Privacy policy

Last updated: October 7, 2026

1. Who we are

This Privacy Policy explains how Circadian Healing Ltd, trading as In Rhythm ("we", "us", "our"), collects, uses, shares and protects your personal information when you visit our website and online store (inrhythm.earth and shop.inrhythm.earth), buy our products, join our emails, or contact us.

Circadian Healing Ltd is the "controller" of your personal information. We are a company registered in England and Wales, company number 16307291, with our registered office at 124 City Road, London, EC1V 2NX, United Kingdom. You can contact us about privacy at team@inrhythm.earth.

We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, the EU GDPR where it applies to you, and applicable US state privacy laws.

2. Information we collect

Information you give us:

• Identity and contact details: your name, email address, phone number, and billing and shipping addresses.

• Order details: what you bought, when, how much you paid, discount or affiliate codes used, and your order and support history.

• Payment information: payments are processed by our payment providers (such as Shopify Payments, Shop Pay and PayPal). We do not see or store your full card number.

• Communications: emails and messages you send us, survey responses, and reviews.

• Marketing preferences: whether you have signed up to our emails and how you would like to hear from us.

• Information you choose to share about your health or sleep: for example, if you reply to one of our emails describing your sleep. See section 4 below.

Information we collect automatically:

• Device and usage information: your IP address, browser and device type, operating system, time zone, pages viewed, links clicked, and how you arrived at our site (including campaign tags in links).

• Email engagement: whether our emails are delivered and opened and which links are clicked, so we can send relevant emails and keep our mailing list healthy.

• Cookies and similar technologies: see section 9.

Information from others: payment providers (to confirm payment and prevent fraud), delivery partners (to confirm delivery), affiliates and partners (when you use their link or code), and advertising and analytics providers (aggregated campaign performance).

3. How we use your information

4. Health information

We do not ask for health information to sell you a product. If you choose to tell us about your health or sleep, for example in an email or survey, we will use it only to respond to you and, with your explicit consent, to improve our products and support. You can ask us to delete it at any time by emailing team@inrhythm.earth. Our products are not medical devices and we do not provide medical advice.

5. Marketing emails and messages

We send marketing emails if you have signed up for them, or if you have bought from us and have not opted out (where the law allows). We will only send SMS or WhatsApp messages if you have specifically opted in to those channels.

Every marketing email includes an unsubscribe link. You can also opt out by emailing team@inrhythm.earth. Unsubscribing from marketing will not stop essential service messages about your orders.

We never sell your email address, and apart from Shopify's use described in section 7, we never share your information with other companies for their own marketing.

6. Affiliates

When you use an affiliate's link or code, our affiliate platform records the referral so we can pay the affiliate's commission. Affiliates may see limited information about orders they referred (such as the order value and date), but they do not receive your contact or payment details.

7. Who we share your information with

We share personal information only as needed to run our business and provide the Services, with:

• Store and checkout: Shopify (hosting our store and checkout) and payment providers such as Shopify Payments, Shop Pay and PayPal. Shopify may also use data about your purchases, combined with data from other Shopify stores, to improve its services, personalization and ad targeting, as described in Shopify's privacy policy.

• Email: Klaviyo and Kit (email delivery and marketing).

• Fulfillment and delivery: our warehouse and fulfillment partners in the US and internationally, shipping software, and delivery carriers.

• Affiliates: UpPromote (our affiliate platform).

• Reviews: Judge.me (collecting and displaying product reviews).

• Analytics and advertising: Google (including Google Analytics) and Meta (Facebook and Instagram), where you have allowed analytics or advertising cookies.

• Professional advisers: our accountants, lawyers and insurers.

• Authorities: tax authorities, regulators or law enforcement where required by law.

• Business transfers: a buyer or investor, if we sell or restructure all or part of our business, under confidentiality obligations.

Our service providers may only use your information to provide services to us and must protect it.

8. International transfers

We are based in the UK, and many of our service providers are in the United States or elsewhere. When we transfer personal information outside the UK or European Economic Area, we make sure it is protected, for example through UK or EU adequacy regulations (including the UK-US data bridge), the UK International Data Transfer Addendum, or the European Commission's standard contractual clauses.

Our fulfillment partners receive only the name, address and contact details needed to ship your order. Where a partner is outside the UK or EEA, we protect that transfer with the UK International Data Transfer Addendum and the European Commission's standard contractual clauses.

9. Cookies and tracking

We use cookies, pixels and similar technologies to:

• make our store work (for example, your cart and checkout). These are essential and cannot be switched off;

• remember your preferences;

• understand how visitors use our site (analytics); and

• measure and personalize our advertising (for example, the Meta Pixel and Google tags).

Where the law requires it, we ask for your consent before setting non-essential cookies, and you can change your choices at any time using the cookie or privacy settings link on our website. You can also block or delete cookies in your browser settings, but parts of the store may not work properly. Our emails contain tracking links and pixels so we can see whether emails are opened and links clicked; you can limit this by turning off image loading in your email app.

10. How long we keep your information

• Customer and order records: 6 years after your last order, for tax and legal purposes.

• Marketing contacts who have not bought from us: up to 3 years after your last interaction with us, or until you unsubscribe or ask us to delete your information.

• Health information you choose to share: only as long as needed for the purpose you shared it for, or until you ask us to delete it.

• Anonymized or aggregated data: may be kept indefinitely, as it no longer identifies you.

When you unsubscribe, we keep your email address on a suppression list so we do not email you again by mistake.

11. How we protect your information

We use appropriate technical and organizational security measures, and only people and partners who need your information to do their job can access it. We have procedures to deal with any suspected data breach and will notify you and the regulator where we are legally required to.

12. Your rights

Depending on where you live, you have the right to:

• access the personal information we hold about you;

• correct inaccurate information;

• ask us to delete your information;

• restrict or object to how we use it, including objecting to marketing at any time;

• receive a copy of your information in a portable format;

• withdraw your consent at any time, where we rely on consent.

To exercise any of these rights, email team@inrhythm.earth. We will respond within one month (or 45 days where US state law applies), and there is normally no fee. We may need to verify your identity first.

If you are in the UK, you can complain to the Information Commissioner's Office (ico.org.uk). If you are in the EU, you can complain to your local data protection authority. We would appreciate the chance to resolve your concern first.

13. Additional information for US residents

Residents of California and certain other US states have additional rights, including the right to know what personal information we collect and how we use it (as described above), to access, correct and delete it, and to opt out of the "sale" or "sharing" of personal information for targeted advertising.

We do not sell personal information for money. Some advertising cookies and pixels (such as the Meta Pixel) may be considered "sharing" for cross-context behavioral advertising under some state laws. You can opt out by using the privacy settings link on our website or by emailing team@inrhythm.earth, and we honor Global Privacy Control (GPC) browser signals as a valid opt-out. We will not discriminate against you for exercising your privacy rights. You may use an authorized agent to make a request on your behalf.

14. Children

Our Services are not directed at children, and we do not knowingly collect personal information from anyone under 16. You must be 18 or over to place an order. If you believe a child has given us personal information, please contact us and we will delete it.

15. Changes to this policy

We may update this Privacy Policy from time to time. The latest version will always be on this page with the date it was last updated. If we make significant changes, we will let you know where required by law.

16. Contact us

Circadian Healing Ltd (trading as In Rhythm)
124 City Road, London, EC1V 2NX, United Kingdom
Company number 16307291, registered in England and Wales
Email: team@inrhythm.earth