Privacy Policy

E&J Bio UK Ltd is the Data Controller responsible for your personal data and sensitive clinical health information. We are registered in England and Wales under Company Number 13825658, and our registered clinic and laboratory premises are located at:

We are registered with the UK Information Commissioner's Office (ICO) under registration number ZB337581. For any queries relating to data protection, privacy rights, or Subject Access Requests, please contact our Data Protection Officer at info@ejbio.co.uk.

As an independent private healthcare and diagnostic testing centre, we collect and process the following categories of information:

• Patient Identification & Contact Details: Given name, surname, title, date of birth, biological sex, residential address, telephone number, and email address.
• Appointment & Transaction Details: Booked appointments, date and time of clinic visits, order number, booked test packages, and transaction status (processed securely through our payment provider; we do not store full payment card details).
• Special Category Health Data: Biological pathology samples (e.g. venous blood, urine, faecal, or swab samples), laboratory diagnostic test measurements, clinical interpretations, relevant medical history, fasting status, and prescribing doctor or GP details (where provided).
• Digital & Technical Information: IP address, device type, browser information, pages viewed, and cookie consent preferences when you navigate our website.

Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, we process your information under the following lawful bases:

• Article 6(1)(b) — Contract: Processing is necessary for the performance of our contract with you, specifically to schedule clinical appointments, collect samples, conduct laboratory testing, and deliver your diagnostic results.
• Article 6(1)(c) — Legal Obligation: Processing is required to comply with statutory healthcare standards, CQC regulatory obligations, and mandatory public health reporting where legally required by UK law.
• Article 6(1)(f) — Legitimate Interests: Processing is necessary for our legitimate interests in operating secure IT systems, managing customer queries, and preventing fraudulent transactions, balanced against your individual privacy rights.
• Article 9(2)(h) — Special Category Health Data: Processing of health and biometric data is lawful because it is strictly necessary for the purposes of medical diagnosis, preventive medicine, and the provision of health or social care and clinical treatment by healthcare professionals bound by professional confidentiality.

We use your personal and medical information exclusively for legitimate clinical and operational purposes:

• To identify and register you as a patient and prepare sample collection materials.
• To perform in-house diagnostic laboratory testing (e.g. HPLC haemoglobinopathy screening, clinical biochemistry, haematology).
• To generate secure, encrypted laboratory reports and deliver them directly to your designated email or patient portal.
• To provide clinical follow-up advice or recommend GP consultation if critical alert thresholds are detected.
• To manage appointment reminders, booking rescheduling, and customer service enquiries.

We do not sell, rent, or trade your personal or health data to any marketing agencies or third parties.

To provide reliable online booking and diagnostic services, we partner with trusted, secure third-party processors who comply with strict data protection standards:

• Square Up (UK) Ltd: Our payment gateway for processing card transactions securely. Square operates under Level 1 PCI-DSS compliance. E&J Bio does not store or process your complete credit or debit card numbers on our servers.
• Google LLC (Google Analytics & Google Ads): We use Google Analytics and Google Ads conversion tracking with Google Consent Mode v2. Analytical and marketing cookies are strictly disabled until you provide affirmative consent via our Cookie Preferences banner.
• WhatsApp (Meta Platforms Ireland Ltd): When you choose to initiate communication with our clinic via our official WhatsApp business number, your message and telephone number are processed by WhatsApp in accordance with their privacy policy.
• UKAS-Accredited Referral Partner Laboratories: Where a requested test is processed externally (referral pathology), samples and required clinical details are transferred securely to accredited NHS or UKAS-accredited (ISO 15189) partner laboratories under formal Data Processing Agreements.

We retain personal and health data only for as long as necessary to fulfil clinical, legal, and regulatory requirements:

• Pathology Results & Clinical Records: Retained for a minimum of 8 years from the date of the last test, in accordance with the Royal College of Pathologists (RCPath) Guidelines and the NHS Records Management Code of Practice. Records for paediatric patients or complex genetic screenings may be retained longer in line with statutory guidance.
• Financial & Invoicing Records: Retained for 6 years in accordance with statutory UK HMRC accounting requirements.
• Pathology Samples: Blood and other biological specimens are retained for a brief verification period (typically 7 to 14 days) to permit repeat verification if required, after which they are safely incinerated or disposed of in accordance with clinical waste regulations.

We maintain robust technical and organisational security measures to protect your data against loss, unauthorised access, alteration, or disclosure:

• All web traffic is encrypted using 256-bit Secure Sockets Layer (SSL) / Transport Layer Security (TLS).
• Diagnostic reports and patient database records are stored in secure, encrypted cloud infrastructure located within the United Kingdom.
• Access to clinical records is restricted strictly to authorised laboratory scientists and registered clinical staff bound by professional codes of confidentiality.

Under the UK GDPR and the Data Protection Act 2018, you possess key rights regarding your personal information:

• Right of Access: You can request a copy of the personal and medical records we hold about you (a Subject Access Request).
• Right to Rectification: You can request correction of any inaccurate or incomplete details.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data. Please note: Regarding clinical diagnostic and pathology records, this right is legally limited by statutory medical record retention requirements under UK healthcare law.
• Right to Restriction of Processing: You can request that we restrict processing of your data under certain circumstances.
• Right to Data Portability: You can request your electronic clinical data in a structured, commonly used format.
• Right to Object: You can object to processing based on legitimate interests.

To exercise any of these rights, please email us at info@ejbio.co.uk. We respond to verified requests within one calendar month, free of charge.

If you have any questions, concerns, or complaints regarding how we handle your personal data, we encourage you to contact us first so we can promptly address the issue:

You also retain the statutory right to lodge a complaint at any time with the UK supervisory authority for data protection: