01Who we are
[BioHealthcare Hub UK Ltd], a company registered in England and Wales (company number [company number]), whose registered office is at Broadgate Tower, 12th Floor, 20 Primrose Street, London EC2A 2EW is the controller of your personal data. We are registered with the Information Commissioner's Office (ICO) under registration number [ICO registration number]. Our Data Protection Officer is [Data Protection Officer name / contact], contactable at [privacy@biohealthcarehub.co.uk].
We comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (as amended by the Data (Use and Access) Act 2025) and the Privacy and Electronic Communications Regulations 2003 (PECR).
02The personal data we collect
| Category | Examples |
|---|---|
| Identity & contact | Name, date of birth, sex recorded at birth (needed for reference ranges), address, email, phone |
| Account & order | Login details, orders, appointments, payment confirmations (we don't store full card numbers) |
| Health data (special category) | Health questionnaire answers, samples, test results, reports, clinical notes, messages with our clinical team |
| Genetic data (special category) | DNA test results and raw genetic data |
| Communications | Emails, calls, chat messages and feedback |
| Technical | IP address, device and browser information, cookie data (see our Cookie Policy) |
| Marketing preferences | Your choices about receiving marketing |
03How we use your data and our lawful bases
| Purpose | Lawful basis (Art. 6) | Special category condition (Art. 9) |
|---|---|---|
| Providing your tests, reports and Hub | Contract | Explicit consent; and provision of health care (Art. 9(2)(h) with DPA 2018 Sch. 1 para 2) |
| Clinical review, safety alerts and contacting you about urgent results | Contract; vital interests where necessary | Provision of health care (9(2)(h)); vital interests (9(2)(c)) |
| Customer service and complaints | Contract; legitimate interests | Explicit consent or health care, where health data is involved |
| Payments, fraud prevention and accounting | Contract; legal obligation; legitimate interests | Not applicable |
| Quality assurance and regulatory obligations (e.g. CQC, laboratory accreditation) | Legal obligation; legitimate interests | Health care; public health (9(2)(i)) |
| Research, using de-identified data | Consent | Explicit consent (separate, optional) |
| Marketing | Consent or legitimate interests (soft opt-in under PECR) | Never uses health or genetic data |
| Website analytics | Legitimate interests (aggregate statistics only) | Never uses health data |
04Who we share data with
- Our UKAS-accredited partner laboratories ([UKAS-accredited ISO 15189 partner laboratory name(s)]) and phlebotomy and logistics partners, to deliver your tests.
- UK-registered clinicians who review orders and results for us.
- IT, hosting, email and payment providers acting as our processors under written contracts.
- Other BioHealthcare Group companies that provide technical services to us, under an intra-group data processing agreement.
- Your GP or another clinician, only with your consent, or without consent only where there is a serious risk to your life or health and we cannot reach you.
- Regulators, law enforcement or courts where the law requires it.
We never sell your personal data, and never share health or genetic data with insurers, employers or advertisers.
05International transfers
We store your health and genetic data in the UK [confirm hosting location]. Some service providers, including group companies in the United States, may access limited personal data. Where data leaves the UK, we use a UK adequacy regulation (including the UK–US Data Bridge for certified US organisations), the ICO's International Data Transfer Agreement or Addendum, or another lawful safeguard. You can ask us for details.
06How long we keep data
| Data | Retention |
|---|---|
| Test results, reports and clinical records | [8 years after your last test, in line with UK health record guidance; confirm] |
| Blood and stool samples | Destroyed by the laboratory after testing, normally within [30] days |
| DNA samples | Destroyed within [60] days of your report unless you consent to longer storage |
| Account and order records | 6 years after your last order (tax and limitation periods) |
| Marketing preferences | Until you unsubscribe, plus a suppression record |
07Your rights
You have the right to: access your data; correct inaccurate data; erasure; restrict processing; data portability; object to processing based on legitimate interests and to direct marketing at any time; withdraw consent at any time; and not be subject to solely automated decisions with significant effects without safeguards. We don't make such decisions about you.
To exercise a right, email [privacy@biohealthcarehub.co.uk] or use the privacy settings in your Hub. We'll respond within one month (extendable by two months for complex requests). Some rights are limited where we must keep health records by law.
08Security
We use encryption in transit and at rest, access controls, multi-factor authentication for staff, audit logs and regular security testing. [Add Cyber Essentials Plus / ISO 27001 certification if held.] If a breach is likely to result in a high risk to you, we'll tell you without undue delay.
09Children
Our services are for adults aged 18 and over. We don't knowingly collect data from children.
10Complaints
If you're unhappy with how we've handled your data, please complain to us first at [privacy@biohealthcarehub.co.uk]. We'll acknowledge your complaint within 30 days, investigate it and tell you the outcome, as required by the Data Protection Act 2018. You also have the right to complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, 0303 123 1113.
11Changes
We'll post any changes here and tell you about significant changes by email.