Privacy Notice

01Who we are (data controller)

The data controller for the personal data described here is Ondermax Ltd, a company registered in England and Wales.

02What we collect

When you submit the consultation application at /consult, we collect the details you provide:

• Your name.
• Your work email and, if you choose to provide it, your phone number.
• Your organisation or practice.
• The country where you primarily operate.
• The context that best describes you (for example, clinic, operator, distributor, research, or other).
• The free-text details you write about what you're building.
• A record of your consent to be contacted about your application.

We also process limited technical data (your IP address and a timestamp) used only for anti-spam and rate-limiting on the application form. We do not use it to profile you.

If you choose to message our business WhatsApp number, we receive and store, as a sales enquiry, the details WhatsApp passes to us:

• Your WhatsApp phone number.
• The profile name shown on your WhatsApp account.
• The text of the message you send us.

You start this contact, and you control what you send. WhatsApp is provided by Meta. See "Who we share it with" below.

03Why we use it

We use the information solely to assess and respond to your consultation or partnership application, or to your WhatsApp enquiry, and to communicate with you about it. We do not use it for unrelated marketing.

When you submit the consultation application, we send you an automatic acknowledgement email confirming we've received it. After that, a member of our team may email you to respond, ask follow-up questions, or arrange a call about your application. We do not add you to a marketing list.

04Legal basis

Under the UK GDPR, our primary legal basis for handling your application (and any enquiry you send us on WhatsApp) is our legitimate interests: receiving, assessing and responding to your consultation or partnership application or enquiry, managing the prospective business relationship, and protecting the form against abuse (anti-spam / rate-limiting). We balance this against your rights and reasonable expectations, and you can object at any time (see "Your rights").

The tick box on the form records your consent for us to contact you about your application. If we ever wish to send you separate marketing, we would rely on a fresh, specific consent that you can withdraw at any time. We do not use your application details for unrelated marketing.

05Who we share it with

We share your personal data only with the service providers that help us run the service, namely our hosting platform and our email provider, and (for messages you send us on WhatsApp) Meta Platforms, who provide WhatsApp and carry your message to us as the messaging transport. We share data only so far as needed to operate the service. We do not sell your personal data, and we don't share it with advertisers.

06International transfers

Your application data is hosted in the United Kingdom or the European Union. Some of our team operate in the GCC region, which the UK has not recognised as providing an equivalent level of data protection. Where they access your data, we protect that transfer using the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses, supported by a transfer risk assessment, as required by the UK GDPR. You can ask us for a summary of the safeguards we use.

07How long we keep it

We keep your consultation application data for 24 months from our last activity on it, so we can follow up while a partnership is realistically still in view. After that period (unless we have entered into a business relationship with you, or we are required to keep it longer by law) an automated routine removes the personal details from the record (we anonymise it), leaving only non-identifying information.

For enquiries you send us on WhatsApp, we keep the message and your contact details for as long as needed to respond to you and manage any business relationship that follows, and no longer than necessary. If you ask us to erase any of your data sooner, we will do so unless we're required to keep it.

08Your rights

Subject to UK GDPR, you have the right to:

• Access the personal data we hold about you.
• Rectification of inaccurate or incomplete data.
• Erasure of your data ("right to be forgotten").
• Restriction of how we process your data.
• Objection to processing based on legitimate interests.
• Portability: receive your data in a portable format.
• Withdraw consent at any time, without affecting processing already carried out.

To exercise any of these, email hello@ondermax.com. We will respond within one month. If your request is complex, we may extend this by up to two further months, and we will tell you within the first month if we need to. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk, though we'd appreciate the chance to resolve it with you first.

09Cookies

We keep cookies to a minimum. The application form uses a single session cookie for security (to protect the form against cross-site request forgery). We do not set tracking, advertising, or marketing cookies.

10Changes to this notice

We may update this notice from time to time. When we do, we'll revise the "Last updated" date at the top of the page. This version was last updated on 28 June 2026.