Privacy Policy
This policy explains what information we collect, why we collect it, and how we keep it safe. We have written it in plain English wherever possible.
Who we are
Rempath Medical Limited is the data controller for the personal information we hold about you. The responsible director is Emmett Reidy. We are registered with the Information Commissioner's Office (ICO), registration number [ICO REG NUMBER].
The lawful basis for processing
We process your personal information to fulfil our contract with you — for example, to send your test kit and deliver your results (Article 6(1)(b) UK GDPR).
Your blood test results are health data, which receives special protection under data protection law. We process this only with your explicit consent (Article 9(2)(a) UK GDPR), which you give when you register and activate a kit.
What we collect
- Your name, email address, date of birth and sex
- Your delivery address (stored encrypted)
- Your blood test results and related clinical information
- Payment information, processed by Shopify — we never see your full card details
Why we use your information
- To fulfil your test kit order, via our fulfilment partner Box Smart Cubed
- To analyse your sample, via our laboratory partner Alderley Lighthouse Labs
- To deliver your clinician-reviewed results through your secure patient portal
- To send you essential emails about your order and results, via Resend
How long we keep your information
Patient records are kept for 7 years from your last order, in line with clinical record retention expectations. After a period of inactivity, your account is anonymised — the clinical record remains, but it can no longer be linked back to you.
Your rights
You have the right to:
- Access a copy of your data
- Have inaccurate data corrected
- Have your data erased
- Restrict how we process your data
- Receive your data in a portable format
- Object to processing
You can exercise any of these rights using our data rights request form. We will respond within 30 days.
Who processes your data
We work with a small number of carefully selected processors:
- Box Smart Cubed — kit fulfilment and dispatch
- Alderley Lighthouse Labs — laboratory analysis
- Supabase — database hosting (EU West 2, London)
- Resend — email delivery
- Shopify — e-commerce and payments
- Cloudflare — website hosting
International transfers
We do not transfer your personal data outside the UK or the European Economic Area. All of our processors operate within the UK or EEA.
Questions and complaints
If you have any questions about how we handle your data, contact us at privacy@rempathmedical.co.uk.
You also have the right to complain to the Information Commissioner's Office at ico.org.uk.