Privacy Policy

Last updated 9 November 2026

This policy explains how BIOCLIN Ltd (“BIOCLIN”, “we”, “us”) collects, uses and protects personal information when you visit bioclin.co.uk, create an account, book a blood test, complete our questionnaire, or attend our clinic.

Please read it with our Terms of Service. If you do not agree with this policy, you should not create an account or give us your information.

Who we are

BIOCLIN Ltd is a company incorporated in England and Wales under company number 17320419. Our registered office and clinic is at 59 Greenford Avenue, Hanwell, London W7 1LL. You can confirm our company details on the Companies House register.

We are the controller of personal data processed through this website and our clinic services, except where a laboratory, payment provider, NHS GP or other organisation decides how to use information for its own purposes. In those cases they are an independent controller and their own privacy notice applies.

For privacy questions or to exercise your rights, contact info@bioclin.co.uk or 020 8036 1082.

Who this policy applies to

This policy covers personal information we collect when you:

visit our website as a guest;
create or use a BIOCLIN account;
book, pay for or attend a blood test, including the Health MOT checks at the clinic;
complete onboarding or a health questionnaire;
contact us by email, phone or through the site;
opt in to marketing, or interact with our Instagram or TikTok pages.

Our services are for people aged 18 and over. We do not knowingly collect data relating to children. If we learn that someone under 18 has created an account, we will close it and delete the information we are not required to keep.

Information we collect

Identity and contact

Name, email address, phone number, date of birth, sex at birth, postal address and login details. Passwords are stored by our authentication provider in hashed form. We do not keep them in readable text.

Health information

Questionnaire answers (including height, weight, smoking, alcohol, medical conditions, medications, family history, exercise, sleep, stress and goals), biomarkers and laboratory results, clinical measurements taken at the clinic, appointment notes, Clinical Summaries, Insight Reports, Health Score, Health Age and prevention plans. This is special category data under UK GDPR.

Booking and payment

Products and tests you select, appointment times, promo codes, payment status and billing history. We do not store full card numbers.

Consents and preferences

Whether you have consented to health-data processing, whether you asked us to share your Clinical Summary with your NHS GP, and whether you opted in to marketing emails.

Technical data

IP address, device and browser type, pages visited and similar information needed to keep the site signed-in, secure and working.

Messages

The content of emails, calls or other messages you send us, and our replies, so we can help you and keep a record of the conversation.

How we collect it

Directly from you — registration, onboarding, booking, checkout, clinic visits and messages to us.
From accredited laboratories that analyse samples taken at our clinic.
From clinicians who review your results for BIOCLIN.
Automatically when you use the site, including the session cookie that keeps you signed in.
When a payment succeeds or fails.

How we use your information

We use personal data to:

create and manage your account and keep it secure;
take payment and issue receipts;
book, change and run clinic appointments;
deliver blood tests and the Health MOT checks — sample collection, laboratory analysis, clinician review, reports and prevention plans;
track results over time in your dashboard;
send appointment, results and service messages (these are not marketing);
share your Clinical Summary with your NHS GP if you have asked us to;
meet legal, clinical, accounting and safeguarding duties;
send marketing emails only if you opted in — you can unsubscribe at any time;
improve and protect the website (for example detecting abuse or fixing faults).

Lawful bases

Under UK GDPR we need a lawful basis for each use of personal data, and a further condition for health data.

Ordinary personal data

Contract — to create your account, take payment and provide the assessment you booked.
Legitimate interests — to run a secure clinic website, answer enquiries, keep records of our relationship with you, and improve the service, where those interests are not overridden by your rights.
Legal obligation — tax, accounting, health and safety, and responding to regulators or courts.
Consent — optional marketing emails. You can withdraw this without affecting your care or account.

Health data

We process health data because it is necessary to provide preventative healthcare — sample collection, laboratory analysis, clinician review and reporting — under Article 9(2)(h) of the UK GDPR. That processing is carried out by, or under the responsibility of, clinicians bound by professional confidentiality.

We also ask for your explicit consent during onboarding before we process health data for your MOT, report, prevention plan and dashboard. That matches the consent you tick in the app. You can withdraw it by contacting us. If you withdraw it we may not be able to complete an assessment or keep your dashboard, but we may still keep records we are required to retain.

Sharing your Clinical Summary with your NHS GP is optional and based on your separate consent. You can turn this on or off in your profile.

Automated scoring

We use your results to generate reports, Health Score and Health Age. A clinician reviews every Insight Report before it is released to you. These scores support prevention planning and are not solely automated decisions with legal or similarly significant effects. We do not use AI chat, voice analysis or similar tools on your data in the patient app.

Who we share data with

We share information only as needed to deliver the service. We do not sell your personal information.

Clinicians who review results and write your Clinical Summary for BIOCLIN. They are bound by professional confidentiality.
Your NHS GP, only if you have consented to that sharing. Your GP then becomes controller of the copy they receive.
Professional advisers and insurers, where they need the information to advise us.
Regulators, courts, the police or other authorities where the law requires it, or to protect someone’s vital interests.
A buyer or successor if we transfer or merge the business. They would have to use your information as described in this policy.

Suppliers who process data for us as processors may use it only on our instructions and must keep it secure. A formal Data Protection Impact Assessment (DPIA) and processor agreements should be kept under review because we process special-category health information.

International transfers

Some suppliers may process information outside the United Kingdom, including in the United States. Where that happens we rely on a UK adequacy regulation or a contract that includes the UK International Data Transfer Agreement or Standard Contractual Clauses, so the information is protected to UK GDPR standards.

How long we keep data

We keep information only as long as we need it for the purpose we collected it, including clinical, legal and accounting duties.

Health and clinical records — eight years after your last appointment or last account activity, in line with usual UK health-records practice, unless the law requires longer.
Account and booking records — while your account is open, then in line with the clinical retention period above.
Payment and tax records — six years after the end of the financial year they relate to.
Marketing preferences — until you unsubscribe or ask us to delete them, and for a short period afterwards so we can honour the opt-out.
Enquiries from people without an account — up to two years after we close the conversation.
Security and session data — the signed-in session ends after 5 minutes without activity. While the account is in use, the session cookie is refreshed and lasts up to about one hour. Security logs are kept only as long as needed to investigate incidents.

You can ask us to delete account data we are not required to keep. Closing your account does not always mean we can erase clinical records immediately.

Cookies

We use essential cookies and similar storage to keep you signed in, secure the site and complete checkout. The main cookie is bioclin_session, an HTTP-only cookie that holds your signed-in session. It ends after 5 minutes without activity, and while you are using the site it is refreshed for up to about one hour. Other sign-in storage in your browser ends with the same inactivity timeout.

Marketing pages may record the page address and referring site. That is not loaded in the signed-in area, booking or checkout. We do not use advertising cookies on this site. You can block cookies in your browser, but login, booking and checkout may not work.

Marketing

If you tick the box at registration, we may email you about offers and health-science updates. You can unsubscribe using the link in any marketing email or by contacting us. Opting out of marketing does not stop appointment, results or billing messages.

Social media

We have Instagram and TikTok accounts. If you follow or message those pages, the platform also processes your data under its own privacy notice. We use what you send us to reply to you. We do not run advertising cookies from those platforms on our website.

How we protect your data

We take practical steps to keep personal information secure. In particular:

Data in transit between your browser and our systems is protected using HTTPS/TLS encryption.
Access to accounts and clinical systems is limited to people who need it to do their job, with role-based permissions where available.
Health information is treated as confidential. Suppliers are required to keep it secure.

No online service is completely secure, so we cannot guarantee that unauthorised access will never occur. If a breach is likely to result in a high risk to you, we will tell you and, where required, the Information Commissioner’s Office.

Your rights

You can ask us to:

give you a copy of the personal data we hold about you;
correct inaccurate or incomplete data;
erase data in certain circumstances (this may be limited for clinical records);
restrict or object to certain processing;
receive data you gave us in a portable format, where the law allows;
withdraw consent where we rely on it.

To use these rights, email info@bioclin.co.uk with enough information for us to identify you. We may ask for further proof of identity. We do not charge a fee unless a request is clearly unfounded, repetitive or excessive. We aim to reply within one month.

Blood tests, offers and notifications

Booking a blood test, which includes the Health MOT at the clinic, uses your contact and health information to deliver that service. A free consultation and a clinic blood-pressure check, when they are open, are separate appointments. Asking to be told when a Coming Soon treatment is available is not clinical consent and is not a booking. Partner enquiries must not include patient information. Clinical consent, processing choices and marketing consent are kept separate.

How to complain

Please contact us first so we can try to put things right. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk.

Changes

We may update this policy from time to time. The “Last updated” date at the top of this page will change when we do. If a change is material, we will take reasonable steps to tell you, for example by email or a notice in your account. Please keep the contact details on your account accurate.