For our website, our contact forms and our services
MicroBiome Bank Ltd. is committed to protecting and respecting your privacy. This notice explains what personal data we collect when you use our website or contact us, why we collect it, who we share it with, how long we keep it, and what rights you have.
What this notice covers, and what it does not. This notice is about the website itself and about enquiries you send us through it. Two other situations have their own notices, because the data, the legal basis and the retention periods are different:
Health data: the condition you enquire about, digestive symptoms, their duration, whether a treating physician is involved, and anything else you choose to write in the message field. Health data is a special category of personal data under Article 9 of the GDPR, and we process it only with your explicit consent (see section 4).
Data about a child, where you enquire on a child's behalf: the child's age, main digestive complaint and how long it has been present. See section 5.
Financial data: payment details, where you place an order.
Technical and usage data: IP address, browser type and version, operating system, and information about how you use the site.
3. How we collect it
Directly from you: when you fill in a form on this site, or write or speak to us.
Automatically: through cookies and similar technologies when you use the site (see section 10).
From third parties: from healthcare providers, laboratories and public health authorities, where the law allows or requires it.
4. Why we process it, and on what legal basis
Answering your enquiry. Legal basis: your consent (Article 6(1)(a)), and for the health data in your enquiry your explicit consent (Article 9(2)(a)). You give that explicit consent by ticking the separate health-data checkbox on the form; without it we cannot process the enquiry.
Providing our services, including microbiota transfer therapy, and communicating with you about it. Legal basis: performance of a contract (Article 6(1)(b)); for health data, explicit consent (Article 9(2)(a)) or the provision of health care (Article 9(2)(h)) where a treating physician directs the care.
Meeting legal obligations, including reporting to health authorities. Legal basis: Article 6(1)(c).
Improving our services and the site. Legal basis: our legitimate interests (Article 6(1)(f)), balanced against your rights.
Marketing, only where you have consented. Legal basis: Article 6(1)(a). You can withdraw at any time.
5. Enquiries about a child
Some of our services concern children. Our enquiry forms therefore ask for a child's age, main digestive complaint and how long it has lasted. This is health data about a minor, and we treat it accordingly:
We do not ask for the child's name — deliberately. The enquiry is answered without it.
Only a parent or legal guardian may submit such an enquiry. The form asks you to confirm that you are acting in that capacity.
Explicit consent is required under Article 9(2)(a) before we process the child's health data, and it is asked for separately from the general acknowledgement of this notice.
You may withdraw that consent at any time by writing to privacy@microbiomebank.com. We will then delete the enquiry, unless we are required to keep it by law.
We do not use a child's data for marketing, profiling or automated decision-making.
6. Who we share it with
We do not sell personal data. We share it with the following categories of recipient:
Our form and workflow processors. A message sent through a form on this site is relayed by our own server to Zapier (Zapier Inc., United States), which passes it to monday.com (monday.com Ltd.), where our team handles it. Both act as processors on our instructions.
Google. Our form pages use reCAPTCHA v3 to tell humans from automated abuse, and we use Google Analytics 4 to understand how the site is used. Both involve Google (Google Ireland Limited / Google LLC) receiving technical data such as your IP address. See section 10.
Healthcare providers, to coordinate and deliver care.
Stripe. Card payments are handled by Stripe Payments Europe, Ltd. Card details go to Stripe, not to our server.
Other service providers, such as IT support and hosting.
Regulatory authorities and law enforcement, where the law requires it.
An acquirer, in the event of a merger, acquisition or sale of assets.
7. International transfers
Some of the processors named above are established outside the European Economic Area and the United Kingdom, or process data there. Where that happens we rely on the safeguards permitted by data protection law — principally the European Commission's Standard Contractual Clauses together with the UK International Data Transfer Addendum, and an adequacy decision where one applies. You can ask us for details of the safeguard used in a particular case.
8. How long we keep it
Enquiries that do not lead to a contract:12 months from your last contact with us, then deleted.
Customer and treatment records: for as long as the service relationship lasts, and afterwards for the period required by the applicable medical, accounting and tax rules.
Data kept on the basis of consent: until you withdraw consent, unless another retention period above applies.
9. Security
We apply appropriate technical and organisational measures against unauthorised access, alteration, disclosure or destruction — including encryption in transit, access control, and protection of our forms against automated abuse.
10. Cookies and tracking
Statistics and marketing storage is switched off by default. Google Analytics starts in a cookieless state and only begins to store anything once you have agreed in the cookie banner. Scripts in those categories are not downloaded at all until then. Closing the banner counts as a refusal, not as agreement, and the accept and refuse buttons carry equal weight. Your choice is kept in your browser's local storage rather than in a cookie, and you can change it at any time.
reCAPTCHA v3 runs on pages that carry a form, to protect the form against automated abuse. We regard this as strictly necessary for the form to work safely, so it runs without a separate cookie choice. Google's own Privacy Policy and Terms of Service apply to it.
11. Your rights
In relation to your personal data you have the right to:
Access it, and be told how we process it.
Rectify it, if it is inaccurate or incomplete.
Erase it, subject to the conditions set by law.
Restrict our processing of it.
Portability — receive it in a structured, commonly used, machine-readable format, and have it transmitted to another controller.
Object to processing based on our legitimate interests.
Withdraw consent at any time, where processing is based on consent. Withdrawal does not affect the lawfulness of processing carried out before it.
Complain to a supervisory authority (Article 77 of the GDPR). In the United Kingdom this is the Information Commissioner's Office (ico.org.uk); in Hungary the Nemzeti Adatvédelmi és Információszabadság Hatóság (naih.hu). You may also complain to the authority in your own country of residence.
We may update this notice. Any change is published on this page with a new "Last updated" date. Where a change materially affects how we use your data, we will say so.
