01Why this notice exists
In the US, healthcare providers give patients a HIPAA Notice of Privacy Practices. In the UK, your health information is protected by UK GDPR, the Data Protection Act 2018 and the common law duty of confidentiality. This notice sets out what that means when you use our clinical services. It should be read with our Privacy Policy.
02Our duty of confidentiality
Everyone who works for us or on our behalf, including clinicians, laboratory staff and phlebotomists, must keep your information confidential. We follow the Caldicott Principles and our clinicians follow the confidentiality guidance of their regulators (for example the GMC, NMC and HCPC). [Name your Caldicott Guardian.]
03Your health record
We keep a health record for each customer, including your health questionnaire, test orders, results, reports and any notes from clinical consultations. This record is separate from your NHS record and we don't add to your NHS record unless you ask us to share your results with your GP.
04How we use and share your health information
- To provide your care: arranging tests, analysing samples, producing reports and clinical review.
- To keep you safe: contacting you about results that need prompt attention.
- With your GP or other clinicians: only with your consent, except where there's a serious risk to your life or health and we can't reach you, or another person is at serious risk.
- Where the law requires it: for example notifying UKHSA about certain infectious diseases, responding to a court order, or regulatory inspections.
- Never for marketing, and never sold or shared with insurers or employers.
05Notifiable infections
If a sexual health or infection test shows a condition that laboratories must report under the Health Protection (Notification) Regulations 2010, the laboratory will notify the UK Health Security Agency (or the equivalent body in Scotland, Wales or Northern Ireland). We'll explain what this means and help you access NHS sexual health or GP services.
06Accessing and correcting your record
You can download your reports in your Hub at any time. You can ask for a copy of your full record, or ask us to correct it, by emailing [privacy@biohealthcarehub.co.uk]. We'll respond within one month, free of charge.
07Your choices
You can withdraw consent to sharing with your GP, or to research, at any time in your Hub. If you ask us to delete your record, we'll explain what we must keep by law (for example clinical records needed for patient safety or legal claims).
08Concerns and complaints
Please contact our Data Protection Officer at [privacy@biohealthcarehub.co.uk]. You can also complain to the ICO (ico.org.uk) or, about clinical care, through our complaints process in the Terms & Conditions.