Privacy & Cookie Policy

1. Who We Are

Only Cells LTD ("we", "our", or "us") provides clinical bench calculators, educational webinars, case studies, courses and morphological training tools for laboratory professionals, and sells science pins, mugs and other items through the Only Cells shop. We are a private limited company registered in England and Wales (company number 16028313; registered office 128 City Road, London, EC1V 2NX) and we are the controller of the personal data described here. We are registered with the Information Commissioner's Office (registration number ZB921339). We are committed to protecting your personal data and respecting your privacy rights.

2. Data We Collect

• Local Bench Preferences: Theme settings (dark/light), font scale, animation toggles, your currency choice in the shop and similar display choices are saved directly in your browser's local storage. None of these contain personal identifiers.
• Client-Side Calculations: Diagnostic tools (e.g. cell differential counters, dilution wizards, unit converters) run entirely in your web browser. No patient or sample data is transmitted to or stored on our servers.
• Your Only Cells Account: If you make an account, we keep your name, email address, username, password (stored only in a scrambled, one-way form), the public username you choose, the name you choose for certificates, and, if you add them, your phone number and delivery addresses. We also keep the courses you can open, your course progress and certificates, the Morphology Monthly cases linked to your account, your orders, your basket (so it follows you between devices) and when you last signed in. Your public username is the only part shown to other people; your full name and certificate name are never made public.
• Shop Orders: When you buy from the Only Cells shop, with or without an account, we keep your name, email address, delivery address, what you bought, the price, postage and any offer, and the order's progress (paid, posted, refunded). For parcels to the United States we also need your phone number for customs. We use this to take payment, post your order, send you emails about it, handle returns and refunds, and keep the accounts that the law requires.
• Courses: When you take a course, your progress is saved in your browser and, when you are signed in, to your account, so you can carry on from another device. When you finish, we keep a record of your certificate (your name for certificates, the course and the date) so that it can be checked.
• Reviews: If you review something you bought, we keep your star rating and words with your public username, and show them on the website once we have checked them. You can ask us to remove a review at any time.
• Enquiries & Contact: If you email us or submit feedback, we retain your email address and message contents to respond to your query.
• Case Study Submissions: When you press Submit on the final station of a Morphology Monthly case study, we keep a record of your completion: the name and optional registration number you enter for your certificate, your answers and reflection as shown in your CPD record, your score, and a copy of your CPD record and certificate (PDF). If you are signed in, the record is linked to your account. We use this to verify certificates and to understand how cases are used. It is kept securely, viewable only by the Only Cells administrator, and you can ask us to delete it at any time.
• Corrections & Shared Images: If you report a mistake with the “Something incorrect?” button in the Cell & Parasite Identifier, we keep your report, the page it is about and, if you give them, your name and email address so we can reply. If you share pictures for our image library, or contribute and label pictures as an Only Cells contributor, we keep the pictures (with their hidden camera, place and date details removed), the details and labels you enter, the credit you choose, the version of the contributor terms you accepted and your email address. Your chosen credit is shown on any picture we publish; your email address is never published and is used only to contact you about your report or pictures. Both are viewable only by the Only Cells administrator, and you can ask us to delete them at any time.
• Training LIMS: When a university or college uses the Only Cells Training LIMS (onlycells.co.uk/lims), its tutors make accounts for their students and other tutors. For each person we keep their name, email address, username, password (stored only in a scrambled, one-way form), class, the lab roles their tutor allows (for a results viewer, such as a nursing student, which wards, clinics or students’ patients they may see) and when they last signed in, and an audit trail of what they do in that lab, such as signing in, changing accounts or settings, and the reports a results viewer opens. Each university's lab is kept in its own separate database that only its own tutors and the Only Cells administrator can see. The patients and samples in the Training LIMS are fictional, and real patient information must never be entered. We hold this data on behalf of the university or college, which decides who has an account; students should contact their tutor first about their data.
• Security: To protect accounts, we keep the details needed for two-step sign-in where you use it, and short-lived counts of sign-in attempts. These counts are stored against a scrambled code made from your internet address that changes every day, so they cannot be traced back to you.
• Site Analytics: We measure visits with our own privacy-friendly analytics, hosted on our server with no third parties. It records the pages you view, time spent on them, links clicked, the website or social network that referred you, and your approximate country. It sets no cookies, does not store your IP address, and cannot identify you or follow you across days. Choosing “Reject All” on our cookie banner, or enabling Do Not Track / Global Privacy Control in your browser, switches it off.
• Your Country: The shop works out your approximate country from your internet address, on our own server, to show the right prices, postage and currency. Your internet address is not stored for this.

3. Payments

Payments in the Only Cells shop are taken by Stripe on its own secure checkout page. Your card details go straight to Stripe and never reach or are stored on our servers. Stripe tells us whether the payment worked, the amount and currency, and the billing country, and, if you ask it to, keeps your card for next time under your account. If you pay in another currency, Stripe makes the conversion. Stripe uses your payment information under its own Privacy Policy, including to prevent fraud.

We also sell through our official Etsy storefront. Orders placed on Etsy, and the payment and shipping details given there, are handled under Etsy's Privacy Policy and Buyer Protection programme. Our website reads only which items sold on Etsy, so that our stock stays correct; it does not copy Etsy buyers' names or addresses.

4. Who We Share It With

We never sell your personal data. We share it only with the services that help us run Only Cells, and only what each one needs:

• Hostinger: hosts this website and the data described above.
• Stripe: takes card, Apple Pay and Google Pay payments and refunds.
• Microsoft 365: sends and stores our emails, including order and course emails.
• Royal Mail: receives your name and delivery address (and, for the United States, your email address and phone number for customs) so that your parcel can be delivered.
• Gelato and Inkthreadable: our print partners, who make and post our mugs and other made-to-order items. Inkthreadable handles UK orders and posts them with Royal Mail; Gelato handles orders outside the UK. They receive your name, delivery address and what you ordered, and Gelato may pass these to its production partner and postal service in or near your country so that your item can be made and delivered close to you.
• Our accountants and accounting software: receive order and payment records so that we can keep the accounts the law requires.

Some of these services may process data outside the United Kingdom. Where they do, they use the safeguards UK law requires, such as UK adequacy regulations or the UK International Data Transfer Agreement. We may also share data if the law requires us to.

5. Cookies & Local Storage

We use a small number of cookies that are strictly necessary for the site to work. They do not track you and do not need your consent:

• OCCOURSE: keeps you signed in and remembers your basket. It lasts up to 30 days.
• oc_nav: shows the number of items in your basket and, when you are signed in, your first name in the site header. It lasts up to 30 days.
• oclims_ cookies: keep you signed in to your university's Training LIMS lab and protect its sign-in form. They end when you close your browser, and each lab has its own.
• OCADMIN and oc_admin_skip: used only by the Only Cells administrator to sign in to the admin pages.

Your browser's local storage also keeps your display choices (see Local Bench Preferences above), your cookie banner choice, and course progress made while signed out. You can clear these at any time in your browser settings.

When you pay, Stripe's checkout page sets its own cookies, which Stripe needs to take the payment safely and prevent fraud.

6. Embedded Services & Third-Party Cookies

We embed educational videos from YouTube. Playing videos may place analytics and tracking cookies set by Google/YouTube. You can control or reject optional non-essential cookies using the cookie banner on this site or via your browser settings.

7. How Long We Keep It

• Accounts: until you ask us to delete your account. Orders linked to a deleted account are kept, without the link, for as long as the law requires.
• Orders and payment records: six years after the end of the financial year in which you bought, because UK tax law requires it.
• Case submissions, certificates, reports, reviews and shared images: until you ask us to delete them, so that certificates can still be checked.
• Training LIMS: for as long as the university's licence runs. A tutor can remove an account at any time, and it is deleted at once. When a licence ends, the lab stays read-only for 30 days so tutors can download their records, then its whole database is deleted.
• Enquiries: for as long as we need them to answer you and deal with any follow-up.

8. Our Legal Basis

We use your data to provide what you ask for, such as your account, your order or your course (contract); to keep the records the law requires, such as our accounts (legal obligation); and to keep the site secure, prevent fraud and improve our resources in ways you would expect (legitimate interests). Where we rely on your consent, such as for YouTube cookies, you can withdraw it at any time.

9. Your Legal Rights

Under UK GDPR, you have the right to request access to, rectification of, or erasure of any personal data we hold about you, and to object to or restrict how we use it, or to receive a copy of it to take elsewhere. You can change most of your account details yourself on your account page. To make a request, contact our team at contact@onlycells.co.uk. If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk.