Privacy Policy

1. Introduction

London Blood Tests Ltd (“we”, “us”, “our”) is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, store and share your information when you use our website https://londonbloodtests.uk or our services.

We are the Data Controller under the UK Data Protection Act 2018 and the UK GDPR.

2. Data We Collect

We may collect and process the following information:

• Identity data: Name, date of birth, address.
• Contact data: Email, phone number.
• Health information: Medical history, test details, and results.
• Payment data: Card or transaction details (processed securely via our payment provider).
• Technical data: IP address, browser type, cookies and analytics.

3. How We Use Your Information

We process your data to:

• Manage and deliver your blood test services.
• Communicate test results securely.
• Handle bookings, payments and refunds.
• Improve our website and services.
• Comply with legal and regulatory obligations.

We will never sell your data.

4. Sharing Your Data

We share only what is necessary with:

• Third-party phlebotomy providers who collect your samples.
• Accredited laboratories that perform your analysis.
• IT and payment processors that securely manage our systems.
• Our AI analysis partner, Kantesti — only if you choose to create an AI blood test report (see section 8).

All third parties are bound by confidentiality agreements and UK GDPR compliance.

5. Data Storage & Retention

• Your data is stored on secure UK or EEA servers.
• Medical data is retained for up to 7 years (or as required by law).
• You may request deletion where legally permitted.

6. Your Rights

You have the right to:

• Access your data (subject access request).
• Request correction or deletion.
• Withdraw consent at any time.
• Lodge a complaint with the Information Commissioner’s Office (ICO) at www.ico.org.uk.

7. Security

We use encryption, secure servers, and restricted access to protect your data. Only authorised staff and clinicians can access personal medical information.

8. AI Blood Test Reports

If you choose to create an AI blood test report, we use Kantesti, a specialist blood test analysis service, to read your blood test and produce the analysis shown in your report. This section explains exactly what happens with your data and your rights around it. Nothing is sent to Kantesti unless you ask for a report and give your consent.

What data we send

We send the blood test you choose — a result already in your account, or a PDF or photos you upload — and, if you enter one, the password needed to open the PDF. Laboratory reports usually show your name, date of birth and sample details, so these reach Kantesti as part of the file. We do not send your account details such as your email address, postal address or phone number.

Who processes the data — Kantesti

Kantesti processes your file on our instructions and only to produce your analysis. Where this involves a transfer of data outside the UK, it is protected by appropriate safeguards under UK GDPR (such as the UK International Data Transfer Agreement or Addendum). You can read how Kantesti handles data in Kantesti's privacy policy.

Lawful basis

We process your data for AI reports on the basis of your explicit consent (UK GDPR Article 6(1)(a) and Article 9(2)(a) for special-category health data). We ask for it on the report screen before your first report, and again whenever what you are agreeing to changes, and we record when you gave it. You can withdraw consent at any time from My AI Reports; withdrawal stops further processing but does not undo processing that already happened.

What we keep and how

We keep the analysis Kantesti returns — your results with their normal ranges and status, the health score, the written interpretation and the risk indicators, together with the name printed on your laboratory report, which appears on your AI report. Before saving it we remove your date of birth and any patient or NHS numbers. The report is stored in our database encrypted at rest (AES-256); only you, through your account, and authorised London Blood Tests staff can read it. Files you upload for a report are deleted from our servers as soon as the analysis has finished, and PDF passwords are never stored.

How long we keep it

We keep your AI wellness reports for as long as your account exists, up to a maximum of 12 months from generation by default. An LBT administrator may configure a shorter or longer retention window from the admin settings; reports older than the configured window are automatically and permanently deleted, including the encrypted payload. The current retention window in force is documented on the "Retention policy" page.

Your specific rights around AI reports

• Delete a single report — open it from My AI Reports and choose Delete. This permanently removes the report from our database; your account and other reports stay untouched.
• Delete all your reports and your account — from My details → Delete account. All AI reports are hard-purged as part of account deletion.
• Export your reports — from My details → Export data. You will receive a decrypted JSON file with the full contents of every AI report we have on file for you, together with your other account data.
• Withdraw your consent — from My AI Reports → Withdraw consent, or by emailing [email protected]. We will not create another report for you unless you agree again. Existing reports remain until you delete them.

Right to human review

AI reports are not automated decisions with legal or significant effects in the sense of UK GDPR Article 22 — they are informational interpretations for you to discuss with a qualified healthcare professional. Even so, if you believe an AI report has caused harm or contains a serious error, contact us at [email protected] and we will review the report and the underlying data with a qualified clinician.

Complaints

If you are unhappy with how we handle your AI report data, you have the right to complain to the UK Information Commissioner's Office at ico.org.uk.

9. Updates to this Policy

We may update this Privacy Policy periodically. The latest version will always be posted on our website.