Privacy Policy

Effective date: 25 October 2026 · Version 2026-10-25

1. Who we are

This Privacy Policy explains what the Luxe Meds website collects, why, and what you can control. It covers information you give us when you register, sign in, shop, check out, upload a review, or contact us, and information the website records automatically while you use it. It also forms part of our Terms of Service.

2. Information we collect

When you create an account

Your name, e-mail address and (optionally) phone number.
Your password, which is stored only as a secure one-way hash (Argon2id or bcrypt). Your actual password is never stored or visible to us.
Whether you chose to receive marketing updates (optional, off unless you tick the box).
Which version of the Terms and Privacy Policy you accepted, and when.

When you place an order

Recipient name, phone number, delivery address and city, plus your e-mail if you provide one.
What you ordered: items, sizes, colours, fabrics, quantities, prices and the order total.
The payment method you selected and the payment screenshot you upload as proof of payment.
For custom orders: your design, colour, size, gender, fabric, notes and any logo file you upload.
Order status history (pending, verified, shipped, delivered, cancelled and so on), including the recorded delivery date.

When you write a review

The name you type, your rating, your text, and up to three photos per review.
If you ask for the Verified Purchase badge, the order number and tracking code you type are checked against the order, and a reference to that order is kept with the review so we can always see what the badge stands for. If you are signed in, we use your account instead and no extra details are asked for.

When you ask us to remind you about your basket

The e-mail address you type on the cart page, and the items, sizes, quantities, prices and total of the basket you were looking at.
The delivery area you had chosen, if you had chosen one, so the reminder can name it.
We keep this only because you asked us to. It is used to send you one reminder e-mail and for nothing else — we never add it to a mailing list and never pass it to anyone else.

Recorded automatically

Your session identifier in a cookie (see section 3), used to keep you signed in and to hold your cart.
Your IP address, stored only as a keyed hash for abuse prevention — it is used to rate-limit sign-in and password-reset attempts and to record which network your policy acceptance came from. We do not keep raw IP addresses in the application database.
Standard server logs kept by our hosting provider (see section 6).

3. Cookies and similar technologies

The site uses one essential cookie: the session cookie that holds your sign-in and your shopping cart. It is HttpOnly (JavaScript cannot read it), sent only over HTTPS when the site is served over HTTPS, and set to SameSite=Lax so it is not sent along to other sites.
We do not use advertising, analytics or social-media tracking cookies. There are no third-party analytics, remarketing pixels or embedded trackers on this website — we verified this in the code.
There are currently no non-essential cookies to opt out of, so no cookie banner is shown. If you block cookies entirely, signing in and checkout will not work.
Links to WhatsApp and Instagram are ordinary links; those services' own cookies begin only if you follow them, on their sites.

4. Cart contents, browsing and personalisation

Your cart contents are stored in your own server-side session and are used to build your order summary, calculate totals and complete checkout.
Product suggestions on the website (such as "You May Also Like") are based on the category and type of product you are currently viewing, and the shop's featured products, which are chosen by the store and shown to everyone. Suggestions are not built from a profile shared with other companies.
Activity within the site — pages you view, what you add to your cart — stays inside your session. It is not written to a customer profile used for advertising, not sold, and not shown to other customers.
Your cart, order history and account details are visible only to you (when signed in) and to our staff. Order lookups by guests require both the order number and your private tracking code.
We do not collect sensitive information (health, financial card numbers and so on) for personalisation.

5. How we use information

To create and secure your account, and sign you in (including automatic session expiry and invalidation).
To process, verify, fulfil and deliver your orders, and to answer questions about them.
To verify payments manually: our team reviews the payment screenshot you submit; payment status is confirmed on our backend, never on your browser's say-so.
To handle refund and exchange requests within the 7-day window, and show their status to you.
To show your orders, profile and personalised product suggestions while you shop.
To prevent abuse: rate-limiting sign-ins and password resets, and detecting abusive account activity (see the prohibited-activity rules in our Terms).
To send marketing updates only if you opted in — you can switch this off any time on your account page.
To send the single reminder e-mail about a basket you asked us to remind you about, when you asked for it.
To keep accounting, tax and fraud-prevention records we are required to keep.

We do not sell your personal information.
Hosting: the website, database and files are hosted by our web host, which processes this information on our behalf to run the site (and keeps server logs).
E-mail: password-reset e-mails and basket-reminder e-mails are sent through the hosting provider's mail service.
Delivery: the courier delivering your order receives the minimum needed to deliver — recipient name, address and phone number.
Payments: you transfer the amount yourself to the payment account shown at checkout and upload a screenshot. We never see or store your card or wallet credentials — the screenshot is the only payment file we hold.
Messaging: if you contact us on WhatsApp or Instagram, that service processes your messages under its own policy.
Legal requirements: we may share information where required by law, regulation, or to protect the rights, safety and property of our customers and the business.
Business transfers: if the business is sold or restructured, customer records may be transferred as part of that transaction, subject to this policy.

7. Security and its limitations

Passwords are stored only as Argon2id/bcrypt hashes; they are never stored in plaintext and never returned by any page or interface.
Sessions expire automatically, are regenerated on sign-in, and are invalidated when your password changes or your account is suspended.
Sign-in, registration and password-reset attempts are rate-limited; forms are protected against cross-site request forgery; order and account pages check server-side that you own what you are viewing.
Uploads are validated by real file content (not just the file name), re-encoded, and stored under generated names; private uploads are served only through restricted scripts.
Sensitive directories are blocked from direct web access, debug output is off in production, and security headers are set.
Limitations: no system can be guaranteed 100% secure. We use reasonable, industry-standard measures, but cannot promise absolute security of information transmitted over the internet.

8. Retention, unpaid orders and account deletion

Accounts are kept while your account exists, and until you ask us to delete it.
Orders and payment records are kept for as long as needed for accounting, tax, legal and fraud-prevention purposes.
Unpaid orders: an order still unpaid 48 hours after it was placed is deleted permanently — the order, its items, its custom-order details and any file uploaded for it are removed from our systems — after its payment status has been re-checked on our backend, and never if a payment confirmation is pending or cannot be verified. Your customer account and every other order are unaffected. We keep only our own log entry of the deletion (the order number, the reason and the time) so we can answer questions about it. See section 6 of our Terms.
Payment screenshots and custom logos are deleted together with the order they belong to when an order is permanently deleted by us.
Account deletion: contact us to request deletion of your account. We remove or anonymise personal information held in your account and on your orders, while retaining the records we must keep for accounting, legal or fraud-prevention reasons. Active sessions are revoked immediately. Where an investigation into abusive activity is open, we may suspend first and delete later.
Rate-limit hashes are short-lived entries that expire automatically.
Saved baskets: a basket you asked us to remind you about is deleted 30 days after you left it, together with the e-mail address you gave us. If you place an order instead, the basket is marked as ordered and is never chased. You can also ask us to delete it sooner — just contact us.

9. Your choices and rights

View and correct your name, phone and marketing preference any time on your account page.
Change your password yourself; doing so signs out your other devices.
Marketing consent is optional and separate from accepting the Terms — it is never pre-ticked, and you can withdraw it on your account page or by messaging us.
Access, correction, deletion and portability requests: message us on WhatsApp (below) and we will respond. Where the website gives you self-service access (your orders, profile, reviews), you can use that immediately.
Order lookups: guests can view an order with the order number plus the private tracking code given at checkout.
Complaints: please contact us first; you may also have the right to complain to your local data-protection authority.

10. Children

The website is intended for adult shoppers. If you believe a child has created an account or provided personal information, contact us and we will remove it.

11. Updates to this policy

The current version and effective date appear at the top of this page.
The version you accepted when you created your account or placed an order is recorded, so we can tell you which version applied to you.
Material changes will be highlighted on this page; continued use after an update means you accept the revised policy.

12. Contact

To exercise your rights or ask anything about this policy:
WhatsApp: +923254157498
Instagram: luxemedscrubpk

Related: Terms of Service · My account