About this notice
All Things Blood takes your privacy seriously. This notice explains what personal information we may collect, why we need it, how it is used, who it may be shared with and the rights you have in relation to your information.
This notice applies to information collected through our website, appointment bookings, enquiries and the services we provide.
Who is responsible for your information?
All Things Blood is responsible for personal information collected directly through our website, bookings and services and acts as the data controller for that information.
You can contact us at:
All Things BloodEmail: info@allthingsblood.co.ukTelephone: 07745 761301
ICO registration
All Things Blood is registered with the Information Commissioner’s Office (ICO).
Registration number: 00015568844
Information we may collect
Depending on the service you enquire about or book, we may collect your name and contact details, the address or location for a mobile appointment, appointment and booking information, date of birth or other identifying information where required, details of the blood test or service requested, relevant health information where necessary to safely provide the service, information required to identify and label samples correctly, payment status and transaction references, and communications you send to us.
If an appointment is being arranged for a child, we may also collect information relating to the child and the parent or person with parental responsibility who is arranging or consenting to the appointment.
Our website and service providers may also process limited technical information such as IP addresses, browser/device information, security logs and information needed for the website and booking service to operate securely.
We aim to collect only the information reasonably necessary to provide, administer and safely deliver the service.
Health information
Information about a person’s health is treated as special-category personal information under UK data protection law.
Where health information is required in connection with phlebotomy, blood testing or another healthcare service, it is handled confidentially and only used where there is an appropriate lawful basis and special-category condition for doing so.
Health information is not used for advertising or unrelated marketing.
Why we use your information
We may use personal information to arrange and manage appointments; respond to enquiries and requests for quotes; provide the service requested; identify patients and label blood samples correctly; arrange collection, processing or transport of samples; send samples to the appropriate laboratory; communicate with you about your appointment, sample or results where applicable; process and reconcile payments; deal with cancellations, complaints or queries; protect the security and integrity of our website and services; and meet applicable legal, regulatory, insurance, accounting and record-keeping obligations.
For ordinary personal information, the lawful basis will depend on why the information is being used. This will commonly include processing necessary to provide or arrange a service you have requested, compliance with legal obligations, and legitimate interests such as operating and protecting the business, handling enquiries and resolving complaints.
Where we rely on legitimate interests, we only do so where those interests are not overridden by your rights and interests.
Where special-category health information is processed, an appropriate condition under UK data protection law must also apply, including the health or social care condition where its legal requirements are met. Health information provided in connection with your care is treated as confidential.
Blood test results
Where laboratory testing is arranged through All Things Blood, the sample is analysed by the relevant laboratory and results are produced by that laboratory.
How results are provided will depend on the test and laboratory arrangements concerned. All Things Blood may receive, transmit or communicate information relating to results where this forms part of the service being provided.
Private blood testing provides information about your health but does not replace medical assessment, diagnosis or treatment. Where appropriate, results should be discussed with your GP or another suitably qualified healthcare professional.
Payments
Payments are processed using our payment provider.
All Things Blood does not normally receive or store your full card number, card expiry date or card security code. Those payment details are handled by the payment provider in accordance with its own security and privacy arrangements.
We may retain information such as the amount paid, payment status, transaction reference and information required for accounting, refunds or resolving payment queries.
Who we may share information with
Where necessary to provide or administer your service, information may be shared with organisations such as the laboratory processing your sample; booking and appointment providers such as Acuity Scheduling; payment providers such as Square; email and communications providers; website hosting, security and IT service providers; healthcare professionals or organisations involved in the service where appropriate; and professional advisers, insurers, regulators or public authorities where disclosure is required or permitted by law.
Information is only shared where there is a legitimate reason for doing so.
Personal information is not sold to third parties.
Where one of our service providers processes personal information outside the UK, appropriate data-protection arrangements and safeguards are used where required. You can contact us if you would like further information about relevant international-transfer safeguards.
How long we keep information
We retain personal information only for as long as reasonably necessary for the purpose for which it was collected and to meet applicable legal, regulatory, insurance, accounting and business requirements.
Different information may therefore be retained for different periods.
Booking, payment and correspondence records may need to be retained after an appointment has taken place where they are required for accounting, complaints, insurance or legal purposes. Health-related information is not kept for longer than necessary for the purpose for which it was collected and any applicable healthcare, professional or regulatory requirements.
Information that is no longer required will be securely deleted or anonymised where appropriate.
Keeping your information secure
Reasonable technical and organisational measures are used to protect personal information against accidental loss, unauthorised access, misuse, alteration or disclosure.
Access to personal and health information is limited to those who need it for the relevant service or legitimate business purpose.
Your rights
Depending on the circumstances and the lawful basis being used, UK data protection law may give you rights to ask for access to your personal information; correct inaccurate or incomplete information; request deletion of information in certain circumstances; request restriction of processing; object to certain processing; receive certain information in a portable format; and withdraw consent where processing is based on consent.
Some rights do not apply in every situation, particularly where information must be retained for legal, healthcare or other legitimate reasons.
To exercise a right or ask a question about your information, contact info@allthingsblood.co.uk.
You also have the right to raise a concern with the Information Commissioner’s Office (ICO) if you are unhappy with how your personal information has been handled.
Cookies and website technologies
Our website may use cookies or similar technologies that are necessary for security, booking and normal website operation.
Where technologies requiring consent are used, appropriate information and controls will be provided in accordance with the applicable rules.
Further information is available in our Cookie Notice.