Privacy Policy

Last updated 2 September 2026

This policy explains how BIOCLIN Ltd (“BIOCLIN”, “we”, “us”) collects, uses and protects personal information when you visit bioclin.co.uk, create an account, book a Health MOT, complete our questionnaire, or attend our clinic.

Please read it with our Terms of Service. If you do not agree with this policy, you should not create an account or give us your information.

Who we are

BIOCLIN Ltd is a company incorporated in England and Wales under company number 17320419. Our registered office and clinic is at 59 Greenford Avenue, Hanwell, London W7 1LL. You can confirm our company details on the Companies House register.

We are the controller of personal data processed through this website and our clinic services, except where a laboratory, payment provider, NHS GP or other organisation decides how to use information for its own purposes. In those cases they are an independent controller and their own privacy notice applies.

For privacy questions or to exercise your rights, contact info@bioclin.co.uk or 020 8036 1082.

Who this policy applies to

This policy covers personal information we collect when you:

visit our website as a guest;
create or use a BIOCLIN account;
book, pay for or attend a Health MOT or related assessment;
complete onboarding or a health questionnaire;
contact us by email, phone or through the site;
opt in to marketing, or interact with our Instagram or TikTok pages.

Our services are for people aged 18 and over. We do not knowingly collect data relating to children. If we learn that someone under 18 has created an account, we will close it and delete the information we are not required to keep.

Information we collect

Identity and contact

Name, email address, phone number, date of birth, sex at birth, postal address and login details. Passwords are stored by our authentication provider in hashed form. We do not keep them in readable text.

Health information

Questionnaire answers (including height, weight, smoking, alcohol, medical conditions, medications, family history, exercise, sleep, stress and goals), biomarkers and laboratory results, clinical measurements taken at the clinic, appointment notes, GP Clinical Summaries, Insight Reports, Health Score, Health Age and prevention plans. This is special category data under UK GDPR.

Booking and payment

Products and tests you select, appointment times, promo codes, payment status and billing history. Card payments are processed by Stripe. We do not store full card numbers.

Consents and preferences

Whether you have consented to health-data processing, whether you asked us to share your Clinical Summary with your NHS GP, and whether you opted in to marketing emails.

Technical data

IP address, device and browser type, pages visited and similar information needed to keep the site signed-in, secure and working.

Messages

The content of emails, calls or other messages you send us, and our replies, so we can help you and keep a record of the conversation.

How we collect it

Directly from you — registration, onboarding, booking, checkout, clinic visits and messages to us.
From accredited laboratories that analyse samples taken at our clinic.
From UK-registered GPs who review your results for BIOCLIN.
Automatically when you use the site, including the session cookie that keeps you signed in.
From Stripe when a payment succeeds or fails.

How we use your information

We use personal data to:

create and manage your account and keep it secure;
take payment and issue receipts;
book, change and run clinic appointments;
deliver Health MOTs — sample collection, laboratory analysis, GP review, reports and prevention plans;
track results over time in your dashboard;
send appointment, results and service messages (these are not marketing);
share your Clinical Summary with your NHS GP if you have asked us to;
meet legal, clinical, accounting and safeguarding duties;
send marketing emails only if you opted in — you can unsubscribe at any time;
improve and protect the website (for example detecting abuse or fixing faults).

Lawful bases

Under UK GDPR we need a lawful basis for each use of personal data, and a further condition for health data.

Ordinary personal data

Contract — to create your account, take payment and provide the assessment you booked.
Legitimate interests — to run a secure clinic website, answer enquiries, keep records of our relationship with you, and improve the service, where those interests are not overridden by your rights.
Legal obligation — tax, accounting, health and safety, and responding to regulators or courts.
Consent — optional marketing emails. You can withdraw this without affecting your care or account.

Health data

We process health data because it is necessary to provide preventative healthcare — sample collection, laboratory analysis, clinician review and reporting — under Article 9(2)(h) of the UK GDPR. That processing is carried out by, or under the responsibility of, clinicians bound by professional confidentiality.

We also ask for your explicit consent during onboarding before we process health data for your MOT, report, prevention plan and dashboard. That matches the consent you tick in the app. You can withdraw it by contacting us. If you withdraw it we may not be able to complete an assessment or keep your dashboard, but we may still keep records we are required to retain.

Sharing your Clinical Summary with your NHS GP is optional and based on your separate consent. You can turn this on or off in your profile.

Automated scoring

We use your results to generate reports, Health Score and Health Age. A UK-registered GP reviews every Insight Report before it is released to you. These scores support prevention planning and are not solely automated decisions with legal or similarly significant effects. Draft wording and scores may be prepared with OpenAI acting as a processor under our instructions; we do not use AI chat, voice analysis or similar tools on your data in the patient app.

Who we share data with

We share information only as needed to deliver the service. We do not sell your personal information.

Nationwide Pathology, the accredited laboratory that analyses many of our samples and returns laboratory results. Labs often have their own clinical and legal duties, so they may be an independent controller for that analysis.
Semble, our clinic and appointment system used to manage bookings, clinical workflows and related patient administration.
UK-registered GPs who review results and write your Clinical Summary for BIOCLIN. They are bound by professional confidentiality.
Your NHS GP, only if you have consented to that sharing. Your GP then becomes controller of the copy they receive.
Stripe, to take card payments. Stripe has its own privacy notice.
OpenAI, which may process compacted laboratory and clinical context to draft Insight Report copy for a GP to review. OpenAI acts as a processor under a data processing agreement. Scores remain GP-reviewed before they are released to you.
Firebase / Google Cloud, for authentication, hosting and data storage.
Professional advisers (such as accountants or lawyers) and insurers, where they need the information to advise us.
Regulators, courts, the police or other authorities where the law requires it, or to protect someone’s vital interests.
A buyer or successor if we transfer or merge the business. They would have to use your information as described in this policy.

Suppliers who process data for us as processors may use it only on our instructions and must keep it secure. A formal Data Protection Impact Assessment (DPIA) and processor agreements should be kept under review because we process special-category health information.

International transfers

Some suppliers, including Google (Firebase / Google Cloud) and Stripe, may process information outside the United Kingdom — including in the United States. Where that happens we rely on a UK adequacy regulation or a contract that includes the UK International Data Transfer Agreement or Standard Contractual Clauses, so the information is protected to UK GDPR standards.

How long we keep data

We keep information only as long as we need it for the purpose we collected it, including clinical, legal and accounting duties.

Health and clinical records — eight years after your last appointment or last account activity, in line with usual UK health-records practice, unless the law requires longer.
Account and booking records — while your account is open, then in line with the clinical retention period above.
Payment and tax records — six years after the end of the financial year they relate to.
Marketing preferences — until you unsubscribe or ask us to delete them, and for a short period afterwards so we can honour the opt-out.
Enquiries from people without an account — up to two years after we close the conversation.
Security and session data — the signed-in session cookie lasts about one hour and is refreshed while you use the site. Security logs are kept only as long as needed to investigate incidents.

You can ask us to delete account data we are not required to keep. Closing your account does not always mean we can erase clinical records immediately.

Cookies

We use essential cookies and similar storage to keep you signed in, secure the site and complete checkout. The main cookie is bioclin_session, an HTTP-only cookie that holds your signed-in session for about one hour. Firebase authentication may also store a token in your browser so you stay logged in.

Stripe may set cookies on its own domain when you pay. We do not use advertising or social-media tracking cookies on this site. You can block cookies in your browser, but login, booking and checkout may not work.

Marketing

If you tick the box at registration, we may email you about offers and health-science updates. You can unsubscribe using the link in any marketing email or by contacting us. Opting out of marketing does not stop appointment, results or billing messages.

Social media

We have Instagram and TikTok accounts. If you follow or message those pages, the platform also processes your data under its own privacy notice. We use what you send us to reply to you. We do not run advertising cookies from those platforms on our website.

How we protect your data

We take practical steps to keep personal information secure. In particular:

Data in transit between your browser and our systems is protected using HTTPS/TLS encryption.
Access to accounts and clinical systems is limited to people who need it to do their job, with role-based permissions where available.
Health information is treated as confidential. Our suppliers are required to use appropriate security measures for the services they provide to us.
We use reputable cloud and payment providers (including Firebase / Google Cloud and Stripe) that maintain their own security programmes.

No online service is completely secure, so we cannot guarantee that unauthorised access will never occur. If a breach is likely to result in a high risk to you, we will tell you and, where required, the Information Commissioner’s Office.

Your rights

You can ask us to:

give you a copy of the personal data we hold about you;
correct inaccurate or incomplete data;
erase data in certain circumstances (this may be limited for clinical records);
restrict or object to certain processing;
receive data you gave us in a portable format, where the law allows;
withdraw consent where we rely on it.

To use these rights, email info@bioclin.co.uk with enough information for us to identify you. We may ask for further proof of identity. We do not charge a fee unless a request is clearly unfounded, repetitive or excessive. We aim to reply within one month.

How to complain

Please contact us first so we can try to put things right. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk.

Changes

We may update this policy from time to time. The “Last updated” date at the top of this page will change when we do. If a change is material, we will take reasonable steps to tell you, for example by email or a notice in your account. Please keep the contact details on your account accurate.