Privacy notice.

Last updated: 10 November 2026

Who we are

This website is operated by AMBE LIMITED, a company registered in England and Wales with company number 03809718, trading as Ambe Medical Group. Registered office: Unit 4 Green Lane Business Park, 238 Green Lane, London, SE9 3TL.

AMBE LIMITED is the controller of the personal data described below. For any privacy question or request, email info@ambemedical.com or call +44 (0)1732 760900.

To report a security problem with this website or our systems, email info@ambemedical.com with "Security" in the subject. We reply within 2 working days.

AMBE LIMITED has paid the data protection fee to the Information Commissioner's Office (ICO), the UK's data protection regulator.

What we collect

When you send an enquiry through the Request a Quote form:

• company name, your name, business email and phone number;
• business type and country;
• the product details you give us (product, strength, pack size, quantity, target market, date required);
• anything you write in the notes fields.

When you apply to open a customer or supplier account online:

• the email address you apply with, which we use to send you a one-time sign-in code so you can save your application and return to it;
• company details: company and trading name, company type, country, business type, company registration number and VAT number;
• contact details: a contact name, telephone number, company email, and your registered, invoice and warehouse addresses;
• the names and work contact details of the people you tell us about: a director, your Responsible Person or Qualified Person, and your quality contact;
• licence details, trading currency and whether you are an export customer;
• your answers to our Good Distribution Practice questionnaire, where it applies to you;
• copies of your licences to handle medicines (a wholesale dealer's authorisation, manufacturer's licence, pharmacy or CQC registration, or for export customers your import or wholesale licence). For a company outside the UK, also its company registration certificate. You may add other documents if you choose: a GDP certificate, an ISO certificate, a signed paper copy of the account form, and anything else that supports the application (such as an insurance certificate). We do not ask for passport or identity document copies;
• your signature on the application: the full name and job title you type, your "I agree" tick, the date and time you submitted, and the internet (IP) address you submitted from;
• suppliers only: bank details, so that we can pay you. We ask for them only after we have approved your company, on a separate page. They are stored encrypted, only Ambe's directors can see them, and we confirm them with you by phone before the first payment. We do not ask customers for bank details; if we ever need to refund a customer, we take the details by phone or email.

Emails we send about your application: the sign-in codes; a receipt when you submit; an email telling you if we need more information (you see what we need when you sign in); and an email telling you whether your application was approved, sent when a member of our team records that decision. The notes our team writes while assessing your application are never included in an email.

When you email or phone us: your contact details and whatever you choose to send us, including attachments such as price lists or account forms.

When you visit the site: our server records standard technical logs (including IP address, browser type and the pages requested) to keep the site secure and working. Your IP address is also used briefly to limit repeated form submissions and sign-in attempts. It is not stored with your enquiry. On an account application it is stored only once, as part of your signature when you submit.

We do not use analytics, advertising or tracking cookies on the public site.

If you give us details about other people

An account application asks for the names and work contact details of colleagues, such as a director or Responsible Person. Please make sure they know you have given us their details and show them this notice. We use their details only to assess the application and to run the trading relationship.

Why we use it, and our lawful basis

You do not have to apply online or give us this information, but we cannot open a trading account without it.

Checks we make on an account application. A copy of a licence alone is not enough, so we check each licence on the public register that holds it (MHRA, GPhC or CQC). We check UK companies on Companies House, and we screen every applicant against the UK sanctions list. We cannot accept applications from companies in countries under broad UK sanctions. We may contact the people named in the application to confirm details.

Every account application is reviewed by a person at Ambe before any account is opened. We do not use your data for automated decisions that have legal or similarly significant effects on you, and we do not sell it.

Who can see it, and who we share it with

Account applications and their documents are seen only by the small number of Ambe staff who assess and approve them, including our Responsible Persons. Uploaded documents are kept in our company file storage, which only Ambe staff can open. Supplier bank details are visible to Ambe's directors only.

We share personal data only with service providers who help us run the business and the website, under contract and only for that purpose:

• our website and server hosting provider (servers in the UK);
• our database provider (servers in the UK);
• our email and document storage provider, which sends our emails (including sign-in codes) and holds application documents in our company file storage;
• our AI service provider, which helps us read the price lists and offers suppliers email to us. It does not use your data to train its models.

We may also share information where the law requires it, for example with a regulator such as the MHRA.

International transfers

Some of these providers are based outside the UK, and some data may be processed outside the UK. Where that happens, we rely on the UK's adequacy regulations or on the UK International Data Transfer Agreement or Addendum, so your data keeps the same level of protection.

How long we keep it

• Enquiries that do not lead to trading: 2 years from the last contact.
• Account applications started but never finished: 12 months from the last activity.
• Account applications we decline: 6 years from the decision.
• Customer and supplier records, including approved applications and their documents: we keep them until we decide to delete them. We do not delete them automatically.
• Sign-in codes expire after 15 minutes and can be used once. We store only a scrambled (hashed) version of each code, never the code itself.
• Server logs: up to 90 days.

Your rights

You can ask us to give you a copy of your data, correct it, delete it, restrict or object to our use of it, or transfer it. Contact us using the details above. We will respond within one month.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113). We would appreciate the chance to put things right first.

Cookies

We use only cookies that are strictly necessary, so we do not show a cookie banner.

• ambe_client_onboarding is set only after you enter a sign-in code on the account application. It keeps you signed in to your own application for up to 12 hours, works only on the application pages, and is removed when you sign out. It does not track you.
• ambe_internal_session is set only when Ambe staff sign in to the internal dashboard. It is not used on public pages.

Browsing the rest of the public website sets no cookies.

Changes to this notice

We will update this page when what we collect or how we use it changes, and change the date at the top.