Your data protection rights under the General Data Protection Regulation.
Last updated: June 2026
Heath-ibex is committed to protecting your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page outlines how we comply with these regulations and explains your rights.
Heath-ibex acts as the data controller for personal information collected through this website. As data controller, we are responsible for deciding how your personal data is processed and for ensuring compliance with data protection laws.
Contact details:
Address: 47 Cathedral Road, Cardiff CF11 9HB, United Kingdom
Email: [email protected]
We only process personal data when we have a valid legal basis. Our processing activities rely on the following lawful bases:
Under the UK GDPR, you have the following rights regarding your personal data:
You have the right to request a copy of the personal data we hold about you. We will provide this information within one month of receiving your request.
You have the right to request that we correct any inaccurate personal data we hold about you, or complete any incomplete data.
You have the right to request that we delete your personal data in certain circumstances, such as when the data is no longer necessary for the purpose for which it was collected.
You have the right to request that we restrict the processing of your personal data in certain circumstances, such as when you contest the accuracy of the data.
You have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit that data to another controller.
You have the right to object to the processing of your personal data where we are relying on legitimate interests as our legal basis, or where we are processing your data for direct marketing purposes.
You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you. We do not currently engage in automated decision-making.
To exercise any of these rights, please contact us using the details provided above. We will respond to your request within one month. In complex cases, we may extend this period by a further two months, in which case we will inform you of the extension and the reasons for it.
You will not normally be charged a fee for exercising your rights. However, we may charge a reasonable fee or refuse to comply with your request if it is clearly unfounded, repetitive, or excessive.
We have implemented appropriate technical and organisational measures to ensure a level of security appropriate to the risk of processing your personal data. These measures include:
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours of becoming aware of the breach. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly.
We do not routinely transfer personal data outside the United Kingdom. Should such transfer become necessary, we will ensure appropriate safeguards are in place in accordance with UK GDPR requirements.
If you are not satisfied with how we have handled your personal data or responded to your request, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
Website: ico.org.uk
Telephone: 0303 123 1113
Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
We may update this GDPR compliance information from time to time. Any changes will be posted on this page with an updated revision date.