Last Updated: 17/09/2026
1. Who is responsible for your data
The controller is PectusConnectUs, 25 Hatton Lane, Northwich, Cheshire, CW8 1JY, United Kingdom. Contact: pectusconnectus@gmail.com.
This policy covers our website, orders and communications. Our App has its own App Privacy Notice, which follows the same rules.
2. What data we collect
| Category | Examples | Source |
|---|---|---|
| Identity and contact | Name, postal address, email, phone, WhatsApp number | You |
| Order and payment | Products, invoices, payment status (we do not see full card numbers) | You, payment providers |
| Health and body data | Type of chest deformity, relevant medical history, contraindications, measurements, chest photos and videos, optional X-ray or scan images, doctor’s recommendation | You |
| Device data | 3D models, specifications, fit feedback, warranty claims | You and us |
| Communications | Emails, WhatsApp messages, complaint records | You |
| Website data | IP address, browser, pages visited, cookies | Your device |
Health and body data are special category data. We ask you not to send photos showing your face. We ask for your explicit consent when you first send these data, before we prepare your free 3D model.
3. Why we use your data and our legal basis
| Purpose | Legal basis (UK GDPR / EU GDPR) |
|---|---|
| Preparing your free 3D model and preview video; designing, making, adjusting and delivering your Device | Steps you request before a contract, and the contract (Art. 6(1)(b)); for health data, your explicit consent (Art. 9(2)(a)) |
| Fit Guarantee, warranty and after-sales support | Contract; explicit consent for health data |
| Payments, invoices and accounting | Contract; legal obligation (Art. 6(1)(c)) |
| Keeping device documentation after delivery | Legal obligation; legitimate interest in defending legal claims; Art. 9(2)(f) for health data |
| Replying to enquiries and complaints | Contract or legitimate interest |
| Presenting your case in de-identified form | Your explicit consent, given at App registration; you can opt out at any time |
| Website operation and security | Legitimate interest |
| Analytics and marketing cookies, newsletter | Your consent |
We cannot design a Device without your health and body data. If you do not give or later withdraw consent for these, we cannot continue your order or support, but this does not affect processing already carried out.
4. AI and 3D design
We use software, including AI tools, to help turn your photos and measurements into a 3D design. Every design is reviewed and approved by a person. We make no decisions about you by automated means alone.
5. Presenting your case — only with your consent
With your consent, we may use de-identified material from your case on our website, social media (Facebook, YouTube, Reddit, TikTok) and in educational presentations.
- What we may use: chest-area photos and videos, measurements, 3D scans, progress data, device type, treatment duration, age range and deformity type.
- What we never use: your face, name, contact details, date of birth, or any other information that identifies you.
- How we de-identify: we crop or mask the face, tattoos, birthmarks, jewellery and backgrounds, and remove file metadata before publishing.
- Your choice: consent is optional and separate from your order. Saying no changes nothing about your Device or support.
- Withdrawal: you can withdraw at any time in the App or by email. We stop new use immediately and remove the material from our website and channels within 30 days. We cannot recall copies that others have already saved or shared.
6. Who we share data with
We share data only with service providers that process it on our behalf under a written contract, and only as needed:
- website hosting and online shop: Hostinger UK
- payments: PayPal, Wise, our bank
- delivery: UPS/FEDEX (name, address, phone, email, general description of contents)
- email and file storage: Google
- WhatsApp (Meta), only if you choose to contact us there
We share information with your doctor or other specialists only at your request or with your consent. We disclose data to authorities only when the law requires it. We never sell your data or use it for third-party advertising.
7. International transfers
Some providers process data outside the UK or EEA. We transfer data only where the destination has an adequacy decision or regulation, or under standard contractual clauses (including the UK International Data Transfer Addendum).
8. How long we keep your data
| Data | How long |
|---|---|
| Enquiries, photos, measurements, 3D models and preview videos that do not lead to an order | 12 months after the last contact |
| Device documentation: contact details, measurements, design photos and videos, 3D models, specifications, fit and warranty records | 10 years after delivery of your last Device |
| Invoices and accounting records | 6 years after the end of the financial year |
| Progress photos and other App data | As described in the App Privacy Notice |
| Case presentation material | Until you withdraw consent; removed within 30 days |
| Records of your consents | While the consent is used, then 6 years |
| Complaint records | 3 years after the complaint is closed |
| Website logs | 30 days |
After device documentation is deleted, lifetime warranty claims are handled on the basis of your invoice.
9. Security
Data is encrypted in transit and stored with providers bound by data processing agreements. Access is limited to people who need it and protected by two-factor authentication. Please send health photos only through the App or email, not through social media messages.
10. Your rights
You can ask us to give you a copy of your data, correct it, delete it, restrict or object to its use, or transfer it to you in a portable format. You can withdraw consent at any time. We reply within one month; if a request is complex, we may extend this by two months and will tell you why. Some data must be kept for the periods in section 8 even if you ask us to delete it.
11. Complaints
If you are unhappy with how we handle your data, please complain to us first at pectusconnectus@gmail.com. We acknowledge complaints within 30 days (usually within 2 business days), investigate them and keep you informed.
You can also complain to the UK Information Commissioner’s Office (ico.org.uk). If you live in the EU, you can complain to the data protection authority in your country.
12. Children
For Users under 18, a parent or legal guardian gives all consents and exercises data rights on their behalf. We also ask for the young person’s own agreement before presenting their case. When a User turns 18, we tell them that their parent’s case presentation consent continues unless they switch it off, and how to do so.
13. Cookies
We use essential cookies to run the website and shop. We use analytics or marketing cookies only if you accept them in our cookie banner, where you can change your choice at any time.
14. Changes
We will notify you of material changes by email or on our website before they take effect.
15. Contact
PectusConnectUs · 25 Hatton Lane, Northwich, Cheshire, CW8 1JY, United Kingdom · pectusconnectus@gmail.com