Privacy Policy

Last updated: 24 September 2026

1. Who we are

N1 Health Group Ltd (“N1 Health”, “we”) is the data controller for the personal data described in this policy.

Company number: 17398954
Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ
ICO registration number: ZC223987
Data protection contact: contact@n1health.co.uk — this reaches the Director

We are not required to appoint a statutory Data Protection Officer at our current scale, but we have named a single accountable person above.

2. Our privacy commitments in short

• We collect the minimum we need to arrange your test and get your results to you.
• We do not sell your data. Ever.
• We do not use your health data for marketing.
• Your results are sent to you password-protected.
• We will never share your results with an employer, insurer, or anyone else without your explicit instruction, unless the law requires it.

3. What we collect

Identity and contact: name, date of birth, sex at birth (required by the laboratory for reference ranges), email, mobile number, postal address.

Order data: what you ordered, when, order reference, and which collection option you chose.

Health data (special category): your test results and any clinical information you provide to us or the laboratory. This is the most sensitive data we hold and it is treated accordingly.

Payment data: handled entirely by our payment provider. We never see or store your card number.

Communications: emails and messages between us, and our notes of them.

Technical: IP address, device and browser information, and how you use our site. See our Cookie Policy.

We collect your date of birth and sex at birth in your basket, before checkout, and your name, email, mobile number and address at checkout. The laboratory requires verified identifiers to match a sample to a person, and a clinic booking cannot be made without them. You also confirm in your basket that you are 18 or over, and you agree to the commercial terms that apply to what you have chosen — how replacements work if your sample cannot be tested, and the cancellation terms for a clinic appointment or a nurse home visit.

We ask for sex at birth because laboratory reference ranges differ. This is not a question about your gender identity, and we do not record gender identity.

4. Why we process it, and our lawful basis

What Article 9(2)(h) means, in plain terms. Health data is protected data, and the law sets out a short list of situations in which it may be handled at all. We rely on the one written for medical testing: processing that is necessary for medical diagnosis and for the provision of health care. That condition carries a safeguard — the data must be handled by, or under the responsibility of, someone bound by a professional duty of confidentiality. Our Director is a pharmacist registered with the General Pharmaceutical Council, which is one of the professions named for this purpose in section 204 of the Data Protection Act 2018.

Two consequences worth stating plainly. You do not have to consent to us handling your results, because consent is not the basis we rely on; handling them is simply part of providing the test you bought. And because that basis applies, the right to erasure is limited for your results. Section 9 explains this.

Where we rely on legitimate interests, we have assessed that our interest in operating a safe service does not override your rights. You can ask for that assessment.

Where we rely on consent — for marketing, for analytics cookies, and for optional research — you may withdraw it at any time. See section 9. Withdrawal does not undo processing already carried out, and does not remove records we must keep by law.

5. Research use — entirely optional

5.1 We would like, in future, to analyse anonymised results to understand patterns and develop better reference ranges — particularly for populations that standard ranges describe poorly.

5.2 This only happens if you tick a separate, optional box. It is not part of buying a test, and declining changes nothing about the service you receive.

5.3 If you consent, data used for research is stripped of your name, contact details, and address.

5.4 You can withdraw research consent at any time by emailing us, and we will remove your data from any dataset not already irreversibly anonymised.

6. Who we share it with

Inuvi Diagnostics Limited — our laboratory (UKAS Medical Laboratory 10641). They receive your name, date of birth, sex at birth, address, and the tests requested, and they process your sample. They act as our processor, and separately as a controller for their own regulatory and accreditation obligations, including retention required by UKAS and the Royal College of Pathologists.

Two of our four collection options are operated by the laboratory itself. If you book a nurse home visit, their phlebotomy service also receives your full address, telephone number and appointment details in order to attend. If you use their London walk-in centre, no kit is posted to you at all: the laboratory contacts you directly to confirm, you attend in person with photographic identification, their own clinical team takes your sample, and it goes to the laboratory by their internal courier. They therefore also hold a record of your attendance and identity check.

Clinic appointment providers — only where you purchase a clinic appointment through us. They receive your name, telephone number, date of birth, sex at birth and full address including postcode, together with your appointment details. That is the minimum they need to register you and carry out the appointment. They do not receive your results. The provider operates its own clinical records and is an independent controller of the data it holds about your appointment; it is not our processor, and its own privacy notice applies to that record. We do not name the provider here because the network we use may change; if you want to know who will hold your appointment record before you order, email us and we will tell you.

If you choose a finger-prick collection or arrange your own blood draw, no third-party collection provider receives anything from us at all.

Shopify — our website and checkout platform, and our payment processor. As payment processor they receive your payment details directly and act as an independent controller for that purpose.

Google (Workspace) — our email and document storage, including the results archive.

Our accountant and professional advisers — order and financial records, never results.

Regulators, law enforcement, or courts — only where legally required.

Google (Analytics) — site analytics, used with your consent. It receives the pages you visit and the products you buy, with a randomly generated identifier, your approximate location and your device information. It never receives your results, your name, your date of birth or your contact details, and we do not use it to build advertising audiences.

We do not share your data with employers, insurers, or data brokers, and your test results are never sent to any marketing or analytics tool.

Every processor is bound by a written contract requiring appropriate security and prohibiting any use of your data for their own purposes.

7. Transfers outside the UK

Some of our providers process data outside the UK. Where they do, transfers are protected by UK adequacy regulations or the International Data Transfer Agreement or Addendum.

Our laboratory’s terms permit transfers outside the UK where a specialist assay has to be referred to another laboratory. No test currently on our menu is referred anywhere — every profile, panel and add-on marker we sell is run in-house at the laboratory named above, and several tests were deliberately left off our menu precisely because they would have to be referred out. This clause therefore does not apply to anything you can buy from us today. If that ever changes for a particular test, it will be stated on that product’s page before you buy.

8. How long we keep it

Our laboratory retains records under its own accreditation obligations, which we do not control. A clinic appointment provider likewise keeps its own record of your appointment under its own retention rules. We cannot promise that deletion by us deletes everything everywhere.

At the end of a retention period we securely delete or irreversibly anonymise.

9. Your rights

You have the right to:

• Access a copy of your data
• Rectify inaccurate data
• Erase data, subject to the limit explained below
• Restrict processing while a dispute is resolved
• Portability — receive your data in a machine-readable format
• Object to processing based on legitimate interests
• Withdraw consent at any time, where consent is what we rely on — marketing, analytics cookies, and optional research
• Complain to us about how we have handled your data, under section 164A of the Data Protection Act 2018
• Not be subject to automated decision-making — we do not carry out any

Asking for a copy of your data. Email contact@n1health.co.uk. There is no charge. We respond within 1 calendar month, extendable by 2 further months where a request is complex or where you have made several at once — we will tell you within the first month if that applies. Where we reasonably need to confirm who you are, or to ask what exactly you want, the clock pauses until you reply. We search for your data to the extent that is reasonable and proportionate. A request may be refused, or a reasonable fee charged, only where it is manifestly unfounded or excessive.

What you would receive is more than your results. It is everything we hold that identifies you — your order history, the emails between us and our notes of them, any entry about you in our critical results register, and our correspondence with the laboratory about your order — as well as the reports themselves.

We may ask you to verify your identity, especially for health data, where releasing to the wrong person would be a serious breach.

An important limit on erasure. Because we handle your results under Article 9(2)(h), the right to erasure does not apply to them in the way it applies to ordinary personal data. In practice this means we may decline to delete a result where we still need it — to answer a query, to defend a potential claim, or because the law or our retention schedule requires it. We will always consider a request, we will always tell you our reasons if we say no, and we will delete at the end of the retention period in any event. This limit applies to the results only. Your contact details, marketing preferences and correspondence are ordinary personal data and the usual erasure right applies to them.

10. Security

• Encryption in transit and at rest
• Results issued as password-protected PDFs, with a password unique to you
• Multi-factor authentication on every system holding personal data
• Access restricted to those who need it
• Devices encrypted, password-protected and kept up to date
• No health data on unmanaged devices or personal accounts
• Regular backups, tested for restoration
• A documented breach response plan

Our laboratory holds ISO 27001 certification and Cyber Essentials Plus.

No system is perfectly secure. Email in particular carries inherent risk, which is why results are password-protected. If you would prefer another delivery method, tell us and we will do what we reasonably can.

11. Children

Our service is for adults aged 18 and over only. We do not knowingly collect data about anyone under 18. If we discover we have, we delete it promptly. If you believe a minor has used our service, tell us at contact@n1health.co.uk.

12. Marketing

12.1 We will only send marketing emails if you have opted in, or if you bought from us and we are offering similar services (the “soft opt-in”).

12.2 Marketing never uses your health data. We will not send you offers based on your results, your markers, or anything a test revealed. This is a deliberate choice, not merely a legal minimum.

12.3 Unsubscribe using the link in any email, or email us.

13. Cookies

See our Cookie Policy. Non-essential cookies are only set with your consent, and you can change that at any time using the Cookie preferences link in our footer.

14. Complaints

You have a right to complain to us directly about how we have handled your personal data, under section 164A of the Data Protection Act 2018. Use our contact form, email contact@n1health.co.uk, or write to the registered office above. We aim to acknowledge it within 5 working days, and will in any event respond within the 30 days the law allows, investigate without undue delay, and give you our decision in writing. Our Complaints Policy sets out the full procedure.

You can also complain to the Information Commissioner’s Office at any time, whether or not you come to us first: ico.org.uk/make-a-complaint · 0303 123 1113 · Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

15. Changes

We will post any changes here and update the date above. For significant changes affecting how we use your data, we will email you.

N1 Health Group Ltd is a company registered in England and Wales. Company number 17398954. Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ. ICO registration ZC223987.