Privacy Policy

Effective Date: July 2, 2026

Hampshire Phlebotomy Services ("we," "our," or "us") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal and medical data when you use our mobile phlebotomy services, contact us, or use our website (www.hampshirephlebotomyservices.com).

We operate in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We are registered with the Information Commissioner’s Office (ICO) under registration number ZC186045.

1. Information We Collect

Because we provide medical and clinical services, we must collect both standard personal data and "Special Category" (health) data.

  • Personal Data: Name, date of birth, home address (for mobile visits), email address, phone number, and billing/payment details.

  • Special Category Data: Medical history, GP details, laboratory test requests/requisition forms, and details regarding your blood sample collection (e.g., historical difficulties with venepuncture).

2. How We Use Your Information

We use your information strictly to provide safe and effective clinical care:

  • To schedule, manage, and attend your mobile phlebotomy appointments.

  • To process payments and manage invoices via our secure booking systems.

  • To accurately label, track, and transport your blood samples to the designated laboratory.

  • To communicate with you regarding appointments, preparation instructions, or clinical governance matters.

3. Legal Basis for Processing

Under the UK GDPR, we rely on the following legal bases:

  • Contract: To fulfill our service agreement with you (e.g., visiting your home to take a sample).

  • Legal Obligation: To comply with professional clinical governance and tax records (HMRC).

  • Health and Social Care (Special Category Data): Processing is necessary for the purposes of preventive or occupational medicine and the provision of health or social care or treatment.

4. How Your Data is Stored and Secured

We take data security incredibly seriously.

  • Patient Records: Are securely stored using WriteUpp, a professional practice management system designed to support healthcare providers with secure record management.

  • Digital Storage: Any secondary digital business documentation is secured via encrypted cloud storage.

  • Physical Protection: Any temporary paper records (such as signed consent forms) are kept secure and processed in strict confidence until they are digitized or securely disposed of.

5. Sharing Your Data

We do not sell your data. We only share your information with trusted third parties necessary to complete your care:

  • The Analyzing Laboratory: Your name, DOB, and sample details must be shared with the pathology laboratory processing your blood test.

  • Software Providers: Secure platforms that support our business operations, including WriteUpp for appointment management and clinical records, and Squarespace for website hosting.

  • Emergency Services: In the highly unlikely event of a medical emergency during a home visit, relevant health data will be shared with emergency medical professionals.

  • NHS Information Sharing
    Where a patient provides an NHS blood test request form, Hampshire Phlebotomy Services provides the blood collection service only. We do not send blood samples, request forms, or patient information to NHS GP surgeries or NHS organisations on the patient's behalf unless this has been specifically agreed or we are legally required to do so. Patients are responsible for returning samples or information to their NHS provider where required.

6. Consent and Clinical Care

Before any blood collection procedure, appropriate consent will be obtained. Patients may withdraw consent at any time before or during the procedure. We will explain the procedure and answer any questions before proceeding.

7. Data Retention

We retain medical records in accordance with UK health and social care retention guidelines and clinical governance standards, which typically require us to keep adult clinical records for a minimum of 8 years after the conclusion of treatment. HMRC financial logs are kept for 6 years.

8. Your Rights

Under UK data protection law, you have rights including:

  • Your right of access: You have the right to ask us for copies of your personal information.

  • Your right to rectification: You have the right to ask us to rectify personal information you think is inaccurate.

  • Your right to erasure: You have the right to ask us to erase your personal information under certain circumstances (though this may be limited by our legal obligation to retain medical records).

  • Your right to restriction of processing: You have the right to ask us to restrict the processing of your personal information.

9. Complaints link

For information about raising a concern, please see our ComplaintsProcedure.

10. Contact Us

If you have any questions, concerns, or wish to exercise your data rights, please contact us at:

If you remain unsatisfied with how we handle your data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at www.ico.org.uk.