Last updated: 24 October 2026
This policy explains how BioLab Compounds (biolabcompounds.com) collects, uses and protects your data.
Who we are and how to reach us
The site is run by the BioLab Compounds team. For any request about your data write to [email protected]; general questions go to [email protected].
Data we collect
- Account data: name, e-mail, password (stored hashed, never visible to anyone) and the addresses you enter.
- Order data once online ordering opens: products, amounts and billing details. Card data is processed by the payment provider and never stored by us.
- Personalised-service data: your answers in the service form (age, gender, weight, height, goal, training days and place) and files you upload such as an InBody report or lab tests. This is health data and is collected only with your explicit consent.
- Messages: e-mails and live-chat messages if you use the chat. Chat messages are also forwarded to our business mailbox so we can answer even when nobody is online.
- Your newsletter choice if you subscribe: the consent, its date and where it was given (registration or account details) and the site language.
- Technical data: IP address and browser type in the server's security logs.
Why we use it
- To run your account, process your orders and deliver digital files.
- To have the specialist prepare the personalised service you ordered.
- To answer your questions.
- To protect the site and prevent fraud and abuse.
- To meet legal obligations.
- To e-mail news about new products and offers — only to newsletter subscribers.
We do not sell your data and do not use it for advertising or marketing profiles.
Newsletter
Subscribing is entirely optional: an unticked box at registration, which you can change at any time in My Account → Account details. We send news and offers only to people who chose to receive them, and every such e-mail has a one-click unsubscribe link. E-mails about your account and orders (such as an order confirmation) are not marketing and are sent without a subscription.
Health data in personalised services
- Your answers and files are stored encrypted, outside the site's public folder.
- Only the authorised specialist can see them, and every access is logged.
- They are never sent by e-mail; our e-mails only link to your account.
- They are deleted automatically 180 days after the request is completed or cancelled, or earlier if you ask.
- We do not accept data from anyone under 18.
Who processes data on our behalf
- The site's hosting server (site files and database).
- Cloudflare: security and delivery of the site.
- Namecheap Private Email: our business e-mail and the site's e-mails.
- The live-chat provider (Tawk.to or Crisp) when you use the chat; if you are signed in, we pass it your name and e-mail so our team knows who is writing.
- The newsletter service we send news from (such as Mailchimp or Brevo), which receives only subscribers' e-mail, name and language.
- The approved payment provider once online payment is enabled.
We may disclose data to authorities when the law requires it.
Cookies and browser storage
- Cookies needed for sign-in, your session and the order basket.
- Your chosen language, and the site colour you pick, saved in your own browser only.
- The chat provider's cookies when the chat is enabled, and Cloudflare security cookies.
We use no advertising or tracking cookies.
Retention
Account data is kept while your account exists, order records for as long as accounting rules require, health data for 180 days after the request is completed or cancelled, and your newsletter consent while you are subscribed (after you unsubscribe we keep only the date you did). Details: Data Processing and Retention Notice.
Your rights
You can ask for a copy of your data, its correction or deletion, withdraw your consent to the processing of health data, or unsubscribe from the newsletter (with the link in any e-mail, or directly in your account). Send your request to [email protected] from the e-mail registered on your account; we reply within 30 days.
Security
The site runs over HTTPS, health data is encrypted, access is limited by role, sign-in attempts are limited, and every access to sensitive data is logged.
Changes to this policy
We may update this policy; the date of the last update is shown at the top of this page.