Your data,
and what we do with it.

Who is responsible for your data

Sero ([registered company name], company number [number], registered at [address]) is the data controller for the personal data described here. We are registered with the Information Commissioner's Office under registration number [ICO number].

You can reach us about anything on this page at privacy@serohealth.co.uk.

What we hold

• Identity and contact details, your name, email address, phone number and delivery address.
• Health information you give us, date of birth, sex, relevant medications, and the answers to the health questions asked at checkout. The reviewing doctor needs these to read a result correctly; a ferritin level means something different depending on whether you are menstruating or taking iron.
• Your results, the marker values returned by the laboratory, and the doctor's review of them.
• Order and payment records, what you bought and when. We never see or store your card details; those go directly to Stripe.
• Basic technical data, the pages you visited and the device you used, so the site keeps working.

Why we are allowed to hold it

For your name, address and order records, our lawful basis is performance of a contract, we cannot post you a kit without them.

Health data and blood results are special category data under Article 9. We rely on Article 9(2)(h), the provision of healthcare and medical diagnosis, together with your explicit consent, given at checkout. You can withdraw that consent at any time, though we cannot un-run a test that has already been analysed.

Who else sees it

• The laboratory, [partner name], a UKAS-accredited laboratory, which analyses your sample.
• The reviewing doctor, a GMC-registered clinician who reads every panel before you do.
• Stripe, payments only. Stripe never receives your health data.
• Our hosting and email providers, as processors bound by contract.

We do not sell your data, ever, to anyone. We do not use your results for advertising or share them with any other business. Nobody in our supplement or coaching businesses can see your blood results.

Where it is stored

Within the UK and the European Economic Area. Data is encrypted in transit and at rest. Access is limited to the people who need it to do the work described above, and every access is logged.

How long we keep it

• Blood results and the clinical review, 8 years. This follows NHS records-retention practice for adult health records, and it exists for your benefit: a result from four years ago is what makes today's result mean something.
• Order and payment records, 7 years, because HMRC requires it.
• Marketing preferences, until you withdraw them.

You can ask us to delete your results before those periods are up and we will, subject to the tax records we are legally required to keep.

Your rights

Under UK GDPR you have the right to access a copy of everything we hold, to have inaccuracies corrected, to have your data deleted, to restrict or object to how we use it, and to receive it in a portable format. Email privacy@serohealth.co.uk and we will respond within one month.

If you are not satisfied with how we have handled something, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would rather you came to us first, but it is your right either way.

Cookies

This site uses no advertising or tracking cookies. We store nothing in your browser beyond what is needed to keep you signed in and to remember your basket.

Changes

If we change anything material on this page we will email everyone whose data we hold rather than quietly updating the date at the top.