1. Who We Are

OptiBlood is a trading name of BB 2 SERVICE LTD, registered in England and Wales under company number 10213673.

Registered office:

39 Tilston Walk
Wilmslow
SK9 2HL
United Kingdom

ICO registration number: ZB069379

Email: support@optiblood.uk

For data-protection purposes, BB 2 SERVICE LTD is the controller of the personal information described in this Privacy Policy.

2. About This Policy

This Policy explains how OptiBlood collects, uses, stores, protects and shares personal information when customers:

• Visit the website
• Contact OptiBlood
• Purchase a test or health bundle
• Provide patient information
• Submit a sample
• Receive a laboratory report
• Exercise their legal rights

Blood-test information, selected tests, sample information and laboratory results may constitute special-category health information requiring additional protection.

3. Information We Collect

Depending on the service used, we may collect:

Identity information

• Full name
• Date of birth
• Sex where relevant to testing or reference ranges
• Patient, order or sample reference

Contact information

• Delivery address
• Billing address
• Email address
• Mobile number

Order information

• Products and bundles purchased
• Order date and value
• Delivery and return status
• Discounts
• Support history

Health and testing information

• Selected test or bundle
• Relevant preparation or collection information
• Sample identifiers and status
• Laboratory report
• Test results and reference ranges
• Health information voluntarily supplied to customer support

A selected test may reveal or imply information about health and will be handled appropriately.

Payment information

Payments are processed securely through Stripe.

OptiBlood does not store complete card numbers or security codes.

We may receive limited information including payment status, transaction reference, amount and refund status.

Technical information

• IP address
• Browser and device information
• Website activity
• Security and error logs
• Cookie preferences
• Basket and checkout activity

Communications

• Contact-form submissions
• Emails and support messages
• Cancellation and refund requests
• Report-delivery records
• Consent and preference records

4. Why We Use Information

Information may be used to:

• Process orders
• Confirm payment
• Deliver collection kits
• Arrange sample return
• Create the correct laboratory request
• Link a sample to the correct person
• Arrange laboratory analysis
• Deliver the original laboratory report
• Send the report password separately by SMS
• Provide customer support
• Process cancellations, replacements and refunds
• Prevent fraud
• Maintain website security
• Meet accounting, tax and legal obligations
• Establish, exercise or defend legal claims
• Manage cookies and marketing preferences

Health information will not be used for unrelated advertising.

OptiBlood does not sell personal or health information.

5. Lawful Bases

Under Article 6 of the UK GDPR, personal information may be processed because:

• Processing is necessary to perform a contract or take requested steps before entering a contract.
• Processing is necessary to comply with a legal obligation.
• Processing is necessary for legitimate interests such as fraud prevention, security, customer support and protecting legal rights, where these interests do not override individual rights.
• Consent has been provided for optional activities such as marketing and non-essential cookies.

6. Special-Category Health Information

Health information requires an additional condition under Article 9 of the UK GDPR.

Where OptiBlood relies on explicit consent, customers will be asked to provide that consent separately before health information is processed.

Health-data consent must not be combined with marketing consent.

Withdrawing consent does not make earlier lawful processing unlawful. However, withdrawing consent before testing has been completed may prevent OptiBlood from completing the service.

Where another Article 9 condition applies, it must be identified and documented before it is relied upon.

7. Laboratory Analysis

The minimum information necessary may be shared with a specialist laboratory to:

• Identify the patient and sample
• Perform the selected analysis
• Produce the laboratory report
• Investigate sample or report queries
• Meet relevant quality, regulatory and legal responsibilities

The laboratory may act as a processor or a separate controller depending on its legal and contractual responsibilities.

8. Report Delivery

OptiBlood does not provide a results portal.

The original laboratory report is sent to the verified customer email address as a password-protected PDF.

The password is sent separately by SMS to the verified mobile number.

Laboratory reports must not be:

• Uploaded to public website storage
• Stored in a media library
• Made available through public links
• Sent as unprotected attachments
• Rewritten or automatically interpreted by AI

Customers are responsible for providing accurate report-delivery information.

For a Couples Bundle, each participant must have a separate patient record, report and verified contact details.

9. Who We Share Information With

Where necessary, information may be shared with:

• Specialist laboratory providers
• Kit-fulfilment providers
• Postal and courier services
• Stripe and payment providers
• Email and SMS providers
• Website, hosting and technical providers
• IT-security and backup providers
• Professional advisers
• Insurers
• Regulators, courts and public authorities

Each provider should receive only the information necessary for its role.

Providers acting as processors must be subject to appropriate contractual and data-protection obligations.

10. Website Platform and Data Location

The OptiBlood website is built using Base44.

The current Base44 Builder workspace stores website app data in the United States.

Laboratory PDF reports must not be uploaded to or stored in Base44.

Some order information may reveal or imply health information. OptiBlood will minimise the information stored on the website platform.

11. International Transfers

Some service providers may process information outside the United Kingdom.

Where a restricted international transfer occurs, OptiBlood will identify and use an appropriate legal transfer mechanism where required.

This may include:

• UK adequacy regulations
• The UK International Data Transfer Agreement
• The UK Addendum to approved Standard Contractual Clauses
• Another legally recognised safeguard

Customers may contact support@optiblood.uk for further information about applicable safeguards.

12. Security

Proportionate technical and organisational safeguards may include:

• Restricted staff access
• Role-based permissions
• Staff authentication
• Password-protected reports
• Separate-channel password delivery
• Encryption during transmission
• Secure payment processing
• Confidentiality requirements
• Security monitoring
• Incident-management procedures
• Supplier due diligence
• Retention and deletion procedures

No internet or email system can be guaranteed completely secure.

Safeguards will be reviewed according to the sensitivity of the information and associated risks.

13. Retention

Information is retained only as long as reasonably necessary for:

• Providing the service
• Delivering the report
• Customer support
• Complaints and disputes
• Legal and regulatory obligations
• Tax and accounting requirements
• Establishing, exercising or defending legal claims
• Fraud prevention and security

Retention categories include:

• Order and financial information: retained for applicable legal, accounting and tax periods.
• Patient and testing information: retained only for the documented period required to provide the service and meet applicable responsibilities.
• Laboratory reports: handled according to the documented report-delivery and clinical-record policy.
• Contact enquiries: retained until resolved and for a reasonable complaints or legal-claims period.
• Consent records: retained as accountability evidence.
• Marketing preferences: retained until withdrawal or no longer required.
• Cookie records: retained according to the Cookie Policy.
• Security logs: retained for an appropriate limited security period.

BB 2 SERVICE LTD must maintain an internal retention schedule.

14. Marketing

Marketing consent is optional and separate from:

• Terms acceptance
• Health-data consent
• Essential service communications
• Report delivery

Customers can unsubscribe through the link in a marketing email or by contacting support@optiblood.uk.

Health information and laboratory results must not be used to create unrelated advertising profiles.

15. Cookies

Necessary cookies may support:

• Basket functionality
• Checkout
• Security
• Cookie preferences

Optional analytics and marketing technologies must not load until valid consent is obtained.

Customers can accept, reject or manage optional cookies through Cookie Settings.

Further details are provided in the Cookie Policy.

16. Data-Protection Rights

Subject to applicable law, customers may have the right to:

• Request access
• Request correction
• Request deletion
• Request restriction
• Object to certain processing
• Request data portability
• Withdraw consent
• Complain about information handling

Some rights are subject to legal exceptions.

OptiBlood may request reasonable information to verify identity before disclosing health or order information.

Requests should be sent to support@optiblood.uk.

17. Complaints to the ICO

Customers should contact OptiBlood first so that we can investigate.

Customers also have the right to complain to the Information Commissioner's Office:

https://ico.org.uk/make-a-complaint/

OptiBlood's ICO registration number is ZB069379.

18. Children

Standard OptiBlood services are intended for adults aged 18 or over.

OptiBlood does not knowingly collect children's health information through standard adult products.

19. Automated Decision-Making and AI

OptiBlood does not use an AI system to:

• Diagnose medical conditions
• Make automated treatment decisions
• Rewrite laboratory results
• Change reference ranges
• Determine urgent clinical action without an approved human-controlled process

The original laboratory report remains the authoritative report delivered to the customer.

20. Data Breaches

OptiBlood maintains procedures to identify, investigate and respond to personal-data incidents.

Where required by law, the Information Commissioner's Office and affected individuals will be notified within applicable timeframes.

21. Changes to This Policy

This Policy may be updated when services, providers, technology or legal obligations change.

The latest version and effective date will be displayed on the website.

22. Contact

OptiBlood
BB 2 SERVICE LTD
39 Tilston Walk
Wilmslow
SK9 2HL
United Kingdom

Company number: 10213673
ICO registration number: ZB069379
Email: support@optiblood.uk