Privacy Policy

1. About this Privacy Policy

This Privacy Policy describes how your personal information and data is collected, used, stored, and shared if you attend one of our branches, testing locations or partners’ testing locations, or if you visit or make a purchase from one of our online sites or websites (the “websites”):

www.digistain.co.uk

“We” are Digistain Limited a company registered in England and Wales with company number 12329264 and its registered office situated at Unit 101, Interchange Business Park, Howard Way, Newport Pagnell, England, MK16 9PY, UK. “You” are the customer who has accessed one of our websites, attended one of our branches, testing locations or partners’ testing locations, or intends to place or has placed an order for our products, services and or applications (“Services”).

We respect and are committed to protecting your personal data. Our Privacy Policy, along with our Terms and Conditions, details the way in which we use your personal data, how we collect and look after it, how the data is stored, and your rights concerning the data. The information in this policy covers the websites listed above, in addition to the IT systems that will process your data (including internal and external laboratory systems and referral laboratories) which deal with data.

2. Data Protection Officer Contact Details

Digistain Limited has appointed a Data Protection Officer (“DPO”). If you would like to contact the DPO or the Data Protection Team, please contact the DPO via email using the address: contact@digistain.co.uk Once we have received your request we will respond as soon as possible, and certainly within the regulatory time limit (one month).

3. What is Personal Data?

Personal information or data (“Personal Data”) is defined as ‘any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier’ by the United Kingdom’s  General Data Protection Regulation or “GDPR” (the original EU regulation can be found here EU Regulation 2016/679). We must meet many data protection and privacy law requirements.

In simple terms, personal data is information that can be used to identify you. Personal information can be details such as name or gender, but it also applies to more abstract data, such as IP address and location data.

4. Personal Data we collect about you

For example, we will collect your Personal Data from:  

  • When you reach out to us, either online or via email, mobile, phone or post, or in person and you provide us with your details for a test (e.g. Blood or covid-19 test);
  • Your devices, for example when you visit or use our websites;
  • Cookies we use on our websites to keep them safe or offer you personalised experiences (please see our Cookie Policy); and/or
  • One of our branches, testing locations or partner’s testing locations. 

Different types of tests will need slightly different details or “Order Information”. This is test information related to your order and may be collected on paper forms (such as test request forms), or digitally on a laptop, tablet or mobile telephone. This is usually collected during the ordering process or when you register your details for a particular test, such as filling an online form.

When you visit one of our websites, we automatically collect certain information about your device, including information about your web browser, IP address, time zone, and some of the cookies that are installed on your device. Additionally, as you browse the Website, we collect information about the individual web pages or products that you view, what websites or search terms referred you to the Website, and information about how you interact with the Website. We refer to this automatically collected information as “Device Information”.

We collect Device Information using the following technologies:

  • “Cookies” are data files that are placed on your device or computer and often include an anonymous unique identifier. For more information about the cookies we use and collect please see our Cookie Policy
  • “Log files” track actions occurring on the website, and collect data including your IP address, browser type, Internet service provider, referring/exit pages, and date/time stamps.
  • “Web beacons”, “tags”, and “pixels” are electronic files used to record information about how you browse the websites.

When we talk about Personal Data or information in this Privacy Policy, we are talking both about Device Information and Order Information. Some examples of your Personal Data we may collect is detailed in the table below.

Purpose Type of Personal Data 
Data and information collected to register and take the test(s)Title, Name, date of birth, sex, email address, mobile number, home address 
your customer username or number, password, Sample number, 
Passport number, nationality
Payment method used and payment amount
Any Personal Data you provide us when you contact us. We also record your telephone calls with us.  We collect and store all copies of emails sent. 
  • Medical data that directly relates to the blood, Covid-19 or other biological sample tests.
  • Test method (e.g. PCR, blood film or immunochemistry)
  • Test result (e.g. positive or negative)
  • Genetic data (genetic swabs)
  • Health questionnaires 
  • Pre-existing medical conditions, medications, symptoms and clinical information 
  • Date and time of sample taken 
  • Sample type
  • Result date and time
  • Location
  • Name of referral doctor, GP practice or laboratory
Device Information, which may include: Traffic information, IP address, time of access, date of access, location, web pages visited, device identifiers (as described above).
Website use data. Please see our Cookie policy.
  
Information, Marketing and Advertising PurposesYour marketing preferences and responses to our direct marketing, for example when and if you have open, read and deleted our marketing emails, or if you have clicked on any links in information or marketing emails. 

If you are taking any medications, or have any pre-existing medical conditions or problems, or concerns such as vulnerabilities, you can discuss this during a visit with one of our healthcare assistants (HCA) at our testing locations. The HCA will only use the information you share to provide direct care and will always remain confidential. If the HCA needs your medical consent to care for you, they will get this from you at the time. The HCA may note this on your file and notify the laboratory. A referring doctor, GP or laboratory may also pass this information onto us if necessary and this may be stored on your file.

If you have provided Personal Data on someone else’s behalf, such as a relative or child then this Privacy Policy is relevant to them, and they should be made aware of it.

5. How we use your Personal Data

We will use your Personal Data in the following circumstances: 

  • To allow us to carry out the test(s) and perform a contract we have with you or are about to enter into with you (please see our Terms and Conditions);
  • For our “Legitimate Interest”, but only when your rights and freedoms do not override our legitimate interest. Our legitimate interest is to help us improve our services and products and to obtain feedback from you;
  • To comply with legal and regulatory obligations; and/or
  • Where we have your consent for direct marketing from us or a third party. Please see below.

“Special Category Data” or sensitive data is defined as Personal Data relating to race, ethnic origin or ethnicity, politics, religion, genetics, health, sex life or sexual orientation. It is processed under the following additional legal basis: 

  • To comply with our legal and regulatory obligations; and
  • Where necessary for reasons of public health, such as notifiable diseases, and protecting against general threats to the nation’s health.

The table below outlines the lawful basis on which we rely in order to process your Personal Data.

What we use your information for Legal basis
Confirming the appointment and passing appointment-related information to branches, testing locations or partners’ testing locationsTo perform a contract we have with you or are about to enter with you. 
Performing a security and ID verification at one of our or partners’ testing locationsTo perform a contract we have with you or are about to enter with you. 
Performing your test To perform a contract we have with you or are about to enter with you. 
To process payment for the test To perform a contract we have with you or are about to enter with you. 
Receiving and processing your testTo perform a contract we have with you or are about to enter with you. 
Sharing all results with Public Health England (or relevant local authority) to help plan and respond to Covid-19 or future pandemicsTo comply with our legal and regulatory obligations.  This is necessary for reasons of public health, such as notifiable diseases.
Provide access to Covid-19, blood, genetic or any other biological sample test resultsTo perform a contract we have with you or are about to enter with you. 
Respond to any enquiries from you regarding our serviceTo perform a contract we have with you or are about to enter with you. 
Where we share your personal data and sensitive personal data with regulators and governmental agencies. To comply with our legal obligations. This is necessary for reasons of public health, such as protecting against serious cross-border threats to health.
To provide you with information about products and services which we believe may be of interest to you from us or trusted third parties. Where we have your consent.
To provide you with access to our website(s), online portal and/or our mobile app.To perform a contract we have with you or are about to enter with you. 
To help develop, improve and optimise our websites, products, services, and the way in which we communicate with you, and to carry out internal research and development that allows us to better serve our customers.
  • Legitimate Interest to help understand how we can improve our services. This could be done through third parties such as Google Analytics (see below).
  • To help us screen for potential risk and fraud (in particular, your IP address).
To receive feedback from you to help us improve our product services Legitimate Interest to help understand how we can improve our services.
To provide customer support services To perform a contract we have with you or are about to enter with you.

 Other uses: 

  1. We may also keep and use your Personal Data to comply with our legal and regulatory obligations, resolve disputes, and enforce our agreements.
  2. We may share your Personal Data, medical history and test results with your GP, doctor or the NHS if they have requested or referred a test to us. We will not share your Personal Data, medical history and test results unless explicitly authorised by yourself or your authorised representative. 
  3. We may access, use and preserve your Personal Data to comply with legal and public health authorities, in anticipation of litigation, or to protect our rights or property or those of third parties, even if your Personal Data is subject to a deletion request from you. We may also provide information to law enforcement or authorities to protect the safety of you or other users of our services or the general public.
  4. Sale, acquire, merger, or change of ownership. If we merge with another company, or our equity securities or all or a part of our assets are sold to a third party, your Personal Data may be transferred to the buyer or successor entity. We will notify you and other users of any transfer to a different legal entity.

We use Google Analytics to help us understand how our customers use the websites. You can read more about how Google uses your Personal Information here: https://www.google.com/intl/en/policies/privacy/

You can also opt-out of Google Analytics here: https://tools.google.com/dlpage/gaoptout

6. How we share your Personal Data 

We may share your Personal Data with the following types of companies (Data Controllers or Processors) for the reasons explained in section 5. A Data Controller is a person(s) or company (either alone or jointly or in common with other persons) who decides how Personal Data will be processed. A Data Processor is an external company or other third parties that collects and processes Personal Data on our behalf.

Also, to help us deliver our services and provide the test(s) administration, we may share Personal Data with our medical practitioners who provide you with the results of your test and analyse data from our laboratory or referral laboratories. They will be under a duty of confidentiality and will handle your data securely. 

Companies (Data Processors) with whom we will share your Personal Data include:

  1. Third party testing locations or partners’ testing locations
  2. Our referral and partner laboratories, who include and may not be limited to: note
  3. IT service providers, Laboratory Information Management System (LIMS) providers, data disposal service providers and data storage service providers.

If we share your Personal Data with our Data Processors, we will have contracts with them to make sure they keep your data safe in line with Data Protection Law and this Privacy Notice.  

Companies (Data Controllers) with whom we will share your Personal Data include: 

  1. Our payment service providers.
  2. Other third parties outside Digistain to offer you services or products, where we have your consent.
  3. Public Health England (PHE). Covid-19, the disease caused by infection with SARS-CoV-2, is classified as a notifiable disease by the United Kingdom government. Therefore, our laboratory and our referral laboratories providers have a legal obligation to report all Covid-19 results (positive, negative and unclear) and associated patient data to PHE. Your data will be transferred to PHE using only the methods approved by the standard reporting protocols. Further details and information about notifiable diseases and reporting to Public Health England is available here. Further details on how Public Health England uses, discloses and processes all personal data we share with them can be found in its privacy notice here.
  4. We may share your Personal Data with courts, law enforcement, governmental authorities and other third parties if required by law, subpoena, a directive from a regulatory authority or as otherwise necessary to comply with legal requirements or to protect our rights or property or those of third parties. 

Where we share your Personal Data with a Data Controller, we comply with Data Protection Laws. As Controllers, they will also have their obligations under data protection law must meet. 

If we have links to other sites promoting our partners and clients, please read their Privacy Policies or Notices on their website to see how they use your Personal Data. Our Privacy Policy will not cover their use of your Personal Data by these third parties. 

7. Marketing and your Personal Data 

We do not sell your personal information. If you consent to receive marketing from Digistain or on any of our websites, we may send you relevant healthcare information or information about our products and services that may be of interest to you. 

With your consent, we may share your information with selected third parties and partners outside DigiStain for marketing purposes. They will handle your Personal Data, and any opt-outs as set out in their Privacy Notice on their website. 

With your consent, we may send you updates and news about products and services on behalf of trusted third parties. When marketing on behalf of third parties all communications will come from us and we will not share your details with these carefully selected third parties for marketing purposes.

Opting out of Marketing   

Where you consent to receive communication for marketing purposes, you have the right to opt-out.  You can opt-out of receiving marketing communication from us at any time by following the opt-out links or options in any marketing messages sent to you or by contacting us any time at contact@digistain.co.uk

If you opt-out of marketing, you will stop receiving marketing from us within 5 working days. Please note, this does not apply to service communication, market research or customer surveys or any other processing outside marketing. 

Where you consent to receive marketing from our selected partners or third parties, we do not control the use of your Personal Data by these partners or third parties. You should contact them directly to opt-out of receiving their marketing communications.

8. International Transfer of your Personal Data

We may send your data to countries outside the UK, where different data protection laws may apply.  These transfers will only happen when:

  • we use service provider companies outside the UK; 
  • there is a legal or regulatory obligation; or 
  • we have your consent. 

Where we transfer your data to a service provider company outside the UK, we will implement safeguards so that your data continues to be protected. We protect your data by making sure:

  • the country has adequacy protection approved by the UK; or
  • we conduct a security and data protection transfer assessment and implement measures and put an appropriate contract in place with approved UK standard contractual clauses between the recipient entity and us. 

9. Retention of your Personal Data 

We will not keep your data for longer than we need to and will only use your data for the purposes outlined in this Privacy Policy. We aim to be paper light and aim to digitally store all paper documents such as test request forms. These are then stored in your medical record or file. Paper documents are securely stored for up to 1 (one) month and then destroyed by confidential paper disposal companies.

We may keep your data if we have a legal obligation to do so or to establish, exercise or defend a legal claim. In most circumstances, this means we will not keep your data for more than 8 (eight) years after the end of your relationship with us. According to the NHS Records Management Code of Practice we are required to hold all Covid-19 records until necessary, which is currently indefinitely. Please note that laboratory results and records will be kept indefinitely on our secured systems, or kept until no longer required.

Subject to the below, in some cases biological samples may be stored by our laboratory for up to 4 (four) weeks after the initial analysis has been carried out to give you the opportunity to order further tests or to repeat the analysis at an additional cost (‘Storage Period’). Samples will be destroyed once the Storage Period has expired. We may also be requested by regulatory authorities (such as Public Health England) to store samples for longer or even send samples to referral laboratories for additional analysis, for example for the sequencing of Covid-19 genomes. In which case we will follow all legal and regulatory requirements.

10. Security of your Personal Data 

We will make every effort to use appropriate technical, organisational and administrative security measures to protect any information we hold in our records from loss, misuse, and unauthorised access, disclosure, alteration and destruction. We have written procedures and policies documenting these measures and our operations.

11. What are your rights?

The information below gives you more information on the rights that you have regarding your data. All requests can be made in writing by emailing contact@digistain.co.uk

  • The right to know about how we gather/use/store your data. This privacy policy offers this information, but please contact us if there is anything else that you would like to know.
  • The right to obtain access to the data that we hold in relation to you. You can request this data using the email address above unless legal exceptions apply.
  • The right to data rectification or completion if it is incomplete. If you wish to correct personal data, you can request rectification or completion using the email address above.
  • The right to erasure (to be forgotten). You have the right to have any personal data permanently removed. This is not an absolute right and only applies in certain circumstances, for example, we cannot delete information if there is a legal or regulatory obligation on us to keep it.
  • The right to restrict the use and processing of your data. You have the right to object to the processing of your Personal Data in certain situations. You have an absolute right to stop your Personal Data being used for direct marketing.
  • The right to data portability, which can be achieved in the form of a data request. This right can only be used where the processing relies on your consent or contract. 
  • Rights in relation to automated decision making and profiling. We do not engage in profiling, or any processing related to automated decision-making activity.
  • The right to withdraw consent at any time (where relevant). If you withdraw your consent, this will not affect the lawfulness of how we used your personal data before you withdrew consent, and we will let you know of any consequences of the withdrawal of consent, for example if we can no longer provide you with your chosen service.
  • The right to complain to the Information Commissioner.

More detailed information on your rights and privacy laws can be found at the ICO website. If you have an issue or complaint, you can contact us or lodge a complaint with the ICO.

If you make a request, where required, we will confirm your identity and ask you for more information to help us with your request.

We will keep a copy of your request. Further, we may charge a reasonable fee or refuse to act on your request if such a request is excessive, repetitive or manifestly unfounded. 

We have 1 (one) month from receiving your request (provided we have verified your identity and have enough information to locate your data) to respond. 

12. Changes in the Privacy Policy

We keep our Privacy Policy under regular review and may update this privacy policy from time to time in order to reflect, for example, changes to our practices or for other operational, legal or regulatory reasons. Any changes will be made available on our websites.

13. Contact us or to make a complaint

For more information about our privacy practices, if you have questions, or if you would like to exercise one of your rights, or make a complaint related to your privacy or this Privacy Policy, please contact us by e‑mail at contact@digistain.co.uk or by post using the details provided below:

DPO, Digistain Limited , Unit 101, Interchange Business Park, Howard Way, Newport Pagnell, England, MK16 9PY, UK