Privacy policy

MD Lanka (Pvt) Ltd (“we”, “us”) operates medicaldeviceslanka.com, selling orthopaedic supports and braces in Sri Lanka. We are the data controller for the information described here.

Only what is needed to take an order and deliver it:

• Order details — your name, phone number, email address and delivery address, plus any delivery notes you add.
• Account details — if you create an account, your email, name, phone number, saved addresses and saved products.
• Order history — what you bought, when, and the status of each order.
• Technical data — your browser sends an IP address and browser type with every request. Our hosting and database providers log these to keep the service running and to detect abuse.

We do not collect or store card or bank details. Orders are cash on delivery, so no payment information passes through this site at all.

We do not ask for medical records or diagnoses, and you should not send them to us. What you buy can imply a health condition, so we treat your order history as sensitive: it is visible only to you and to our staff, and we never sell it, share it for advertising, or use it to build advertising profiles.

• To take, fulfil and deliver your order — our contract with you.
• To contact you about that order by phone or email.
• To provide fitting advice when you ask for it.
• To keep accounting records, as the law requires.
• To send marketing email — only if you opted in. Order emails are sent either way, because they are part of the service.

We share the minimum necessary with:

• Delivery couriers — your name, address and phone number, so they can deliver and collect payment.
• Supabase — our database and authentication provider, which stores this data on our behalf.
• Resend — our email provider, which sends order confirmations and account emails.

We never sell your personal information. We do not share it for advertising.

Needs your review: If your hosting, database or email providers store data outside Sri Lanka, cross-border transfer needs to be disclosed here and may require a lawful transfer basis. Confirm where each provider's region is set.

Order records are kept for as long as accounting and tax rules require. Account details are kept until you ask us to close your account. Marketing consent is kept until you withdraw it.

You can ask us to:

• tell you what personal data we hold about you, and give you a copy;
• correct anything that is wrong;
• delete your account and the data attached to it;
• stop sending you marketing, at any time;
• withdraw consent you previously gave.

Signed in, you can already view your orders, edit your details and manage your saved addresses under your account. For anything else, email sales@mdlanka.lk and we will respond within 30 days.

We use only what the site needs to work: a session cookie that keeps you signed in, and browser storage that remembers your basket between visits. There are no advertising or third-party tracking cookies, so there is nothing to consent to and no banner to dismiss.

Traffic is encrypted in transit. Access to customer data is restricted to staff accounts and enforced at the database level, not just in the interface, so a bug in the website cannot expose another customer's orders. Passwords are hashed by our authentication provider and are never visible to us.

This site is not intended for children under 16. We do not knowingly collect their data. Products bought for a child should be ordered by a parent or guardian.

If we change this policy we will update the date at the top of the page. Questions or complaints: sales@mdlanka.lk.