Privacy policy

privatetests is the data controller for the personal data you give us. You can reach our data-protection contact at privacy@privatetests.co.uk.

• Launch-list details — your email address, optional first name, the page where you joined and campaign-level source information such as UTM tags and referring site. We do not ask for health interests or medical information on the launch form.
• Account details — your email address, used to sign you in (we are passwordless) and to send order and result notifications.
• Patient details — name, date of birth and sex at birth, needed so the laboratory applies the right reference ranges and the reviewing doctor can interpret your results safely.
• Health data — the tests you order and the results the laboratory reports. This is special-category data under UK GDPR; we process it with your explicit consent, collected when you order.
• Payment — handled entirely by Stripe. We never see or store your card details.
• Usage data — limited interaction events (such as a page view or button click), IP address and browser information used to understand and protect the service. Our website analytics do not write an identifier to cookies or browser storage, and we do not use third-party advertising trackers.

• With your consent, to email launch news, service updates and occasional offers.
• To process your order and deliver your sample to a UKAS-accredited laboratory.
• To have every result reviewed, signed and released by a GMC-registered doctor.
• To notify you when your results are ready — results themselves are never emailed.
• To meet our clinical-safety and regulatory obligations (audit trails, incident records).

We rely on your consent to send launch news, service updates and occasional offers. Joining the list is optional and is not required to use any future testing service. We record when and where consent was given and the version of the wording shown. You can withdraw consent at any time without creating or signing into an account.

We use infrastructure providers to host the launch list and may use an email-service provider to send messages on our behalf. They act under contract and cannot use the data for their own marketing. When testing opens, only the people needed to deliver your test will receive relevant data: the accredited laboratory that analyses your sample, the doctor who reviews your result, and our payment and postal providers. We do not sell personal data. If you add family members or a partner to your account, they see only what the person concerned has consented to share.

We review inactive launch-list records after 24 months and delete them unless you renew your interest. If you unsubscribe, we keep the minimum email suppression record needed to make sure we do not contact you again. Medical records, including test results, are retained in line with UK health-records guidance. You can close your account at any time; we will retain only what clinical record-keeping law requires us to keep.

You have the right to access, correct, export and (where the law allows) erase your data, object to processing, and withdraw marketing consent at any time. Every marketing email will include an unsubscribe link; you can also email privacy@privatetests.co.uk and we will respond within one month. You can also complain to the ICO at ico.org.uk.

Data is encrypted in transit and at rest, access is role-restricted and audited, and every access to a result is logged. Identity documents used for verification are processed on our own infrastructure and never retained as images.