscription, in line with HMRC requirements
• Terms acceptance records — retained for 6 years post-order alongside the order they relate to, then deleted
• Contact form enquiries — retained for up to 12 months
• Analytics data — anonymised and aggregated, not linked to individual users

Who we share it with

We share your personal data with the following third-party services, solely to support our business operations:

• Stripe — payment processing. Stripe processes your payment details securely and is certified to PCI DSS Level 1. Stripe Privacy Policy
• Microsoft (Outlook) — email delivery for order confirmations, reminders, and transactional emails
• Pushover — internal operational notifications. Your name and order summary may be included in notifications sent to our admin team
• Vercel — website hosting and anonymised analytics. Vercel Privacy Policy
• NeonDB — secure database hosting for order and booking records
• Parcel2Go — our shipping broker. We share your name, delivery address, and phone number to generate Royal Mail delivery and return labels and to arrange collections
• Royal Mail — delivery and collection of orders and returned equipment
• Upstash — abuse prevention. Receives only an irreversible code derived from your IP address, never the address itself, and holds it for minutes. Hosted in London

We do not sell your personal data to any third party.

How we protect your data

• Your card details never reach us — payment is taken on Stripe's own checkout page, so we never see or store a card number
• Encrypted in transit — the site and our database connections are encrypted
• Stored in the UK — see International transfers below
• Named accounts, not shared logins — everyone on our team signs in with their own work account, protected by their own password and multi-factor authentication. There are no shared passwords, and we remove a person's access when they leave the team
• Access to surgery details is recorded — whenever a member of our team opens a booking containing your medical information, we record who opened it and when. We keep that record for 12 months, so for that period we can tell you exactly who has seen your data
• Limits on our public forms — we cap how often our contact, checkout and discount forms can be used from one place, to prevent spam and abuse

No system is perfectly secure, but if a breach ever affected your rights we would tell you and the ICO as the law requires.

Cookies and analytics

Our website uses minimal cookies:

• Essential cookies — used for session management on our admin dashboard. These are strictly necessary and do not require consent.

We use Vercel Analytics and Speed Insights to understand website performance. These tools are cookieless and do not track individual users or set any cookies on your device.

We do not use advertising cookies, tracking pixels, or any non-essential cookies.

Your rights

Under UK data protection law (UK GDPR), you have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — ask us to correct any inaccurate or incomplete data
• Erasure — ask us to delete your personal data, subject to our legal obligations
• Restriction — ask us to limit how we use your data
• Portability — request your data in a structured, machine-readable format
• Objection — object to our processing of your data based on legitimate interests
• Withdraw consent — where we process data based on your consent (such as surgery details), you can withdraw that consent at any time

To exercise any of these rights, please contact us at hello@recoverykit.co.uk. We will respond within one month.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe your data has been mishandled.

International transfers

Your order and booking data is stored in the United Kingdom. Our database is hosted in London, our website runs in London, and our abuse-prevention service is in London.

Some of our providers are US companies, and two of them receive data in the United States: Stripe (payment processing) and Pushover (internal notifications to our team, which include your name and a summary of your order). Vercel is a US company, but our site and your requests are processed in its London region.

Where data is transferred outside the UK, we rely on the safeguards required by UK data protection law, including the International Data Transfer Agreement or the UK Addendum to Standard Contractual Clauses.

Automated processing

We use automated systems to support our hire service. Specifically:

• End-of-hire reminders — we automatically send you an email five days before your hire end date, with options to extend your hire or arrange a return
• Extension processing — if you choose to extend via the email, payment is processed automatically through Stripe and your hire dates are updated
• Return arrangements — if you choose to return via the email, the relevant return process is initiated automatically

These automated processes do not involve profiling and do not make decisions that produce legal or similarly significant effects without human involvement. Our team reviews all automated actions and can intervene at any point. You can contact us at any time if you wish to discuss your options with a member of our team instead.

Changes to this policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated date. We encourage you to review this page periodically.

Contact us

If you have any questions about this Privacy Policy or how we handle your data, please contact us:

• Email: hello@recoverykit.co.uk
• Phone: +44 20 7096 6404
• Address: Fulford House, Newbold Terrace, CV32 4EA