Privacy Policy

Easy Medical Centre — Easy Testing Ltd

37 High Street, Crewe, Cheshire, CW2 7BL Registered in England and Wales, company number 13209420 ICO registration number: ZB152200

Last updated: 14 September 2026 (version 2.0)

1. About this notice

Easy Testing Ltd, trading as Easy Medical Centre, is the data controller for the personal information described here. We are registered with the Care Quality Commission and with the Information Commissioner's Office under registration number ZB152200.

This notice explains what information we hold about you, why we hold it, who we share it with, how long we keep it, and what rights you have.

Our Data Protection Lead is Rustams Bobonazarovs, Clinic Manager. You can contact him at GDPR@easytests.co.uk, by telephone on 01270 916080, or by writing to the address above.

2. The information we collect

Booking and contact information — your name, date of birth, sex, address, email address and telephone number, and the service you are booking.

Identity information — we check photographic identification before taking a sample for most services. We record that identity was verified and the type of document seen. We do not keep copies of identity documents unless a service requires it (for example legally admissible DNA testing or a chain-of-custody drug test), and we will tell you when it does.

Clinical information — relevant medical history, current medication, symptoms, reason for testing, the samples taken, laboratory results, reports, and any clinical correspondence about your care.

Occupational health information — where your employer has arranged your appointment, the information needed to carry out the assessment and to issue a fitness outcome.

Payment information — the service purchased, the amount and whether it was paid. We do not hold your full card details; card payments are handled by our payment provider.

Correspondence — emails, forms and messages you send us. We may record telephone and video calls for training, quality assurance, complaint investigation, record-keeping and staff safety.

Website information — cookies and similar technologies, described in section 9.

3. Why we use it, and our lawful basis

Data protection law requires us to have a lawful basis for using your information. Because health information is given extra protection, we also need a separate condition under Article 9 of the UK GDPR before we can use it. This section sets out both.

To book and deliver your test, medical or consultation. Our basis is performance of our contract with you. For health information, our condition is Article 9(2)(h) — the provision of health care and treatment and the management of health care services — together with paragraph 2 of Part 1 of Schedule 1 to the Data Protection Act 2018.

To keep clinical records and provide continuity of care. Our basis is our legal obligation to maintain records, and our legitimate interest in running a safe clinic. Our condition for health information is Article 9(2)(h).

To act on abnormal or critical results, including contacting you or a healthcare professional. Our basis is our legal obligation and our legitimate interest in patient safety. Our condition is Article 9(2)(h), and Article 9(2)(c) — protecting vital interests — where we cannot reach you and there is a serious risk to your health.

To meet our duties as a CQC-registered provider and respond to our regulators. Our basis is our legal obligation. Our condition is Article 9(2)(h) and Article 9(2)(i), public interest in the area of public health.

To report notifiable infections to public health authorities where the law requires it. Our basis is our legal obligation, and our condition is Article 9(2)(i).

To take payment and keep accounting and tax records. Our basis is our legal obligation. No health information is used for this purpose.

To investigate complaints, defend claims and arrange insurance. Our basis is our legal obligation and our legitimate interest in protecting our position. Our condition for health information is Article 9(2)(f), the establishment, exercise or defence of legal claims.

To send service messages such as appointment confirmations, preparation instructions and reminders. Our basis is performance of our contract with you.

To send marketing about our services. Our basis is your consent, or our legitimate interest where you are already a customer and have not opted out. We do not use health information for marketing, and you can opt out at any time.

To carry out an occupational health assessment arranged by your employer. Our basis is performance of a contract and our legitimate interests. Our condition for health information is Article 9(2)(h), which covers assessment of working capacity.

To provide legally admissible DNA testing. Our basis is performance of our contract with you. Our condition is your explicit consent under Article 9(2)(a), and Article 9(2)(f) where the result is used in legal proceedings.

Where we rely on your consent, you can withdraw it at any time. Withdrawing consent does not affect anything we did before you withdrew it, and does not require us to delete clinical records we must keep by law.

4. Who we share it with

We share your information only where it is necessary, and only with:

Laboratories that analyse your samples, including Randox and Nationwide Pathology, acting on our instructions
Partner collection clinics in our nationwide network, where you choose to attend one, limited to the information needed to take and label your sample
Clinical software providers used to hold your patient record and to deliver remote consultations
Specialist reporting providers, for example the service that reports your ECG
Pharmacies, where a medicine is prescribed to you
Healthcare professionals you ask us to share with, such as your GP or a consultant
Public health authorities, where a notifiable infection must be reported by law
The DVLA or a licensing authority, where a driver medical requires it
Your employer, for occupational health services, limited to the fitness outcome unless you consent to more
Our payment provider, telephony provider, website platform and IT providers, acting as our processors
Couriers, for kits and samples
Our insurers, legal advisers, regulators and auditors, where required
Courts, police or other authorities, where the law requires or permits it

We do not sell your information, and we do not share health information with advertisers.

Each processor is bound by a written contract meeting the requirements of Article 28 of the UK GDPR.

International transfers. Our laboratories are based in the United Kingdom and your samples and results are analysed here. Some of our software and IT providers may store or process information outside the United Kingdom. Where that happens we rely on UK adequacy regulations, or on the International Data Transfer Agreement or Addendum approved by the Information Commissioner, so that your information keeps the same level of protection it has in the UK. You can ask us which providers this applies to.

5. How long we keep it

We keep information only for as long as we need it:

Adult clinical records — 10 years from the date of the last entry.
Clinical records for a patient under 18 — until the patient's 25th birthday, or their 26th birthday if the last entry was made when they were 17.
Occupational health records — in line with the statutory requirement that applies to the exposure or assessment concerned.
Records relating to a complaint — 10 years from the closure of the complaint.
Accounting and payment records — 6 years plus the current financial year.
Call recordings — 6 months, unless we need to keep one longer for a complaint or a dispute.
Marketing preferences — until you withdraw consent or object.
Website analytics — as set out in our cookie settings.

When a retention period ends, records are securely destroyed or deleted.

6. Identity and the use of a pseudonym

If you would prefer not to use your own name for sexual health screening, you may book under a name of your choosing. We ask for an accurate date of birth and a contact route that reaches you, so that your sample and your result can be matched to you correctly and safely.

We require your correct legal name, and photographic identification, for any service that produces a certificate or a document that someone else will rely on. This includes legally admissible DNA testing, chain-of-custody drug and alcohol testing, driver medicals, occupational health services, immunity and vaccination status testing, and any service where the result is shared with your GP, your employer or another third party.

Where a test is booked under a chosen name, we cannot later issue a certificate in a different name, share the result with a third party, or provide it as evidence of your health or immunity status.

7. Children

Our Crewe clinic accepts patients aged 8 and over. A patient under 16 must be accompanied by a parent or legal guardian, who provides consent and receives the report. We assess the capacity of patients aged 16 and 17 to consent for themselves.

8. Security

We hold your information on systems protected by access controls, encryption in transit and at rest, and monitoring. Staff are trained in information governance and access records only where they need to. We keep a record of processing activities and assess new systems for data protection risk before adopting them.

9. Cookies and website tracking

Our website uses essential cookies to work correctly. It also uses analytics and marketing technologies, including Google tools and Meta tools, which are set only where you give consent through our cookie banner. You can change or withdraw your cookie preferences at any time using the banner. Withdrawing consent does not affect the essential cookies needed for the site to function.

10. Your rights

You have the right to:

be told how we use your information — this notice
ask for a copy of the information we hold about you
have inaccurate information corrected
ask us to delete information, where we are not required to keep it
ask us to restrict how we use it while a concern is resolved
receive information you gave us in a portable format, where our basis is consent or contract
object to processing based on our legitimate interests
object to direct marketing at any time, without giving a reason
withdraw consent where we rely on it

You are not subject to any automated decision-making that produces legal or similarly significant effects.

To exercise any right, contact gdpr@easytests.co.uk. We respond within one month. There is no charge unless a request is manifestly unfounded or excessive.

11. Complaining to the regulator

If you are unhappy with how we have handled your information, please tell us first emailing to complaints@easytests.co.uk, so we can put it right. You also have the right to complain to the Information Commissioner's Office:

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF Helpline 0303 123 1113 · ico.org.uk

12. Changes to this notice

We review this notice at least annually. The version in force is the one published on this page.