Privacy Policy
Effective Date: 26 August 2026
Hampshire Phlebotomy Services (“we”, “our” or “us”) is committed to protecting your privacy and handling your personal and health information securely, lawfully and responsibly.
This Privacy Policy explains what information we collect, why we collect it, how it is used, who it may be shared with, how long it may be retained and your rights in relation to your personal information.
We process personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable UK data protection legislation.
ICO Registration Number: ZC186045
1. Who We Are
Hampshire Phlebotomy Services provides independent mobile blood collection and ECG services.
For the purposes of UK data protection law, Hampshire Phlebotomy Services is the data controller for personal information that we determine how and why to process.
Where another healthcare, laboratory, cardiac or service provider processes information for its own purposes, that organisation may act as a separate data controller and its own privacy information may also apply.
2. Information We May Collect
Depending on the service you use, we may collect:
Personal and contact information, including:
Name
Date of birth
Home or appointment address
Telephone number
Email address
Appointment details
Billing and payment information
Health and clinical information, where relevant, including:
Relevant medical or health information
GP or healthcare-provider details
Blood test or ECG request forms
Tests requested
Information necessary to carry out your appointment safely
Information concerning previous difficulties with blood collection
Information about allergies, anxiety, needle phobia or other relevant clinical considerations
Information generated during the provision of our service
Health information is special category personal data and receives additional protection under UK data protection law.
3. Where We Obtain Your Information
We usually obtain information directly from you.
Where appropriate, information may also be provided by a parent or guardian, carer, healthcare professional, laboratory, cardiac service provider or another person or organisation involved in arranging your care or requested service.
Where information is obtained from another source, we will handle it in accordance with applicable data protection requirements.
4. How We Use Your Information
We may use your information to:
Arrange, confirm and manage appointments.
Provide mobile blood collection and ECG services.
Confirm your identity before carrying out a procedure.
Communicate with you regarding your appointment and preparation requirements.
Maintain appropriate clinical records.
Correctly identify and label blood samples and associated documentation.
Arrange blood testing or ECG services through appropriate third-party providers where requested and applicable.
Transfer information necessary for laboratory analysis, cardiac assessment, processing or reporting.
Communicate with relevant healthcare or service providers where necessary.
Process payments, refunds and invoices.
Respond to enquiries, complaints, incidents or concerns.
Meet our professional, insurance, legal, clinical-governance and record-keeping responsibilities.
Protect the health and safety of patients, practitioners and others.
We only collect and use information that is reasonably necessary for the relevant purpose.
5. Lawful Basis for Processing
The lawful basis used will depend upon why the information is being processed.
Under Article 6 of UK GDPR, this may include:
Contract – where processing is necessary to provide a service you have requested or to take steps at your request before providing that service.
Legal obligation – where information must be processed or retained to comply with a legal requirement.
Legitimate interests – where processing is reasonably necessary for legitimate business, administrative, security or clinical-governance purposes and those interests are not overridden by your rights.
Vital interests – in exceptional circumstances where processing is necessary to protect someone's life.
Where we process health information or other special category data, we must also identify an appropriate condition under Article 9 of UK GDPR.
Where applicable to the particular processing activity, this may include processing necessary for the provision or management of health or care services in accordance with applicable UK law.
We document and review the lawful bases and special-category conditions applicable to our processing activities.
6. Clinical Consent
Before carrying out a blood collection or ECG procedure, we will explain the procedure and obtain appropriate consent.
You may ask questions and may withdraw your consent to the clinical procedure before or during the procedure.
Consent to a clinical procedure is separate from the lawful basis relied upon for processing personal information under data protection legislation.
7. Sharing Your Information
We do not sell your personal or health information.
Where necessary, information may be shared with appropriate organisations or professionals involved in providing or supporting your requested service, including:
Laboratory service providers
Where blood testing is arranged through a laboratory, the information required to identify you, process the requested tests and report the results may be securely provided to that laboratory.
Cardiac service providers
Where an ECG or associated cardiac service requires external processing, interpretation or reporting, relevant information may be securely provided to the appropriate service provider.
Healthcare professionals
Information may be shared with an appropriate GP or other healthcare professional where necessary, where you have requested or authorised this, or where another lawful basis permits or requires the disclosure.
Technology and administrative service providers
We use appropriate systems and providers to support services such as clinical record management, appointment administration, website operation and payment processing.
Where these organisations process information on our behalf, appropriate data-protection arrangements are used where required.
Emergency services and authorities
Information may be disclosed where necessary to protect someone's vital interests, safeguard an individual, comply with the law or respond appropriately to an emergency.
8. NHS Request Forms
Where you provide an NHS blood-test request form, Hampshire Phlebotomy Services provides the blood-collection service unless another arrangement has specifically been agreed.
We do not routinely send samples, request forms or patient information to GP surgeries or other NHS organisations on your behalf.
Where you are responsible for returning a sample or documentation to an NHS provider, this will be explained to you.
9. How Your Information Is Stored and Protected
We take appropriate technical and organisational measures to protect personal and health information against unauthorised access, accidental loss, destruction, alteration or inappropriate disclosure.
Clinical and patient records are managed using WriteUpp, our practice-management system.
Other necessary business information may be held using appropriately secured systems.
Temporary paper documentation is handled confidentially and securely stored, digitised or disposed of when appropriate.
Access to personal and health information is restricted to those who have an appropriate reason to access it.
10. International Data Transfers
Some technology or service providers may process or store information outside the United Kingdom.
Where personal information is transferred internationally, we will take appropriate steps required by UK data protection law to ensure that the information receives an appropriate level of protection.
11. How Long We Keep Your Information
We retain personal information only for as long as reasonably necessary for the purpose for which it was collected and to meet applicable clinical, professional, insurance, legal, tax and regulatory requirements.
Different categories of information may therefore have different retention periods.
Clinical records are retained in accordance with applicable professional and healthcare record-retention requirements.
Financial and taxation records are retained for the period required by applicable UK law and HMRC requirements.
When information is no longer required, it will be securely deleted, destroyed or anonymised as appropriate.
12. Your Data Protection Rights
Depending on the circumstances and the lawful basis relied upon, you may have rights including:
The right to be informed about how your information is used.
The right to request access to your personal information.
The right to request correction of inaccurate or incomplete information.
The right to request erasure of information in certain circumstances.
The right to request restriction of processing in certain circumstances.
The right to object to certain processing.
The right to data portability where applicable.
The right to withdraw consent where consent is the lawful basis for processing.
These rights are not absolute. For example, we may be required to retain certain clinical, financial or legal records even if you request their deletion.
To exercise a data protection right, please contact us using the details below.
13. Automated Decision-Making
Hampshire Phlebotomy Services does not currently use personal or health information to make solely automated decisions that produce legal or similarly significant effects on patients.
If this changes, this Privacy Policy will be updated as required.
14. Children and Young People
Where services are provided to children or young people, personal and health information will be handled with particular care.
Information may be obtained from or shared with a parent, guardian or other person with appropriate parental responsibility where necessary and lawful.
The child's or young person's capacity, understanding, confidentiality and best interests will be considered as appropriate to their age and circumstances.
15. Data Breaches
We maintain procedures for identifying, assessing and managing personal-data breaches.
Where a breach presents a risk requiring notification under data protection law, we will notify the Information Commissioner's Office and/or affected individuals as required.
16. Cookies and Website Information
Our website may use cookies and similar technologies necessary for website functionality and, where applicable, analytics or other website features.
Where consent is legally required for non-essential cookies, visitors will be provided with appropriate choices through the website's cookie controls.
You can review or change your choices using Cookie Preferences on our website.
17. Complaints
If you are concerned about how we have handled your personal information, please contact Hampshire Phlebotomy Services so that we have an opportunity to investigate and respond.
Please also see our Complaints Procedure.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator.
Information Commissioner's Office
18. Changes to This Privacy Policy
We may update this Privacy Policy where our services, providers, business structure, legal obligations or data-processing practices change.
The latest version will be published on our website with its effective date.
19. Contact Us
Data Controller: Cristiana Alexandra Mihaila
Trading Name: Hampshire Phlebotomy Services
ICO Registration Number: ZC186045
Website: www.hampshirephlebotomyservices.com
For questions about this Privacy Policy or to exercise your data protection rights, please contact Hampshire Phlebotomy Services using the contact details provided on our website.