Privacy policy

Version

2.0

Last updated

31 August 2026

Owner

Data Protection Lead

Who we are

Trident Labs Ltd is the data controller for the personal data described here. Our registered office is 159 Maidstone Road, Felixstowe, Suffolk.

We are registered with the Information Commissioner's Office under ZB589104.

What we collect

• Identity and contact — name, email address, delivery address, and phone number if you give one.
• Order data — what you bought, when, order value, delivery status, and the payment reference you quote on your bank transfer.
• Sample and result data — the collection date you record, the laboratory's measured values, and the report generated from them.
• Correspondence — messages you send us and our replies.
• Technical data — IP address, device and browser information, and pages visited.

We do not receive or store your bank account details. Payments arrive as bank transfers; what we see is what your bank shows on the transaction, which we use only to match a payment to an order and to issue any refund.

Health data

Blood test results are “data concerning health” under Article 9 UK GDPR — a special category needing an additional lawful basis beyond the ordinary one.

Our additional basis is your explicit consent, given when you register a kit and submit a sample. You can withdraw it at any time, which stops further processing; it does not undo processing already carried out, and it does not erase records we must keep for the laboratory's own regulatory obligations.

We do not use health data for marketing. We do not profile you on the basis of your results, and we do not sell data to anyone under any circumstances.

Why we process it

Who we share it with

• The analysing laboratory — receives the minimum needed to process your sample and report a result. It is an accredited medical laboratory with its own regulatory duties.
• Delivery partners — name and address only. They are not told what is in the parcel.
• Our bank — necessarily processes the transfer you send and any refund we send back.
• Technology suppliers — hosting, email delivery and database providers acting as processors under contract.
• Professional advisers and regulators — where we are required to disclose.

We do not share health data with insurers, employers, advertisers or data brokers. We never will.

How long we keep it

• Order and financial records — six years after the end of the relevant tax year, as tax law requires.
• Results — kept in your account so you can track markers over time, and deleted on request except where the laboratory must retain its own record.
• Correspondence — two years.
• Marketing consent records — until you withdraw consent, plus a minimal record of the withdrawal so we can honour it.

Security

Data is encrypted in transit and at rest. Access is limited to staff who need it, and access to results is logged. Suppliers are contracted as processors and cannot use your data for their own purposes.

Where a breach is likely to result in a risk to your rights, we will report it to the ICO within 72 hours and tell you directly where the risk is high.

Your rights

Under UK GDPR you have the right to:

• be told what we hold about you, and get a copy;
• have inaccurate data corrected;
• have data erased, where no legal obligation requires us to keep it;
• restrict or object to processing;
• receive your data in a portable format;
• withdraw consent at any time; and
• not be subject to solely automated decisions with legal or similar effects.

We respond within one month. There is no charge unless a request is manifestly unfounded or excessive.

Cookies

We use cookies and local storage that are strictly necessary — remembering the contents of your basket, and keeping you signed in. These do not require consent under the Privacy and Electronic Communications Regulations.

Your basket is stored in your own browser, not on our servers, until you place an order.

Analytics

We do not use advertising cookies, and we do not share anything with advertising networks. We do use a single analytics tool to count how the site is used — which pages and products are viewed, and what people search for — but only if you tell us we may.

We ask because of what we sell. Knowing that a browser looked at a hormone or menopause panel says something about a person's health, and under the UK GDPR that needs your explicit permission rather than an assumption on our part. Nothing is recorded until you answer, declining costs you no functionality, and you can change your mind at any time below.

What is never sent: your name, email address, postal address or phone number. Orders are counted using the order number shown on your confirmation, not your identity. If you type something into the search box that looks like an email address, phone number or postcode, it is removed before the search is counted.

Your answer is stored in your own browser, not on our servers, so clearing your browser data will mean we ask again.

Loading your current choice…

If we ever want to use analytics for anything beyond counting usage, or add advertising cookies, we will ask you again and update this policy before doing so.

Contact and complaints

For any data protection request, email info@tridentlabs.uk. Please say what you are asking for so we can deal with it properly.

If you are unhappy with our response you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. You may complain to the ICO without contacting us first, though we would rather have the chance to put things right — see our complaints procedure.