Privacy policy

Health Intelligence Group Ltd, trading as privatetests, is the data controller for the personal data you give us. We are registered in England and Wales under company number 17153028, with our registered office at Holly Road Medical Centre, 2A Holly Road, Chiswick, London, W4 1NU. You can reach our data-protection contact at privacy@privatetests.co.uk.

• Launch-list details — your email address, optional first name, the page where you joined and campaign-level source information such as UTM tags and referring site. We do not ask for health interests or medical information on the launch form.
• Account details — your email address, used to sign you in (we are passwordless) and to send order and result notifications.
• Patient details — name, date of birth and sex at birth, needed so the laboratory applies the right reference ranges and the reviewing doctor can interpret your results safely.
• Health data — the tests you order and the results the laboratory reports. This is special-category data under UK GDPR; we process it with your explicit consent, collected when you order.
• Payment — handled entirely by Stripe. We never see or store your card details.
• Usage data — limited interaction events (such as a page view or button click), IP address and browser information used to understand and protect the service. We do not use third-party advertising trackers, and nothing is shared with an analytics vendor: these events go only to our own systems. See Cookies and analytics below for what we store and when.

We ask before we store anything on your device that is not strictly necessary, and declining is one click on the banner. Whatever you choose, the site works the same and we never use third-party advertising trackers.

• Strictly necessary — a small cookie recording your answer to the cookie question, and, if you sign in, a session cookie that keeps you signed in. These do not need consent because without them the things you asked for cannot work.
• If you accept analytics — we store a random identifier in your browser so we can tell that several page views came from one visit. That is what lets us see which explanations are working and where people get stuck. It is a random value, not your name, and it is never shared.
• If you decline, or do nothing — we still count page views, but with an identifier held only in memory that disappears the moment you leave the page. Nothing is written to or read from your device.
• Health pages are treated differently either way. Pages that would reveal something about your health, such as an individual test or a Journal article, are never recorded against a stored identifier, even if you have accepted analytics. We would rather have worse analytics than build a record of what you were worried about.
• Global Privacy Control — if your browser sends this signal we treat it as a decline and do not show you a banner at all.

You can change your mind at any time using the analytics control in the footer of every page. Turning it off also deletes the stored identifier.

• With your consent, to email launch news, service updates and occasional offers.
• To process your order and deliver your sample to a UKAS-accredited laboratory.
• To have every result reviewed, signed and released by a GMC-registered doctor.
• To notify you when your results are ready — results themselves are never emailed.
• To meet our clinical-safety and regulatory obligations (audit trails, incident records).

We rely on your consent to send launch news, service updates and occasional offers. Joining the list is optional and is not required to use any future testing service. We record when and where consent was given and the version of the wording shown. You can withdraw consent at any time without creating or signing into an account.

We use infrastructure providers to host the launch list and may use an email-service provider to send messages on our behalf. They act under contract and cannot use the data for their own marketing. When testing opens, only the people needed to deliver your test will receive relevant data: the accredited laboratory that analyses your sample, the doctor who reviews your result, and our payment and postal providers. We do not sell personal data. If you add family members or a partner to your account, they see only what the person concerned has consented to share.

We review inactive launch-list records after 24 months and delete them unless you renew your interest. If you unsubscribe, we keep the minimum email suppression record needed to make sure we do not contact you again. Medical records, including test results, are retained in line with UK health-records guidance. You can close your account at any time; we will retain only what clinical record-keeping law requires us to keep.

You have the right to access, correct, export and (where the law allows) erase your data, object to processing, and withdraw marketing consent at any time. Every marketing email will include an unsubscribe link; you can also email privacy@privatetests.co.uk and we will respond within one month. You can also complain to the ICO at ico.org.uk.

Data is encrypted in transit and at rest, access is role-restricted and audited, and every access to a result is logged. Identity documents used for verification are processed on our own infrastructure and never retained as images.