Privacy policy

Last Updated: 31 October 2026

1. INTRODUCTION

This Privacy Policy explains how QMed Global Ltd, trading as Meidiama ("we", "us", or "our"), collects, uses, and discloses your personal data when you visit, use, or make a purchase from meidiama.com (the "Site" or "Services").

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, QMed Global Ltd is the Data Controller of your personal data. QMed Global Ltd is registered with the Information Commissioner's Office (ICO) under registration number ZC279502.

Our store is powered by Shopify, which provides the e-commerce platform that allows us to sell our products to you.

Our Services are intended for adults aged 18 or over. We do not knowingly collect personal data from children.

2. PERSONAL DATA WE COLLECT

Depending on how you interact with our Services, we collect the following categories of personal data:

  • Identity & Contact Data: Name, billing address, shipping address, email address, phone number, and account credentials.
  • Financial & Transaction Data: Products ordered, order numbers, and payment status details. (Note: Full payment card numbers are processed securely by our payment processor, Shopify Payments; we do not store your full credit card data).
  • Technical & Usage Data: IP address, browser type, device type, operating system, time zone setting, and data regarding your interaction with the Site (e.g., pages viewed, links clicked).
  • Communications Data: Information you provide when contacting our customer support team (by email, phone, WhatsApp, Instagram or Facebook Messenger) or leaving product reviews. This includes your name or profile name, your phone number if you contact us on WhatsApp, and the content of your messages.

Do you have to give us your data? You do not have to give us any personal data. However, we need your name, delivery address, email address and phone number to process and deliver an order; without them we cannot fulfil it. We also keep some order information because the law requires it (for example, tax records).

3. HOW WE USE YOUR DATA AND OUR LAWFUL BASES

Under UK data protection law, we must have a valid "lawful basis" for processing your personal data. We use your data for the following purposes, relying on the corresponding lawful bases:

  • To Provide and Fulfil Services: To process your order, arrange for shipping, provide order confirmations, and process returns.
  • Lawful Basis: Performance of a Contract with you.
  • To Communicate with You: To provide responsive customer support and answer your enquiries.
  • Lawful Basis: Legitimate Interests (in providing good customer service) and Performance of a Contract.
  • Security and Fraud Prevention: To screen orders for potential risk or fraud, authenticate accounts, and secure our Site.
  • Lawful Basis: Legitimate Interests (protecting our business from fraudulent activity) and Legal Obligation.
  • Business Operations & Legal Compliance: To maintain financial records, comply with tax obligations, and enforce our terms and policies.
  • Lawful Basis: Legal Obligation (e.g., HMRC record-keeping).
  • Marketing & Advertising: To send you promotional emails or display relevant advertising, provided you have opted in or we have a soft opt-in right.
  • Lawful Basis: Consent (which you may withdraw at any time) or, for marketing emails to existing customers about similar products (the "soft opt-in"), Legitimate Interests. Every marketing email includes an unsubscribe link.
  • Site Improvement: To analyse how customers use the Site to improve our layout and product offerings.
  • Lawful Basis: Legitimate Interests (improving our commercial offering) and Consent (for non-essential analytics cookies).

Automated decisions: We do not make decisions about you based solely on automated processing that have legal or similarly significant effects on you. Our platform's fraud tools may flag an order for review; a member of our team checks any flagged order before deciding whether to cancel it.

4. HEALTH INFORMATION DISCLAIMER (SPECIAL CATEGORY DATA)

Meidiama retails non-prescription, over-the-counter (OTC) products. We do not require or request "special category data" (such as medical records or health data) to fulfil retail orders.

Please do not submit sensitive medical information to us. If you voluntarily disclose health information in a customer support enquiry, we will process it only on the basis of your explicit consent and strictly to address your request; it will not be processed for any other purpose.

5. HOW WE DISCLOSE YOUR DATA

We share your information with trusted third parties for the legitimate purposes outlined above:

  • Shopify: Our store is hosted by Shopify. Your data is transmitted to and processed by Shopify to provide the platform. For details, review the Shopify Privacy Policy.
  • Fulfilment Partners & Couriers: We transmit your name, shipping address, and order details to our authorised UK-based suppliers and shipping carriers strictly to pick, pack, and deliver your order.
  • Payment Processors: Shopify Payments, to securely process your payments.
  • Email and Office Services: Google Workspace, which hosts our email and business documents.
  • Messaging: If you message us on WhatsApp, Instagram or Facebook Messenger, your messages are processed by Meta, which operates those services. WhatsApp messages also pass, encrypted, through Cloudflare's network on their way to our systems.
  • Customer Service Tools: We use an AI assistant (Claude, provided by Anthropic) to help our team read customer messages and prepare draft replies. A member of our team reviews every reply before it is sent, and no automated decisions are made about you.
  • Professional Advisers: Our accountants, lawyers and other professional advisers, where needed to run our business and meet our legal obligations.
  • Analytics & Advertising Partners: With your consent (given through our cookie banner), providers such as Google, Meta and TikTok receive technical and usage data to help us measure site performance and show relevant advertising. See our Cookie Policy for details.
  • Legal & Regulatory Bodies: When required to comply with applicable laws (such as HMRC), respond to valid legal processes, or protect our rights.

6. INTERNATIONAL DATA TRANSFERS

We are based in the United Kingdom, but our platform (Shopify) and some of our service providers operate internationally. Your personal data may be transferred to, stored, and processed outside the UK, primarily in Canada and the United States. Whenever we transfer your personal data out of the UK, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

  • Transferring data to countries that have been deemed to provide an adequate level of protection for personal data by the UK Government (e.g., Canada, or certified organisations in the United States under the UK–US data bridge).
  • Using specific contracts approved for use in the UK (the International Data Transfer Agreement / UK Addendum to Standard Contractual Clauses) which give personal data the same protection it has in the UK.

7. DATA RETENTION

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for. Specifically:

  • Transaction and Financial Records: Retained for up to seven (7) years to comply with UK tax (HMRC) and accounting legal obligations.
  • Customer Support Data: Retained for up to six (6) years after your last interaction with us, to assist with warranty claims, statutory consumer rights claims, or disputes. The copy of incoming WhatsApp messages held by our messaging system, including your phone number, is deleted 30 days after it arrives. Messages kept as part of your support history follow the six-year period above.
  • Marketing Data: Retained until you opt out or withdraw your consent.

8. COOKIES AND TRACKING TECHNOLOGIES

Our Site uses cookies and similar technologies to power our Services, remember your preferences, and analyse site traffic.

Under UK law, we require your active consent to place non-essential cookies (such as analytics and advertising cookies) on your device. We use a cookie management tool on our website that allows you to accept or decline non-essential cookies. You can change your choices at any time using the "Cookie Preferences" link in the footer of every page. See our Cookie Policy for details.

9. YOUR LEGAL RIGHTS

Under the UK GDPR, you have the following rights regarding your personal data:

  • Request access to your personal data (a "data subject access request").
  • Request correction of incomplete or inaccurate data we hold about you.
  • Request erasure of your personal data (where there is no good reason for us continuing to process it).
  • Object to processing of your personal data where we are relying on a legitimate interest. You also have an absolute right to object to direct marketing.
  • Request restriction of processing of your personal data.
  • Request the transfer of your personal data to you or a third party (Data Portability).
  • Withdraw consent at any time where we are relying on consent to process your personal data.

To exercise any of these rights, please contact us at support@meidiama.com. We will not discriminate against you for exercising your rights. We try to respond to all legitimate requests within one month.

10. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy periodically to reflect changes in our business practices, technology, or legal requirements. The updated version will be posted on this page with a revised "Last Updated" date.

11. CONTACT US AND COMPLAINTS

If you have questions about this Privacy Policy, please contact us:

  • Email: support@meidiama.com
  • Support Line: +44 7882500048
  • Registered Office: QMed Global Ltd, 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom (not a returns address)

How to complain to us: If you are unhappy with how we have handled your personal data, please email support@meidiama.com with the subject "Data protection complaint", or write to us at the address above. We will acknowledge your complaint within 30 days, look into it without undue delay, and tell you the outcome.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection (www.ico.org.uk, telephone 0303 123 1113). We would, however, appreciate the chance to deal with your concerns first.