Privacy policy
Last updated 28 August 2026
We ask you for health information so that a certified orthotist can design insoles for your feet. This policy explains exactly what we collect, why, who else sees it, and the control you have over it.
Who we are
BioSoles is a trading name of K&S ORTHODESIGNS 3D P&O SERVICES LTD, a company registered in Cyprus: registration number ΗΕ 469238, registered office Giannou Kranidioti 2, 3110 Limassol, Cyprus. We are the data controller for the personal data described in this policy.
For anything to do with your data (questions, requests, or complaints), write to biosoles@outlook.com.
We have not appointed a Data Protection Officer. Data protection questions go to biosoles@outlook.com and are handled by the people responsible for the service.
The short version
- We collect the health answers you give us, your contact and delivery details, and, if you choose to add them, photos of your feet.
- We use them for one purpose: so a certified orthotist can design your insoles and we can get them to you.
- Your health answers are special category data. We rely on your explicit consent, and you can withdraw it at any time.
- Your data is stored in the European Union. We do not sell it, and we do not use it for advertising.
- Your 3D foot scan is captured and held by our scanning partner, Wiky Solutions, on their platform.
What we collect
| Data | Where it comes from |
|---|---|
| Health information: where you feel pain, how long you've had it, diagnosed conditions, arch and gait description, previous orthotics, and the safety questions | The questionnaire you complete |
| Body measurements: shoe size, weight, age, gender | The questionnaire you complete |
| Name and email address | Checkout, and when you sign in |
| Delivery address and phone number | Collected by Stripe during checkout and passed to us |
| Photos of your feet (standing and sitting) | Optional, only if you upload them after paying |
| Your 3D foot scan | Captured on our scanning partner's platform. It is held by them, not by us; we receive your order reference so the scan can be matched to your case |
| Order records: reference, status, printer assignment, quality-control sign-off, manufacturing notes, delivery tracking | Generated as we make and ship your order |
| Messages you send us: order comments and site feedback | Whatever you choose to write |
| Messages you send through the contact form, and your name and email address with them | Whatever you choose to write |
| Sign-in codes, and a session cookie once you're signed in | Generated when you ask to sign in |
| Basic technical data: IP address, browser, and server logs | Automatically, when you use the site |
We never receive or store your full card number. Card details are entered on Stripe's own checkout page and handled entirely by Stripe; we only see a payment reference and whether the payment succeeded.
Why we use it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Designing your insoles: a certified orthotist reads your answers, reviews your scan and specifies the build | Explicit consent for the health data (Article 9(2)(a) GDPR), and performance of our contract with you (Article 6(1)(b)) |
| Taking payment, making your insoles, and delivering them | Performance of our contract with you (Article 6(1)(b)) |
| Emailing you about your order: confirmation, status updates, delivery | Performance of our contract with you (Article 6(1)(b)) |
| Telling you when your answers suggest you should be seen in person instead | Explicit consent, and our legitimate interest in not supplying a device to someone it isn't safe for (Article 6(1)(f)) |
| Keeping the site secure and preventing fraud and abuse | Our legitimate interests (Article 6(1)(f)) |
| Keeping accounting, tax and product records | Compliance with our legal obligations (Article 6(1)(c)) |
| Answering your messages and improving the service from feedback | Our legitimate interests (Article 6(1)(f)) |
We do not use your data for advertising, we do not profile you for marketing, and we do not sell or rent it to anyone.
Your health data
The questionnaire asks about pain, diagnosed conditions and other matters that are health data, a special category under Article 9 of the GDPR, with extra protection. We ask for your explicit consent before you begin, and we process it only to assess suitability, design your insoles, and make them.
You can withdraw that consent at any time by emailing us. Withdrawing it does not make our earlier use of your data unlawful, but it does mean we can no longer design or supply insoles for you, because there is no way to do that without your health answers. If you withdraw before your insoles have been made, contact us and we will discuss what can be refunded.
If you tell us something about your health through the contact form rather than the questionnaire, we treat it with the same care and delete it on the same schedule as the rest of that conversation. We ask you not to put medical detail there, because the assessment is where an orthotist can actually act on it.
How long we keep it
We keep your order and clinical records for as long as we need them to support the device we made for you and to meet our record-keeping obligations, then delete them.
| What | How long |
|---|---|
| Your clinical record: questionnaire answers, the prescription, and the manufacturing spec | 10 years from delivery, so we can support and, if needed, account for the device we made you |
| Photos of your feet | Deleted 12 months after your order is delivered |
| Order, invoice and payment records | 7 years, to meet accounting and tax obligations |
| Messages you send us about an order | Kept with the order record |
| Enquiries from people we referred for in-person care | 12 months, unless you ask us to delete them sooner |
| Site feedback | 12 months |
| Contact enquiries and their replies | 12 months from the last message |
| Website usage measurement | 12 months from the visit |
You can ask us to delete your data sooner. We will do so unless we are required to keep it, for example, invoices we must retain for tax purposes.
An unfinished questionnaire is saved in your own browser so you can pick it up again. It never leaves your device until you pay, it is deleted automatically after 30 days, and it is cleared as soon as your order is placed. Clearing your browser data, or using the “Start over” button, removes it immediately.
Your rights
Under the GDPR you have the right to:
- ask for a copy of the data we hold about you;
- have inaccurate data corrected: you can change your questionnaire answers yourself from your order page until your scan reaches us;
- have your data deleted;
- ask us to restrict how we use it, or object to our use of it;
- receive your data in a portable, machine-readable format;
- withdraw your consent to our use of your health data at any time.
To exercise any of these, email biosoles@outlook.com. We will respond within one month. We may ask you to confirm your identity first, so that nobody else can obtain your health data by pretending to be you.
If you think we have handled your data badly, please tell us so we can put it right. You also have the right to complain to a supervisory authority (in Cyprus, the Office of the Commissioner for Personal Data Protection) or to the authority in the EU country where you live.
How we protect it
Data is encrypted in transit and at rest, and is held in the European Union. Your foot photos are kept in private storage that is not publicly reachable; the orthotist views them through short-lived links that expire. Access to order data is limited to the people who need it to review, make and ship your insoles. Signing in uses a one-time code sent to your email rather than a password.
Children
You must be 18 or over to order. The service is not intended for children: growing feet change shape, and a child who needs insoles should be assessed in person. Do not use this service on behalf of a child without taking clinical advice first.
Changes to this policy
We may update this policy. The date at the top shows when it last changed, and if a change materially affects you we will tell you by email. This version was last updated on 28 August 2026.