Privacy policy

When you order

Your name, email, shipping address, optional phone number, items and optional note; laboratory or organization, role, verification reference and in-vitro research purpose. We also record review evidence and outcome. Do not submit health information.

When you contact us

Your name, email, topic, message and optional order number.

When you subscribe or ask to be notified about stock

Your email address and the form you used, and for a stock alert the product and size you asked about.

For security

A keyed one-way hash of your IP address alongside orders and messages, and your browser’s user-agent string with each order, used to stop abuse and fraud. To limit abuse, the store also counts recent requests from that hash, over periods from a minute to a day. We don’t store your raw IP address.

We don’t take card numbers on this site. We don’t use advertising or analytics trackers, social-media pixels or third-party scripts, and the storefront sets no cookies.

Some things are kept only in your own browser:

In your browser’s storage, until you clear this site’s data

Your cart, your age confirmation, any deal you choose, any announcement you close and notes of what the store last showed you, so pages don’t shift as they load. Among the notes are the number, status and pay-by time of up to 20 orders you’ve opened here.

In this tab’s session storage, until you close the tab

A copy of the catalog, your contact and delivery draft if you leave checkout part-way and an order you’ve just placed or looked up, until its page opens.

The site is served only over HTTPS. Every record we store is encrypted with AES-256-GCM before it is written, and each record is cryptographically bound to its place in storage. Access to order data requires a password and a second factor, and every sign-in, change and export in the control center is written to a tamper-evident audit log. Instead of a CAPTCHA, our forms check for bulk spam with a small proof-of-work calculation in your browser, so no third-party service sees you fill them in.

We do, along with the service providers that run parts of the store for us. Our hosting provider stores the encrypted records. If email is enabled, our email provider handles the emails we send you and forwards contact-form messages to our inbox. Payment providers receive what they need to process the method you choose. We don’t sell your information or share it for advertising.

Order and research-review records are retained for at least two years after shipment and longer for accounting, tax or other legal obligations; they are not automatically deleted. Contact messages are archived once resolved and kept until you ask us to delete them. Subscriptions and stock alerts are kept until you ask us to remove them; a stock alert also records when its one email was sent. If email is enabled, our email provider keeps its own copies of the emails it delivers for us, for a period it sets.

You can ask us, through the contact form, what personal information we hold about you, and we’ll tell you by email. We can correct the contact details on an order, unsubscribe you, remove any stock alert you’ve asked for and delete a message you sent, from the store and from our own email and backups. We can’t delete any copy our email provider keeps. Orders themselves aren’t deleted: we keep them for accounting, tax and legal purposes. We confirm it’s you, using the email address on the record, before acting.

Our products and this site are for adults 21 and over. We don’t knowingly collect information from anyone younger.

If we change this policy, we’ll update its version and date on this page.