TheRecord.

This document describes what SOME DOSE collects, why it is collected, and what you are entitled to do with that information.

It exists because the law requires it and because honest disclosure is a baseline standard. It is not a marketing exercise.

SOME DOSE operates from the Republic of Ireland and is subject to the General Data Protection Regulation (GDPR) and applicable Irish data protection law.

The following categories of data are collected in the course of operating this site and fulfilling orders:

• Identity data — name and email address, provided when creating a patient record or placing an order
• Contact and address data — shipping address, collected at checkout for order fulfilment
• Transaction data — order contents, amounts, and status; payment is processed by a third-party provider and card data does not pass through or reside on this site
• Authentication data — sign-in method and session tokens, used to maintain a secure patient record session
• Technical data — IP address, browser type, and session identifiers generated automatically when you access the site

We do not collect sensitive personal data (health, race, religion, biometric). We do not build marketing profiles. We do not track you across other sites.

Under GDPR, each category of processing requires a lawful basis. Ours are as follows:

• Contract performance — identity, address, and transaction data are processed to fulfil orders you have placed and to communicate with you about them
• Legal obligation — transaction records are retained for a minimum of seven years to satisfy Irish tax and accounting law
• Legitimate interest — technical and session data are processed to maintain site security, prevent fraud, and ensure the site functions correctly

We do not rely on consent as the basis for processing transactional or operational data. For one specific purpose — sending occasional field notes (“dispatches”) — we rely on your explicit consent, given by ticking a non-pre-ticked box at signup. You may withdraw that consent at any time via the one-click unsubscribe link included in every dispatch, or by emailing rx@somedose.com.

SOME DOSE occasionally sends editorial dispatches — field notes from the Apothecary. This is a distinct, consent-based processing activity.

• Legal basis — consent (Art. 6(1)(a) GDPR). Given by ticking a non-pre-ticked checkbox at the point of signup. Consent is freely given, specific, informed, and unambiguous.
• Categories of data collected — email address; timestamp of consent; privacy policy version in force at consent time; browser user agent; verbatim text of the consent statement presented.
• Purpose — delivering infrequent editorial dispatches from SOME DOSE. No profiling. No behavioural advertising. No third-party sharing beyond the transactional email provider disclosed below.
• Retention — your address is retained until you unsubscribe, then kept in an UNSUBSCRIBED state as a suppression record to prevent accidental re-addition. Full erasure is available on request via rx@somedose.com.
• Withdrawal — one-click unsubscribe link included in every dispatch; or email rx@somedose.com. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
• Complaint— you have the right to lodge a complaint with the Data Protection Commission (Ireland's supervisory authority) at dataprotection.ie.

When a product variant is sold out, you may file your return address to receive a single notification when it is restocked. This is a distinct, transient, consent-based processing activity.

• Legal basis — consent (Art. 6(1)(a) GDPR). Given by ticking a non-pre-ticked checkbox on the product page at the point of signup. Consent is freely given, specific, informed, and unambiguous.
• Categories of data collected — email address; product and variant identifier; timestamp of consent; privacy policy version in force at consent time; browser user agent; verbatim text of the consent statement presented.
• Purpose — sending a single transactional email when the specific variant you requested is back in stock. No profiling. No ongoing marketing. No third-party sharing beyond the transactional email provider disclosed below.
• Retention — your record is deleted after the restock notification is sent. If a variant is never restocked, records are deleted after six months. Full erasure is available at any time via the link in the notification email or by contacting rx@somedose.com.
• Withdrawal — one-click withdrawal link included in every notification email; or email rx@somedose.com. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
• Complaint— you have the right to lodge a complaint with the Data Protection Commission (Ireland's supervisory authority) at dataprotection.ie.

With your consent, this site uses Google Analytics 4 to count visits and understand how pages are used. No advertising profiling is carried out.

• Legal basis — consent (Art. 6(1)(a) GDPR). The analytics cookie is only set after you click Accept in the cookie notice. If you click Decline, no analytics script is loaded and no cookie is set.
• Data collected — pages visited, approximate geographic region, device type, and session duration. IP addresses are anonymised before transmission.
• Processor — Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4. Google operates under its own GDPR data processing terms.
• Retention — aggregated session data is retained for 14 months in Google Analytics, after which it is automatically deleted.
• Withdrawal— clear this site’s cookies and localStorage in your browser settings; the consent notice will reappear on your next visit and you may decline at that point.

Certain functions require the involvement of third-party service providers. Data is shared with them only to the extent necessary to perform the relevant function.

• Payment processor — handles card transactions; receives order amount and billing details; operates under its own GDPR-compliant data processing terms
• Authentication provider — used for sign-in; receives your email address or OAuth token for the purpose of verifying identity
• Transactional email provider — used to deliver order confirmations and authentication codes; receives your email address only
• Hosting infrastructure — the site is hosted on a cloud platform; technical data (IP, request logs) passes through its infrastructure

We do not sell, rent, or share personal data with advertisers, data brokers, or any party for commercial purposes.

Under GDPR you have the following rights with respect to your personal data:

• Access — request a copy of the data held about you
• Rectification — request correction of inaccurate data
• Erasure — request deletion of your data where no legal obligation requires its retention; this can be initiated directly via the patient record page
• Portability — request your data in a structured, machine-readable format
• Objection — object to processing based on legitimate interest
• Restriction — request that processing be limited while a complaint is resolved

To exercise any of these rights, contact rx@somedose.com. Requests will be responded to within 30 days.

If you believe your data has been processed unlawfully, you have the right to lodge a complaint with the Data Protection Commission: dataprotection.ie.