Privacy policy

Your Baby Scan Ltd is the data controller for the personal data described in this policy. Cheshire Bloods Clinic is a trading name of Your Baby Scan Ltd, a company registered in England and Wales under company number 09446510, with its registered office at 84 Victoria Rd, Widnes, Cheshire, WA8 7RA.

Our clinics are at 84 Victoria Rd, Widnes, WA8 7RA and 73-75 Nantwich Rd, Crewe, CW2 6AW. You can contact us about anything in this policy on 0330 088 4438 or at hello@cheshirebloodsclinic.co.uk.

We are registered with the Information Commissioner's Office (ICO) as a data controller. We have not appointed a statutory Data Protection Officer, as we are not required to do so; our data protection enquiries are handled by the company directors.

This policy explains what personal data we collect, why we use it, who we share it with, how long we keep it, and the rights you have under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Depending on how you use our service, we collect the following categories of personal data:

• Identity and contact data — your name, date of birth, email address, telephone number and postal address. Where you book on behalf of someone else (for example a child or partner), we also collect that person's name and date of birth.
• Appointment data — the test you booked, the clinic and time, your booking reference, any request form you upload, and the notes our phlebotomist records at your appointment.
• Health data — clinical information you give us (such as the date of your last menstrual period where a test requires it, relevant medical history, or reasons for testing), the samples we take, and the laboratory results we receive and release to you. Health data is 'special category' data and is given additional protection.
• Payment data — the amount paid, payment method, and the transaction reference from our payment processor. We do not receive or store your full card number.
• Account data — where you create an account or sign in with a secure link, your login identifiers and sign-in history.
• Correspondence — emails, text messages, call notes, review submissions and enquiry form messages.
• Technical data — IP address, device and browser information, and pages viewed, collected through cookies and similar technologies. See our cookie information below.

Under UK GDPR we must have a lawful basis for each use of your data. Where we process health data, we also rely on an Article 9 condition — normally Article 9(2)(h), processing necessary for the provision of health care and treatment, carried out by or under the responsibility of professionals bound by a duty of confidentiality.

Where we rely on legitimate interests, we have considered whether our interests are overridden by your rights and freedoms; you can ask us for details of that assessment at any time. Where we rely on consent, you can withdraw it at any time without affecting processing carried out before you withdrew it.

We never sell your personal data. We share it only where it is needed to deliver your test or run our business lawfully:

• Partner laboratories — the accredited pathology laboratory that analyses your sample and produces your result. Which laboratory is used depends on the test you booked, and is shown on the test page. Laboratories act as separate controllers or as our processors depending on the arrangement.
• Your clinician — where you were referred to us by a GP, consultant or other clinician, or where you ask us to send your results to them.
• Payment processing — Stripe and Klarna process your card or credit payment. They are separate controllers for that payment data.
• Technology suppliers — our website, database, secure file storage, email and SMS providers process data on our instructions as processors under written contracts.
• Professional advisers — accountants, insurers and legal advisers where necessary.
• Authorities and regulators — where we are required to disclose data by law, or to protect someone's vital interests.

All processors are bound by written contracts requiring them to keep your data secure, to use it only on our instructions, and to delete or return it at the end of the engagement.

Your clinical data and results are held within the UK or European Economic Area. A small number of our technology suppliers (for example email delivery and error monitoring) may process limited data outside the UK. Where that happens we rely on UK adequacy regulations or on the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with additional safeguards where needed. You can ask us for a copy of the relevant safeguards.

• Clinical records, including test requests, consent forms and results — 8 years from the date of your appointment, in line with NHS records-management retention for adult health records. For patients under 18, until their 25th birthday (or 26th if the record was made shortly before their 17th birthday).
• Booking and appointment records not forming part of a clinical record — 8 years.
• Financial and payment records — 6 full financial years plus the current year, to meet HMRC requirements.
• Marketing consent records — until you unsubscribe, and for 2 years afterwards as evidence of your preference.
• Secure results downloads — links expire automatically and are revoked shortly after use; the underlying report is retained with your clinical record.
• Website analytics and cookie data — up to 24 months.
• Complaints and correspondence — 6 years from resolution.

At the end of these periods we securely delete or anonymise your data.

Data is encrypted in transit and at rest. Access to clinical records is restricted to clinic staff who need it, controlled by individual accounts with role-based permissions, and access is logged. Results are released through expiring, identity-verified secure links rather than as email attachments. Our staff are trained in confidentiality and data protection, and we have procedures for detecting, investigating and reporting personal data breaches — including notifying the ICO within 72 hours and notifying you where a breach is likely to result in a high risk to your rights and freedoms.

We use strictly necessary cookies to make the site work, including keeping you signed in and holding your booking. These do not require consent. We also use analytics and preference cookies only where you have consented. You can change your choices at any time using the 'Cookie settings' link in the footer of every page, or by clearing cookies in your browser.

Under UK GDPR you have the right to:

• Be informed about how we use your data — this policy.
• Access a copy of the personal data we hold about you (a subject access request).
• Rectification of inaccurate or incomplete data.
• Erasure of your data, where we no longer have a lawful reason to keep it. This right is limited where we must retain clinical or financial records by law.
• Restrict processing while a concern is investigated.
• Data portability — receive certain data in a structured, machine-readable format, or have it sent to another provider.
• Object to processing based on legitimate interests, and to object to direct marketing at any time (we will always stop).
• Withdraw consent at any time where we rely on it.
• Not be subject to solely automated decision-making with legal or similarly significant effects. We do not make such decisions about you.

To exercise any of these rights, email hello@cheshirebloodsclinic.co.uk or call 0330 088 4438. We will respond within one month. We may ask you to verify your identity before releasing health data. There is normally no charge, but we may charge a reasonable fee for manifestly unfounded or excessive requests.

We only send marketing emails or texts where you have opted in, or where you are an existing customer and the message relates to similar services (the 'soft opt-in'). Every message includes an unsubscribe link, and you can also opt out by emailing us. We do not use your health data to target marketing.

Where we test a child, the booking is made by a parent or someone with parental responsibility, who provides consent on the child's behalf. We hold the child's data as part of their clinical record and apply the extended retention period set out above. A child with sufficient understanding may exercise their own data protection rights.

If you are unhappy with how we have handled your data, please contact us first at hello@cheshirebloodsclinic.co.uk — we would like the chance to put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk, by calling 0303 123 1113, or by writing to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

We review this policy regularly and will update this page when it changes. Where changes are significant, we will tell you directly. This version was last updated on 2 September 2026.