Privacy Notice

Last updated: [insert date]

1. Who we are

SymptomX Health (“SymptomX”, “we”, “us” or “our”) provides gut microbiome testing kits and a personal results interpretation service.

For the purposes of applicable UK data protection law, the data controller responsible for your personal information is:

This Privacy Notice explains what personal information we collect, why we use it, who we share it with and the rights you have.

2. The information we collect

Depending on how you use our website and services, we may collect the following information.

Contact and order information

  • Name, email address and telephone number, where provided.

  • Billing and delivery addresses.

  • Order details, payment status and customer service correspondence.

Health and wellbeing information

  • Information you provide about your symptoms, health history, diet, lifestyle and wellbeing.

  • Information you provide through questionnaires or consultations.

  • Test results and related information supplied by the laboratory, where applicable.

Health information is particularly sensitive personal data and is subject to additional legal protections.

Website and technical information

  • Information such as your IP address, browser, device and website usage, where collected through our website or cookies.

  • Cookie preferences and consent choices.

We aim to collect only the information reasonably necessary for the purposes explained in this Notice.

3. How we use your information

We may use your personal information to:

  • Process and manage your order and payment.

  • Arrange delivery of your test kit.

  • Coordinate the processing of your test with the relevant laboratory.

  • Receive and review your test results.

  • Provide your personalised results interpretation and related communications.

  • Respond to enquiries and provide customer support.

  • Maintain business, financial and transaction records.

  • Operate, secure and improve our website and services.

  • Meet our legal and regulatory obligations.

  • Send marketing communications where we are permitted to do so and, where required, you have consented.

We will not use your health information for unrelated purposes without an appropriate lawful basis.

4. Our legal basis for processing

UK data protection law requires us to have a lawful basis for processing personal information.

Depending on the information and purpose, we may rely on:

  • Contract: to process your order and provide the service you have purchased.

  • Legal obligation: to comply with applicable legal, accounting and tax requirements.

  • Legitimate interests: where necessary for legitimate business purposes, provided your rights and interests do not override those interests.

  • Consent: where you have freely agreed to a specific use of your information and consent is the appropriate legal basis.

Health information is classified as special-category personal data. Processing it requires both a lawful basis under Article 6 of the UK GDPR and an applicable condition under Article 9. [Confirm the specific conditions relied upon for your service and ensure any required explicit consent is obtained separately and appropriately.]

Where we rely on consent, you can withdraw it at any time. Withdrawal does not affect processing that took place before you withdrew consent. It may affect our ability to provide parts of the service.

5. Who we share your information with

We may share relevant information with carefully selected service providers where necessary to deliver our service, including:

  • The testing laboratory: GutMapDx and any relevant laboratory or laboratory service provider involved in processing your sample and making test results available to us.

  • Website and commerce providers: Squarespace, which hosts our website and supports relevant website and commerce functions.

  • Payment providers: the payment processor used to handle your transaction, such as Stripe or Squarespace Payments, depending on our checkout configuration.

  • Delivery providers: couriers or postal services where required to deliver your kit.

  • Professional advisers and authorities: where necessary for legal, accounting, regulatory or other legitimate legal requirements.

We aim to share only the information needed for the relevant purpose. We do not sell your personal information to third parties.

[Confirm exactly which providers receive personal or health information, including whether any health information is entered into third-party systems.]

6. International transfers

Some of our service providers may process personal information outside the United Kingdom.

Where personal information is transferred internationally, we will take steps required by applicable data protection law to ensure it receives an appropriate level of protection. These steps may include relying on UK adequacy regulations or using an approved transfer safeguard where required.

[Confirm the countries in which your relevant providers process or store personal information and the safeguards that apply.]

7. How long we keep your information

We retain personal information only for as long as reasonably necessary for the purposes described in this Notice, including providing the service, maintaining appropriate records, resolving disputes and meeting legal obligations.

Different types of information may be retained for different periods. For example, financial and transaction records may need to be retained to meet legal accounting and tax requirements. Health information and test results should be retained only for a defined and justified period.

[Insert your actual retention periods for order records, health questionnaires, test results, consultation notes and marketing records. Do not publish this Notice until these periods have been decided.]

When information is no longer required, we will securely delete it or anonymise it where appropriate, subject to any legal retention requirements.

8. How we protect your information

We take appropriate technical and organisational measures to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.

Access to personal and health information should be limited to people and providers who need it for legitimate purposes. However, no method of transmission or storage can be guaranteed to be completely secure.

You should avoid sending sensitive health information by ordinary email unless we have specifically advised you that the method is suitable.

9. Marketing communications

We may send service-related messages about your order, test kit, results or customer support.

We will send marketing communications only where permitted by applicable law. Where consent is required, we will ask for it separately. You can unsubscribe from marketing emails at any time using the unsubscribe link or by contacting us.

Choosing not to receive marketing communications will not prevent us from sending essential messages relating to a purchase or service.

10. Cookies and website analytics

Our website may use essential cookies and similar technologies to support website functionality, security and checkout.

Other cookies, including analytics or advertising technologies, may be used depending on our website configuration and your preferences. Where required, we will seek your consent before setting non-essential cookies.

You can manage available cookie preferences through our website’s cookie settings. You may also be able to control cookies through your browser, although blocking some cookies may affect website functionality.

[Check your Squarespace cookie banner, analytics settings, embedded tools and any third-party tracking before publishing this section.]

11. Your data protection rights

Subject to applicable law and any relevant exemptions, you may have the right to:

  • Request access to the personal information we hold about you.

  • Ask us to correct inaccurate or incomplete information.

  • Ask us to delete your information.

  • Ask us to restrict certain processing.

  • Object to certain processing, including processing based on legitimate interests.

  • Request a copy of certain information in a portable format.

  • Withdraw consent where processing relies on consent.

  • Complain to the UK Information Commissioner's Office (ICO).

To exercise your rights, contact us using the details in section 1. We may need to verify your identity before responding.

You can find information about your rights and how to complain at the Information Commissioner's Office website: https://ico.org.uk/

12. Children's information

Our services are intended for adults aged 18 or over. We do not knowingly offer this service to children or intentionally collect children's personal information through the service.

If you believe a child has provided us with personal information, please contact us so that we can assess and address the situation.

13. Links to other websites

Our website may contain links to third-party websites. Those websites operate under their own privacy notices and practices. We are not responsible for their content or privacy practices, and we recommend reviewing their notices before providing personal information.

14. Changes to this Privacy Notice

We may update this Notice to reflect changes to our service, data processing practices or legal obligations. The latest version will be published on this page with its updated date.

15. Contact us

If you have questions about this Privacy Notice or how your personal information is handled, please contact:

SymptomX Health
Email: hello@symptomx.health

Website: https://www.symptomx.health