TrueVitals Privacy Policy

TrueVitals Group Ltd · Company number 16449605 · Last updated 30 August 2026

Introduction and Scope

TrueVitals Group Ltd is a UK company providing private blood testing and health reporting. We are the data controller of your personal information under the UK General Data Protection Regulation (UK GDPR), meaning we determine how and why your personal data is processed.

This policy explains what we collect, how we use and share it, where it goes, how long we keep it, and what rights you have. We have written it to be read rather than skimmed. Where a plain-English summary would help, see our Data Protection page; where the two differ, this policy is the governing document.

Data We Collect

We collect personal data you give us, and data generated in the course of providing your test:

Identity and contact information: name, email address, telephone number, postal address where required for a home visit, date of birth, and sex where relevant to interpreting results. Date of birth and sex are clinically necessary, because reference ranges differ by both.
Payment information: billing details needed to take payment. We never see or store full card numbers. Payment is handled by accredited processors.
Health and lifestyle information (special category data): your questionnaire responses covering goals, symptoms, diet, exercise, sleep, stress and medications, together with the biomarker results returned by our laboratory partners. Health data is special category data under Article 9 of the UK GDPR and carries a higher level of protection.
Report data: the personalised analysis generated from your results, and your report history where you test more than once.
Communications: emails and support messages between you and us.
Technical data: website usage, pages visited, device and browser information, and IP address.

If you choose not to provide certain information, particularly health questionnaire responses, we may not be able to provide the service or your report will be materially less useful.

How We Use Your Data

Providing your test. Registering your order, arranging phlebotomy, sending your sample to the laboratory, and matching results correctly to you.
Generating your report. Cross-referencing your biomarker results against your questionnaire responses to produce a personalised analysis, which is then reviewed by a medical professional before release.
Delivering results securely. We do not send test results by email. Results are accessible only through your TrueVitals account, and report links are additionally gated by date of birth verification, so a link alone is not sufficient to view a report.
Supporting you. Order confirmations, appointment information, notifications when your report is ready, and responses when you contact us.
Taking payment. Processing your transaction through a secure third-party provider.
Improving the service. Reviewing aggregate usage patterns to improve the product. This is done with de-identified data wherever possible.
Meeting legal obligations. Retaining records required for tax, accounting and regulatory purposes, and responding to lawful requests.

We will not use your personal data for a purpose incompatible with those described here. If we intend a genuinely new purpose, we will update this policy and tell you.

Legal Bases for Processing

Under UK GDPR we must have a valid legal basis for processing your data. We rely on the following:

Explicit consent (Article 9(2)(a)) for health data. Health information is special category data and requires explicit consent. You give this when you place your order and complete your health questionnaire. You can withdraw it at any time by emailing us. Withdrawal does not affect processing already carried out lawfully, but it may mean we can no longer provide the service.
Performance of a contract (Article 6(1)(b)). For ordinary personal data used to deliver what you have purchased: your name, contact details, order and appointment records.
Legitimate interests (Article 6(1)(f)). For service improvement, security, fraud prevention and service-related communications, where we have balanced our interests against your rights. We do not rely on legitimate interests for anything intrusive, and never for unsolicited marketing.
Legal obligation (Article 6(1)(c)). For records we are required to keep, such as transaction records for tax and accounting.

Your consent to health processing is separate from your choice about research data. You can use TrueVitals in full while opting out of anonymised research datasets. The two are not bundled, and opting out changes nothing about your service, your report, or your price.

Anonymised Research Datasets

Your personal data is never sold. Information that identifies you is never sold, rented or traded to anyone, for any purpose.

Separately, we may create fully anonymised datasets from biomarker results and questionnaire responses, and may share or license those datasets to research institutions, universities, healthcare organisations and life sciences companies. This supports health research and helps fund development of the service.

How anonymisation is carried out

Anonymisation follows UK GDPR Recital 26 and Information Commissioner's Office guidance, meaning re-identification must not be reasonably likely by any means reasonably available to a recipient. In practice:

All direct identifiers are removed: name, email, telephone, address, account reference
Dates of birth are generalised to age bands rather than exact dates
Location data is truncated or removed entirely
Small groups are suppressed so that no individual can be inferred from an unusual combination of values
No key is retained that could link a dataset back to an individual

Once data has been through this process it is no longer personal data under the UK GDPR. Because the link is genuinely severed, anonymised data cannot subsequently be located, corrected or deleted at an individual's request, which is why the opt-out below operates before anonymisation rather than after.

Who may receive anonymised datasets

Medical and scientific research institutions
Universities and academic researchers
Pharmaceutical, biotechnology and diagnostics companies
Health technology companies developing products and services
Public health bodies

Your opt-out

If you would prefer your results were not included in anonymised research datasets, email support@truevitals.co.uk and we will exclude them.

You do not need to give a reason. This will not affect the service you receive, the depth of your report, the speed of your results, or the price you pay. You can opt out before or after testing, and if you opt out after testing we will exclude your data from any dataset not already anonymised and released.

Data Sharing and Disclosure

We share personal data only where it is needed to deliver the service, meet a legal obligation, or where you have asked us to. Every recipient below operates under a contract requiring them to protect your data and to use it only for our specified purposes.

Nationwide Pathology Limited — our laboratory partner for Advanced and Ultimate panels. Receives your name, date of birth, sex, a test identifier and your sample, to conduct analysis and quality checks and return results to us.
Randox Health — our laboratory and clinic partner for Signature panels. Receives your name, contact details, date of birth and sex to arrange your clinic appointment, take physical measurements, analyse your sample and return results.
Phlebotomy providers — clinic and mobile phlebotomists receive your name, contact details, appointment information and, for home visits, your address.
AI analysis providers (Anthropic's Claude and OpenAI's ChatGPT) — receive de-identified biomarker values and questionnaire responses to generate the cross-system analysis in your report. Your name, email, address and telephone number are not sent. Both act solely as our data processors under contract, are not permitted to use your data for their own purposes, and are not permitted to train models on it. See the section on international transfers below.
The reviewing medical professional — has access to your report and results in order to review them before release.
Payment processors — receive the information necessary to take payment. They are PCI DSS compliant and we never receive or store your full card number.
Buy now, pay later providers (Klarna, Clearpay, Payl8r) — where you choose one of these, they receive your name, contact details and order value in order to provide credit or a deferred payment arrangement. That agreement is between you and them, and their own privacy policy applies to it.
Infrastructure and communication providers — hosting, account management, email and support tools, used to run the platform and communicate with you.
Legal and regulatory — regulators, law enforcement or courts, where disclosure is required by law or necessary to establish or defend legal claims. We verify the legitimacy of any such request before responding.

We do not share your personal data with third parties for their own marketing or advertising purposes. We do not sell personal data. If you would like an up-to-date list of the service providers we use, email us and we will provide one.

International Transfers

Your sample and its laboratory analysis take place in the UK and Ireland. Your identified personal data is held on UK and EU infrastructure.

The AI providers used to generate reports are based in the United States, so de-identified biomarker and questionnaire data is transferred outside the UK for that processing. These transfers are made under the safeguards required by Chapter V of the UK GDPR, specifically the UK International Data Transfer Agreement or the UK Addendum to the European Commission's Standard Contractual Clauses. The receiving organisation is contractually bound to protect your data to UK standards, and your rights over it are unaffected by where it is processed.

Some infrastructure and communication providers also operate outside the UK, under the same safeguards. If you would prefer your data were not processed outside the UK at all, we are unable to generate a report, since that analysis is central to the product. Contact us before ordering if this matters to you.

Data Retention

We keep personal data only as long as necessary for the purpose it was collected, and as required by law:

Results and report data are retained while your account is active, so you can access past reports and track changes across repeat tests. This is the basis of longitudinal tracking and is one of the reasons to hold an account.
Order and payment records are retained for the period required by tax and accounting law, currently six years from the end of the relevant financial year.
Communications are retained for as long as needed to handle your query and to resolve any subsequent dispute.
If you close your account, we delete or irreversibly de-identify your personal data, other than records we are legally required to keep. We will tell you what must be retained and for how long.
Anonymised research datasets may be retained indefinitely by us and by recipients, because once anonymised they are no longer personal data and cannot be linked to any individual. This is why the opt-out described above operates before anonymisation.

We review the data we hold periodically. When a retention period expires, data is securely erased or irreversibly de-identified.

Data Security

We apply technical and organisational measures proportionate to the sensitivity of health data:

Encryption. Data is encrypted in transit using TLS, and sensitive data is encrypted at rest.
Results are behind authentication. We do not email test results. Your report is accessible only by logging into your account.
Report links are gated by date of birth. Even where a report link is obtained, it cannot be opened without correctly verifying the date of birth on the account. A link alone does not grant access.
Access is limited internally. Only personnel who need access to perform their role can reach personal data, and all are bound by confidentiality obligations.
Processor vetting. Third parties handling data on our behalf are assessed for their security practices and bound by contract.
Monitoring. Systems are monitored and security practices reviewed as threats and standards evolve.

Keep your login credentials confidential and use a strong, unique password. Your data is only as secure as your access to it.

No system can be guaranteed completely secure. In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours and notify you without undue delay where the risk is high.

Your Rights

You have the following rights over your personal data. To exercise any of them, email support@truevitals.co.uk. We respond within one month, as required by law, and there is no charge unless a request is manifestly unfounded or excessive.

Access. Request a copy of the personal data we hold about you.
Rectification. Ask us to correct anything inaccurate or incomplete.
Erasure. Request deletion of your personal data. We will comply unless we are legally required to retain specific records, in which case we will tell you exactly what and why.
Restriction. Ask us to pause processing, for example while a dispute about accuracy is resolved.
Objection. Object to processing carried out on the basis of legitimate interests. You have an absolute right to object to direct marketing.
Portability. Receive data you provided to us in a commonly used, machine-readable format, or ask us to transfer it.
Withdraw consent. Withdraw consent for health data processing at any time. This does not affect processing already carried out lawfully, and may mean we can no longer provide the service.
Opt out of research datasets. Exclude your results from anonymised research data, at any time, with no effect on your service or price.
Complain. Lodge a complaint with the Information Commissioner's Office, the UK supervisory authority.

We may need to verify your identity before acting on a request, to ensure we do not disclose data to the wrong person.

Please note that rights of access, correction and erasure cannot apply to fully anonymised research data, because the link to you has been irreversibly severed and the data can no longer be located. This is a consequence of genuine anonymisation rather than a policy choice, and it is why the opt-out operates beforehand.

Cookies

We use cookies and similar technologies on our website. We use:

Strictly necessary cookies, which allow the site to function, keep you logged in and secure your session. These do not require consent.
Analytics and performance cookies, which help us understand how the site is used so we can improve it. These require your consent and are not set unless you give it.

We do not use cookies for third-party advertising, and we do not permit third parties to use cookies on our site for their own marketing.

Where consent is required under the Privacy and Electronic Communications Regulations, you will be asked on your first visit and can change your choice at any time through the cookie settings on the site. You can also block or delete cookies through your browser, though some features such as staying logged in may then stop working.

Children's Privacy

TrueVitals is not intended for anyone under 18. We do not knowingly collect personal data from under-18s and do not accept orders from them. If we learn that we have collected data from someone under 18, we will delete it promptly and close any associated account. If you are a parent or guardian and believe a minor in your care has given us information, contact us and we will remove it.

Changes to This Policy

We may update this policy to reflect changes in our service or legal obligations. The revision date at the top of this page shows when it last changed. Where a change is material or significantly affects how we use your data, we will notify you by email or by a prominent notice on the website rather than relying on you to notice the date.

Complaints

If you are unhappy with how we handle your data, contact us first at support@truevitals.co.uk and we will investigate properly.

You also have the right to complain directly to the Information Commissioner's Office, the UK data protection regulator. You do not need our permission and you do not have to come to us first.

Website: ico.org.uk
Telephone: 0303 123 1113
Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Contact Information

For any question, concern or request about this policy or your personal data, contact us at support@truevitals.co.uk. If your query specifically concerns data protection, say so in the subject line and it will be directed appropriately.

TrueVitals Group Ltd
Registered in England and Wales, company number 16449605
Registered office: Ground Floor, Rear Barn, The Brookdale Centre, Knutsford, Cheshire, WA16 0SR