Privacy policy

1. Who we are and how to contact us

Your Baby Scan Ltd is responsible for your personal information when you use Cheshire Bloods Clinic. Cheshire Bloods Clinic is our trading name. We are registered in England and Wales (company number 09446510), and our registered office is 84 Victoria Rd, Widnes, Cheshire, WA8 7RA. We are registered with the Information Commissioner's Office (ICO) as a data controller, registration number ZB123027.

Our clinics are at 84 Victoria Rd, Widnes, WA8 7RA and 73-75 Nantwich Rd, Crewe, CW2 6AW. You can contact us about anything in this policy at hello@cheshirebloodsclinic.co.uk or on 0330 088 4438.

Our Data Protection Officer is Danielle Farrar, a director of the company, who is registered with the ICO as our DPO. You can contact her at admin@cheshirebloodsclinic.co.uk or by post at our registered office, marked "Data Protection Officer".

What this policy covers. It covers our website, booking a blood test with us, your appointment, how your sample and results are handled, and how we contact you. If you also use Your Baby Scan's ultrasound service or the Your Pregnancy Journey app, they have their own privacy policies. If you booked your test with one of our laboratory partners and were sent to us only for the blood draw, section 4 explains what we hold about you.

2. The information we collect

We collect different information depending on how you use our service.

When you book a test. Your name, date of birth, email address, mobile number and postal address, the test you choose, the clinic, the date and time, and your booking reference. Online bookings need a mobile number because we text you a one-time code to sign in and to view your results. For some tests, such as those in pregnancy, we also ask for health details like how many weeks pregnant you are. If you book for someone else, we collect their name and date of birth as well.

At your appointment. We check your name and date of birth. You sign a consent form, which goes to the laboratory with your sample. Our phlebotomist takes your sample and may make notes about the appointment. Some laboratory request forms ask for more health information. For prenatal screening (NIPT) they ask how many weeks pregnant you are, whether the pregnancy was through IVF, how many babies you are expecting, and any scan findings.

Your results. Laboratory results are health information and get extra protection. Section 4 explains how they reach you and what we keep.

When you pay. Stripe takes online card payments for us, so we never see your full card number. We receive confirmation of payment and a reference. With each payment we send Stripe the name of your test and your booking reference, so that you can recognise the payment on your receipt. The line on your card statement is the same for every payment and does not name your test. If you choose to pay later with Klarna or Afterpay Clearpay, they also receive your order details, including the name of the test, and use them under their own privacy policies.

Emails and text messages. Booking confirmations, reminders, notices that your results are ready, and replies to your enquiries, by email. Text messages that contain your sign-in code. Our emails show the name of your test inside the message (see section 8).

When you contact us. If you phone, email, text, message us on WhatsApp, or use the chat on our website, we keep a record of the conversation in our helpdesk system, and notes of calls. Please do not send health information in a message unless you need to.

CCTV. We use CCTV at our Widnes clinic to keep our staff, patients and premises safe. The cameras cover the entrance, corridor, yard and front of the clinic, never the clinic rooms, and record no sound. Footage stays on a recorder at the clinic and is overwritten after a little less than 60 days. Only our Technical Director can view it, and we share it only with the police or for legal proceedings. Our lawful basis is legitimate interests. To ask for footage of you, email admin@cheshirebloodsclinic.co.uk.

Our website. We use cookies and similar technologies. Essential cookies keep you signed in and hold your booking, and do not need your consent. Analytics cookies are set only if you agree. Where you do, Google Analytics (provided by Google Ireland Limited) measures how the site is used, using an anonymised IP address, device and browser type, approximate location (town or region) and the pages you view. We send no health information, names, email addresses or phone numbers to Google. You can change your choice at any time using "Cookie settings" in the footer of every page, or install Google's opt-out add-on at tools.google.com/dlpage/gaoptout. Analytics data is kept for up to 14 months.

3. Why we use your information

The law says we must have a lawful reason for each way we use your information. Health information is "special category" data and needs a second condition as well. Normally that is Article 9(2)(h) of the UK GDPR: providing health care, by or under the responsibility of a professional who owes a duty of confidentiality.

Where we rely on legitimate interests, we have weighed them against your rights and freedoms, and you can ask us for details of that assessment. Where we rely on consent, you can withdraw it at any time without affecting what we did before. We never use your health information for marketing and we never sell your information.

4. Who we share your information with, and how your results reach you

We never sell your information. We share it only where it is needed to deliver your test or run our business lawfully.

Laboratory partners. Your sample is analysed by the laboratory that offers your test: Concepto, Nationwide Pathology or Goodbody Health. Each laboratory is a separate organisation that decides for itself how it uses your sample and results, so it is responsible for that use and has its own privacy information. For Concepto's NIPT and Blue or Pink tests, you sign Concepto's own consent form, which tells you what Concepto does with your information.

How your results reach you.

Urgent results. The laboratory reviews every result. If one needs urgent attention, the laboratory tells us and telephones you directly.

If you booked with a laboratory partner. Some patients book their test with the laboratory, which then sends them to us only for the blood draw. The laboratory gives us what we need to do that: your name, date of birth, contact details and the test requested. We check your identity, take your sample and send it to the laboratory. Your results come to you from the laboratory. If the laboratory also sends us a copy, we handle it as described above.

Other organisations we use.

Our suppliers act on our instructions under written contracts, except where a supplier is a separate controller for its own purposes, as Stripe is for fraud prevention and legal compliance. We also share information with our accountants, insurers and legal advisers where necessary, and with regulators and the authorities where the law requires it or to protect someone's life.

5. Transfers outside the UK

We keep your booking and health information in the UK or Europe. Our booking system and database are in Ireland, our helpdesk is in London, our staff accounts are in the UK, and our staff email and file storage are in Switzerland. The UK treats Ireland and the rest of the European Economic Area, and Switzerland, as providing adequate protection, so these locations need no extra safeguards.

Some of our suppliers belong to international groups and may move limited information outside the UK:

• Stripe is our payments supplier in Ireland. Its group may transfer payment information to the United States and elsewhere, using Stripe's own safeguards, which include the UK-US Data Bridge.
• Twilio sends our text messages and handles WhatsApp from an account set to Ireland. Its US parent company is certified under the UK-US Data Bridge, with the UK International Data Transfer Agreement as the back-up safeguard.
• Google Analytics, if you agree to analytics cookies, may transfer data outside the UK under the UK addendum to the EU Standard Contractual Clauses.

Each laboratory is responsible for any transfers it makes, and its own privacy information explains them. You can ask us for a copy of the safeguards we rely on.

6. How long we keep your information

We keep information only as long as we need it. These are our periods.

When a period ends, we securely delete or anonymise the information. If a claim, complaint or legal request is under way, we keep what relates to it until it is resolved.

7. Your rights

Under UK data protection law you have the right to:

• Be told how we use your information, which is what this policy is for.
• See a copy of the information we hold about you (a subject access request).
• Have mistakes corrected in information that is wrong or incomplete.
• Ask us to erase your information where we no longer have a reason to keep it. This is limited where the law requires us to keep clinical or financial records.
• Ask us to restrict how we use your information while a concern is looked into.
• Ask for a portable copy, so you can take certain information to another provider.
• Object to uses based on our legitimate interests, and to marketing at any time. We will always stop marketing.
• Withdraw your consent at any time, where we rely on it.
• Not be subject to decisions made only by automated means that have a legal or similarly significant effect on you. We do not make such decisions.

To use any of these rights, email hello@cheshirebloodsclinic.co.uk, call 0330 088 4438, or write to our Data Protection Officer at admin@cheshirebloodsclinic.co.uk. We will reply within one month. We may ask you to prove who you are before we release health information. There is normally no charge.

Your results. We no longer hold some results once the periods in section 4 have passed. The laboratory holds the original, and a request about your sample or your results at the laboratory goes to the laboratory. We will help you make it.

8. How we keep your information secure

Access. Information is encrypted in transit and at rest. Access is limited to the staff who need it, through individual accounts, and our staff sign in with multi-factor authentication. Our staff are trained in confidentiality and data protection.

Signing in and viewing results. When you sign in to your booking, we email you a link and then text a six-digit code to the mobile number on your booking, so a link alone is never enough. The code expires after 10 minutes, and after five wrong attempts the account is locked and you need to contact us. Once you have entered a code, your browser stays verified for 12 hours. The same check applies before you can open a result. If you tick "remember me" when viewing results, you will not be asked for a code again on that device for 30 days, so only tick it on a device that is yours alone.

Emails. The email telling you your results are ready does not name your test. Our confirmation and reminder emails name your test inside the message, and so does your Stripe payment receipt. Their subject lines and the preview text do not name it, but anyone who can open your inbox can read the message. Please use an email address that only you can read.

When you call us. We check your name and date of birth, and ask for more detail where we need to, before we discuss your booking or results.

If something goes wrong. If a data breach is likely to put your rights at risk, we tell the ICO within 72 hours. Where the risk to you is high, we tell you as well.

9. Marketing emails

We send marketing emails only if you choose to receive them. You can opt in when you book, and we then email you to confirm that you want to subscribe. You are not added to the list until you confirm. Every marketing email has an unsubscribe link, and you can also ask us to stop at any time at hello@cheshirebloodsclinic.co.uk. Being on the list makes no difference to your booking or your care.

A specialist provider, Mailerlite, sends these emails for us. We do not use your health information to choose who receives them, and we do not give your details to other companies for their own marketing.

10. Children, complaints and changes to this policy

Children. Where we test a child, the booking is made by a parent or someone with parental responsibility, who gives consent on the child's behalf. We hold the child's information as part of their record and apply the longer retention period in section 6. A child who understands enough can use their own data protection rights.

Complaints. If you are unhappy with how we have handled your information, please contact us first at hello@cheshirebloodsclinic.co.uk or write to our Data Protection Officer, and we will try to put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk, by calling 0303 123 1113, or by writing to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

Changes. We review this policy regularly and update this page when it changes. If a change is significant, we will tell you directly. This version was last updated on 19 October 2026.