Privacy policy
Last updated: 15 September 2026
Anatomical Concepts UK Ltd ("we", "us", "our") is the data controller for this website and for the tVNS UK product and support service. This policy explains what personal data we collect, how we use it, who we share it with, and what rights you have under UK GDPR and the Data Protection Act 2018.
If anything in this policy is unclear, or you want to exercise any of the rights described below, the contact details are at the bottom of this page.
What personal data we collect
We collect personal data in a small number of situations.
- When you ask us to call you through the form on the contact page. We collect your name, email address, phone number, the best times to call, and whether you are the person who would use the device, a carer, or a clinician. We also ask which condition the enquiry concerns, who made the diagnosis and whether a consultant is involved, four yes or no screening questions about the person who would use the device, and a line on what you are hoping for. The form is sent to us by email; the website itself stores nothing.
- When you order the tVNS device from us. We collect your name, billing and delivery address, email address, phone number, and order details so that we can fulfil the order and handle warranty, returns, and after-sales support. If you pay by card, the payment processor handles your card details; we never see or store them.
- When you contact us by email or phone, we collect the details you choose to share with us, including your name, contact details, and the content of your message.
- When you browse the site, our hosting provider keeps standard server logs (the page requested, the time, and the type of device and browser) for security and to keep the site running. We do not run analytics or tracking scripts on this site at present. If we add them, this policy and a consent notice will be updated first.
- When you download a resource from the clinician zone, if we ask for your name or email in exchange for the download, we collect the details you provide.
Health information
The condition and the four screening answers on the request-a-call form are health information, which UK GDPR treats as special category data. We collect them only with your explicit consent, given by ticking the box on the form, and we use them only to prepare for and hold the call you asked for. The confirmation email we send you does not repeat them. You can withdraw that consent at any time by emailing us, and we will delete the request.
If you write to us about a medical condition in an email or a phone call, we handle that information with the same care and only for the purpose of answering your question. Nothing you tell us on a call is recorded beyond brief notes of what was agreed.
Why we collect it, and our lawful basis
We process your personal data for the following purposes and under the following lawful bases in UK GDPR.
| Purpose | Lawful basis |
|---|---|
| Preparing for and holding the call you requested, including the health information on the form | Consent (Article 6(1)(a)), with explicit consent for health information (Article 9(2)(a)) |
| Fulfilling orders and providing after-sales support, warranty, and returns | Performance of a contract (Article 6(1)(b)) |
| Replying to contact enquiries | Legitimate interests (Article 6(1)(f)) |
| Keeping accounting records and meeting our legal obligations | Legal obligation (Article 6(1)(c)) |
| Keeping the site secure and running, using server logs | Legitimate interests (Article 6(1)(f)) |
| Sending you information about tVNS or related products, where you have asked to receive it | Consent (Article 6(1)(a)) |
Who we share it with
We share personal data only where there is a clear reason to do so, and only with parties we have reviewed for their own data handling practices. The main recipients are:
- Our transactional email provider, which delivers the request-a-call form to our inbox and sends you the confirmation. It acts as a data processor on our behalf and does not use the content for any other purpose.
- Our payment processor, if you pay by card. It handles card details directly and is PCI DSS compliant. We do not store card data.
- Our delivery partners, such as couriers and postal services, who need your name and address to deliver the device.
- tVNS Technologies GmbH, the manufacturer of the device, in the limited case where a warranty or technical issue needs to be escalated to them. Only the minimum information needed is shared.
- Our IT and hosting providers, including our website host and email provider, who act as data processors on our behalf.
- Our error-monitoring provider, hosted in the EU, which receives a report when something on the site breaks: the error, the page it happened on, the browser type, and the network address it came from. It receives nothing you type into a form. It acts as a data processor on our behalf.
- Regulatory authorities and law enforcement, if we are legally required to share information.
We do not sell your personal data to anyone, ever.
International transfers
Some of our processors, including the manufacturer in Germany, are based outside the UK. Where personal data is transferred outside the UK, we rely on the UK government's adequacy decisions, or on standard contractual clauses where adequacy is not in place, to ensure your data is protected to the same standard as under UK GDPR.
How long we keep your data
We keep personal data only for as long as we need it.
- Order and warranty records are kept for seven years, to meet HMRC and consumer law requirements.
- Contact enquiries are kept for up to three years, so that we can respond to follow-up questions.
- Requests for a call arrive as email and are kept under the same three year rule while a conversation is live. Where we agree on the call that tVNS is not suitable, or you do not go ahead, we delete the request within six months.
- Server logs are kept by our hosting provider for a short period for security and troubleshooting, and are not used to identify you.
- Marketing subscriptions, where you have opted in, are kept until you unsubscribe.
Your rights
Under UK GDPR, you have the right to:
- Access the personal data we hold about you, and receive a copy of it.
- Rectify data that is inaccurate or incomplete.
- Erase your data, where there is no overriding reason for us to keep it.
- Restrict how we process your data in specific circumstances.
- Object to processing based on legitimate interests, including direct marketing.
- Data portability, to receive your data in a structured, machine readable format.
- Withdraw consent at any time, where processing is based on consent.
To exercise any of these rights, email us (see the contact section below). We will respond within one month.
If you are not satisfied with how we handle your data, you have the right to complain to the Information Commissioner's Office at ico.org.uk. We would rather hear from you first so we can try to put things right, but you are never required to come to us before going to the ICO.
Cookies
We use a small number of cookies to make the site work and to understand how it is used.
tvns_hcpis set when you confirm that you are a UK healthcare professional on entering the clinician zone. It holds the value 1 and nothing else, lasts 30 days, and exists only so that you are not asked to confirm again on every page. It is strictly necessary for the function you asked for and is not used for tracking. Clearing your browser's cookies removes it.
That is the only cookie this site sets. There are no analytics or advertising cookies, which is why there is no cookie banner. If that changes, a consent notice will appear before any such cookie is set.
Changes to this policy
If we make material changes to this policy, we will post the updated version here and update the "last updated" date at the top. If the changes are significant, we will make a reasonable effort to let you know by other means too.
How to contact us
For any question about this policy, or to exercise any of the rights above, the contact details are on our contact page.
Anatomical Concepts UK Ltd is registered with the Information Commissioner's Office.
This policy sits alongside our terms and conditions and accessibility statement.