Privacy Policy

Panacea Health UK Limited, trading as Panacea Distribution

Last updated: 12 August 2026

Panacea Distribution ("Panacea", "we", "us", or "our") respects your privacy and is committed to protecting your personal data. This privacy policy explains how we collect, use, and safeguard the information you provide when you visit panaceadistribution.com, apply for a trade account, place an order, contact us, or otherwise interact with our services.

This policy is written in plain English wherever possible. If anything is unclear, please contact us using the details at the end of this document.

1. Who we are

The data controller for the personal data described in this policy is:

Legal entity: Panacea Health UK Limited (trading as Panacea Distribution)
Registered office: 6th Floor, Amp House, Dingwall Road, Croydon, CR0 2LX
Companies House number: 05389791
VAT number: GB 911 7330 53
ICO registration: ZC150982
Contact for data matters: [email protected]

2. What this policy covers

This policy applies to personal data we collect:

through our website at panaceadistribution.com
when you submit a trade account application, contact form, or brand pitch
when you create or use a trade account on our platform
when you place an order or interact with us as a trade customer
when you sign in to or order through the Panacea Trade app — our customer ordering app at app.panaceadistribution.com and, when released, the iOS and Android apps (see Section 11)
through related communications such as email, telephone, or post

This policy does not cover third-party websites linked from ours. Where we link to external services, those services have their own privacy policies, which we encourage you to review.

3. The personal data we collect

The categories of personal data we collect depend on how you interact with us.

3.1 Information you give us directly

When you fill in a form or correspond with us, you may provide:

Identity and contact data: full name, job title, email address, telephone number, business name
Business information: Companies House number, VAT number, business type, trading address, years trading, locations, website
Account credentials: username, password (stored hashed, never in plain text), and account preferences
Order and transaction data: items ordered, billing and delivery addresses, payment method (we do not store full card details — see Section 5), invoices, returns, and credit notes
Communications: the content of messages you send through our forms, email, or other correspondence

3.2 Information we collect automatically

When you visit our website, our systems may collect:

Technical data: IP address, browser type and version, time zone, operating system, device identifiers
Usage data: pages visited, time spent on pages, referring URLs, the date and time of your visit
Cookie data: see our cookie policy for details on the specific cookies we use

3.3 Information from third parties

We may receive information about you from third parties where lawfully permitted, including:

Companies House and other public business registers, when verifying trade account applications
Payment service providers, who confirm payment authorisation and fraud screening results
Couriers and logistics providers, who provide delivery confirmations and tracking updates

4. Why we use your personal data

UK data protection law requires us to have a lawful basis for using your personal data. We rely on the following bases:

Purpose	Lawful basis
To assess and respond to your trade account application	Steps prior to entering a contract; legitimate interests in vetting trade applicants
To set up and manage your trade account, process orders, take payment, and arrange delivery	Performance of our contract with you
To respond to enquiries submitted via our contact form	Legitimate interests in responding to communications; steps prior to contract
To evaluate brand pitches	Legitimate interests in identifying potential supply partners
To keep accurate accounting and tax records	Legal obligation (HMRC, Companies Act, Money Laundering Regulations)
To send service-related emails (order confirmations, delivery updates, account changes)	Performance of our contract with you
To send marketing emails about our products, brands, and trade events	Consent (you can withdraw at any time); or legitimate interests where you are an existing trade customer and we are promoting similar products
To improve our website, prevent fraud, and ensure security	Legitimate interests in operating a safe and effective service

Where we rely on legitimate interests, we have carefully balanced our interests against your rights and freedoms, and we will not use your data in ways that override your reasonable expectations.

5. Who we share your data with

We share personal data only where necessary to operate our business. Recipients fall into the following categories:

Service providers acting on our instructions (data processors): these include our hosting provider (Amazon Web Services), our content delivery network (Cloudflare), our accounting software provider (Xero), our inventory and order management software (Zoho), our email service provider, our payment service provider, and our chosen couriers. Each is bound by a written agreement obliging them to handle your data securely and only as instructed.
Professional advisers: accountants, auditors, lawyers, and insurers, where required for the proper running of our business.
Regulatory and tax authorities: HMRC, the Information Commissioner's Office, and other authorities where we are legally required to share information.
Successors in title: if we sell, transfer, or restructure our business, your data may be transferred as part of that transaction, subject to standard confidentiality and data protection obligations.

We do not sell your personal data, and we do not share it with third parties for their own marketing purposes.

6. International data transfers

Most of our service providers store data within the United Kingdom or European Economic Area. Where data is transferred outside the UK or EEA — for example, to certain cloud or analytics providers — we ensure that appropriate safeguards are in place, such as the UK International Data Transfer Agreement, the EU Standard Contractual Clauses with the UK Addendum, or transfers to countries the UK government has determined to provide adequate protection.

You can request a copy of the safeguards in place for any specific transfer by contacting us using the details at the end of this policy.

7. How long we keep your data

We keep personal data only for as long as necessary for the purposes set out above, and in accordance with our retention schedule:

Trade account application records: two years from submission if not approved; for the lifetime of the account if approved
Active trade customer records: for the duration of your account plus six years from the date of your last order, in line with HMRC requirements
Order and transaction data: at least six years from the end of the financial year in which the order was placed (HMRC requirement)
Contact form messages: up to two years from the date of submission, unless they form part of an ongoing matter
Brand pitch records: up to two years from submission, unless they lead to an ongoing supplier relationship
Marketing consents: until you withdraw consent or we determine the marketing is no longer relevant to you
Website analytics and cookie data: see our cookie policy for individual retention periods

When data is no longer required, we either securely delete or anonymise it.

8. Your rights

Under UK data protection law, you have the following rights, subject to certain conditions and exceptions:

Right of access: to receive a copy of the personal data we hold about you
Right to rectification: to have inaccurate or incomplete data corrected
Right to erasure ("right to be forgotten"): to have your data deleted in certain circumstances
Right to restriction: to have the use of your data limited
Right to data portability: to receive your data in a structured, commonly used, machine-readable format, and to have it transmitted to another controller
Right to object: to object to processing based on legitimate interests, and to object at any time to processing for direct marketing purposes
Rights related to automated decision-making: we do not currently make decisions about you using solely automated processing
Right to withdraw consent: where we rely on your consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal

To exercise any of these rights, please contact us at [email protected]. We will respond within one month of receiving your request, although in complex cases we may extend this by up to two further months and notify you of the extension.

We do not charge for responding to most rights requests, but we may charge a reasonable fee or refuse to act on requests that are manifestly unfounded or excessive.

9. Security

We use a combination of technical and organisational measures to protect your personal data, including encrypted connections (HTTPS/TLS), restricted internal access, secure password hashing, regular software updates, and contractual obligations on our service providers.

No system is perfectly secure. If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours and, where required, notify you directly without undue delay.

10. Cookies

Our website uses cookies and similar technologies. For full details of which cookies we use, why we use them, how long they last, and how to manage them, please see our cookie policy.

11. The Panacea Trade app

The Panacea Trade app (available in a web browser at app.panaceadistribution.com and, when released, as an iOS and Android app) is a private ordering tool for approved trade customers. You sign in with your existing trade account — the app does not offer public registration, and everything in this policy about trade account, order, and transaction data applies equally to orders placed through the app.

In addition, when you use the app:

On-device storage: the app stores a sign-in token and your draft basket on your device so you stay signed in and your basket is not lost. Signing out or uninstalling the app removes them.
No advertising or third-party tracking: the app contains no advertising and no third-party tracking or analytics SDKs. We measure usage with our own first-party analytics only.
Camera (barcode scanning): where barcode scanning is offered, the camera is used solely to read product barcodes in real time. Images are not recorded, stored, or uploaded, and the camera is only active while you use the scanner.
Push notifications: if offered, notifications (for example dispatch or back-in-stock alerts) are optional and delivered through Apple and Google notification services. You can disable them at any time in your device settings.

Closing your account and deleting your data

Trade accounts are created by us for approved businesses rather than through in-app sign-up. To close your account and request deletion of the personal data associated with it, email [email protected] from your registered address. We will action the request within 30 days. Some records (for example invoices) must be retained for the statutory periods described in Section 7 even after an account is closed; they are deleted when those periods end.

12. Children's data

Our services are intended for businesses and trade customers. We do not knowingly collect personal data from children under the age of 18. If you believe we have inadvertently collected a child's data, please contact us and we will delete it.

13. Changes to this policy

We may update this privacy policy from time to time to reflect changes in our practices, services, or applicable law. The "Last updated" date at the top of this policy will indicate when it was last revised. Where changes are material, we will take reasonable steps to notify you, for example by email or by a notice on our website.

14. How to contact us or make a complaint

For any questions about this policy or our handling of your personal data, please contact us at:

Email: [email protected]
Post: Data Protection, Panacea Health UK Limited, 6th Floor, Amp House, Dingwall Road, Croydon, CR0 2LX

If you are not satisfied with our response, or you believe we have not handled your data in accordance with the law, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO):

Website: ico.org.uk/make-a-complaint
Telephone: 0303 123 1113
Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

We would, however, appreciate the opportunity to address your concerns before you approach the ICO, so please contact us first if you can.