Last Updated: 30 September 2026
 

1. Introduction
 

Harley Street Pathology Services Limited ("HSPS", "we", "our" or "us") is committed to protecting the privacy and confidentiality of personal information entrusted to us.
 

This Privacy Policy explains how we collect, use, store, disclose and protect personal data when you visit our website, contact us, use our services or otherwise interact with our organisation.
 

We process personal information in accordance with applicable data protection legislation, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
 

As a provider of pathology and laboratory services, we recognise the importance of protecting sensitive personal information, particularly health-related data.
 

By using our website or providing personal information to us, you acknowledge that you have read this Privacy Policy.
 

2. Data Controller
 

The organisation responsible for determining how and why your personal data is processed is:
 

Harley Street Pathology Services Limited

Registered Address:
134–136 Harley Street
London, W1G 7JY
United Kingdom

Company Registration Number: 14038568

General Enquiries: contact@hspathology.com
Telephone: 020 7100 2727
 

3. Personal Information We Collect
 

Depending on how you interact with us, we may collect the following categories of personal information.
 

3.1 Personal Identification Information
 

• Full name.

• Date of birth, where required.

• Contact details, including email address and telephone number.

• Postal address.

• Professional or organisational details.
   

3.2 Health and Medical Information
 

Where necessary for the provision of laboratory and diagnostic services, we may process sensitive health information, including:
 

• Medical history and relevant clinical information.

• Laboratory test requests and referral details.

• Biological sample identification information.

• Pathology test results.

• Relevant clinical correspondence.

• Information required for the safe and accurate processing of laboratory samples.
   

Health information and genetic data are recognised as special category personal data under the UK GDPR and are subject to additional legal protections.
 

3.3 Payment and Transaction Information
 

Where applicable, we may collect:
 

• Billing details.

• Invoice information.

• Payment records.

• Transaction references.
   

Payment card information may be processed by authorised payment service providers.
 

3.4 Website and Technical Information
 

When you visit our website, certain technical information may be collected automatically, including:
 

• IP address.

• Browser type and version.

• Operating system.

• Device information.

• Pages visited and browsing activity.

• Website interaction and cookie preferences.
   

This information may be used for website administration, security, performance monitoring and analytics.
 

3.5 Communication Information
 

We may retain information contained in enquiries, emails, contact forms, feedback and other communications submitted to us.
 

4. How We Collect Personal Information
 

We may collect personal data through:
 

• Direct interactions with patients, clients and healthcare professionals.

• Website contact forms and enquiries.

• Laboratory test requests and referrals.

• Clinics, healthcare professionals and authorised representatives.

• Service agreements and business relationships.

• Payment and billing processes.

• Cookies and similar technologies.

• Other lawful sources where necessary for the provision of our services.
   

Where information is provided to us by a healthcare professional, clinic or other authorised organisation, we will process it in accordance with applicable data protection requirements.
 

5. How We Use Your Personal Information
 

We process personal information only where we have an appropriate legal basis and a legitimate, specified purpose.

These purposes may include:
 

5.1 Providing Laboratory Services
 

• Receiving and processing laboratory test requests.

• Identifying and managing samples.

• Conducting laboratory analysis.

• Preparing and delivering test reports.

• Supporting healthcare professionals with relevant diagnostic information.

• Maintaining the quality and accuracy of laboratory services.
   

5.2 Communication and Customer Support
 

• Responding to enquiries.

• Managing service requests.

• Providing information about our services.

• Communicating with clinics, healthcare professionals and clients.

• Handling feedback and complaints.
   

5.3 Business and Administrative Operations
 

• Managing contracts and service agreements.

• Processing invoices and payments.

• Maintaining business records.

• Managing supplier and professional relationships.
   

5.4 Legal and Regulatory Compliance
 

• Complying with applicable legal obligations.

• Maintaining appropriate clinical and laboratory records.

• Meeting relevant regulatory and accreditation requirements.

• Protecting our legal rights and interests.
   

5.5 Website Improvement and Security
 

• Monitoring website performance.

• Improving user experience.

• Identifying technical issues.

• Preventing fraud, misuse and unauthorised access.
   

5.6 Marketing Communications
 

Where permitted by applicable law, we may use contact information to provide updates about our services, educational resources or relevant business communications.
 

You may opt out of marketing communications at any time.
 

We do not sell personal data to third parties.
 

6. Legal Basis for Processing
 

Under the UK GDPR, we rely on one or more of the following lawful bases, depending on the nature and purpose of the processing:
 

• Consent: Where you have freely given permission for a specific purpose.

• Contract: Where processing is necessary to perform a contract or take steps requested before entering into a contract.

• Legal Obligation: Where processing is required to comply with applicable law.

• Legitimate Interests: Where processing is necessary for our legitimate business interests and does not override your fundamental rights and freedoms.

• Vital Interests: Where processing is necessary to protect someone's life in circumstances recognised by law.

• Public Task: Where applicable to a task carried out in the public interest or under official authority.
   

For health information and other special category data, we also identify and rely on an applicable condition under Article 9 of the UK GDPR and, where required, the Data Protection Act 2018.
 

Depending on the circumstances, this may include processing necessary for the provision of health or social care, subject to the applicable legal safeguards and professional confidentiality obligations.
 

7. How We Share Personal Information
 

We may share personal information where necessary and lawful with:
 

7.1 Healthcare Professionals and Referring Clinics
 

Relevant patient information and test results may be shared with the referring clinician, healthcare professional or authorised organisation involved in the patient's care.
 

7.2 Laboratory and Service Providers
 

We may share relevant information with authorised third-party laboratories, specialist testing providers, IT providers, secure hosting providers and other service partners where required to deliver our services.
 

7.3 Regulatory and Legal Authorities
 

Information may be disclosed where required by law, court order, regulatory obligations or other lawful requests.
 

7.4 Professional Advisers
 

Where necessary, information may be shared with legal, financial, insurance or other professional advisers, subject to appropriate confidentiality and data protection safeguards.
 

We require relevant third parties to handle personal information securely and in accordance with applicable data protection requirements.
 

8. International Data Transfers
 

Where personal information is transferred outside the United Kingdom, we will ensure that appropriate safeguards are in place in accordance with applicable data protection legislation.
 

Depending on the circumstances, these safeguards may include:
 

• Transfers to countries recognised as providing an adequate level of data protection.

• International Data Transfer Agreements (IDTAs).

• The UK Addendum to the EU Standard Contractual Clauses.

• Other lawful transfer mechanisms.
   

Further information about applicable safeguards may be requested using the contact details provided in this policy.
 

9. Data Retention

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, including legal, regulatory, clinical, contractual and operational requirements.
 

Retention periods may vary depending on:
 

• The type and sensitivity of information.

• The nature of the laboratory service.

• Applicable healthcare recordkeeping requirements.

• Legal and regulatory obligations.

• The resolution of disputes or complaints.
   

When personal information is no longer required, it will be securely deleted, destroyed or anonymised in accordance with our data retention procedures.
 

10. Data Security
 

We implement appropriate technical and organisational measures designed to protect personal information against:
 

• Unauthorised access.

• Accidental loss or destruction.

• Unlawful processing.

• Unauthorised disclosure.

• Alteration or misuse.
   

These measures may include access controls, restricted permissions, secure systems, staff confidentiality obligations and appropriate information security procedures.
 

Although we take reasonable steps to protect personal information, no method of electronic transmission or storage can be guaranteed to be completely secure.
 

11. Cookies and Website Technologies
 

Our website may use cookies and similar technologies to improve functionality, understand website usage and enhance user experience.

Cookies may include:
 

• Strictly necessary cookies.

• Functional cookies.

• Analytics cookies.

• Marketing cookies, where applicable.
   

Where required by law, non-essential cookies will only be used after obtaining your consent.
 

You may manage your cookie preferences through the website's cookie settings or your browser settings.
 

For further information, please refer to our Cookie Policy.
 

12. Your Data Protection Rights
 

Under applicable data protection legislation, you may have the following rights:
 

Right of Access

You may request a copy of the personal information we hold about you.
 

Right to Rectification

You may request correction of inaccurate or incomplete personal information.
 

Right to Erasure

You may request deletion of your personal data in certain circumstances, subject to applicable legal and clinical recordkeeping obligations.
 

Right to Restrict Processing

You may request that we restrict the processing of your personal information in certain circumstances.
 

Right to Data Portability

Where applicable, you may request to receive certain personal information in a structured, commonly used and machine-readable format.
 

Right to Object

You may object to certain types of processing, including processing based on legitimate interests and direct marketing.
 

Right to Withdraw Consent

Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
 

These rights are subject to certain legal conditions and exemptions.
 

13. How to Exercise Your Rights
 

To exercise your data protection rights or submit a privacy-related request, please contact:

Email: sonal@hspathology.com

Postal Address:

Data Protection / Compliance Team
Harley Street Pathology Services Limited
134–136 Harley Street
London, W1G 7JY
United Kingdom
 

We may need to verify your identity before responding to your request.
 

We will respond within the time limits required by applicable data protection legislation.
 

14. Children's Privacy
 

Our website is not specifically directed at children.
 

Where personal information relating to a child is processed as part of laboratory or healthcare services, we will handle that information in accordance with applicable data protection legislation, safeguarding requirements and relevant professional obligations.
 

15. Third-Party Websites
 

Our website may contain links to external websites operated by third parties.
 

We are not responsible for the privacy practices, content or security of these websites.
 

We encourage users to review the relevant privacy policies before providing personal information to external websites.
 

16. Data Breaches
 

In the event of a personal data breach, we will assess the incident and take appropriate steps in accordance with applicable data protection legislation.
 

Where legally required, we will notify the Information Commissioner's Office (ICO) and affected individuals within the applicable statutory timeframes.
 

17. Changes to This Privacy Policy
 

We may update this Privacy Policy from time to time to reflect changes in legislation, regulatory requirements, business operations or our data processing practices.
 

Any updated version will be published on this page with a revised date.
 

We encourage users to review this page periodically.
 

18. Complaints and Regulatory Authority
 

If you have concerns about how your personal information has been handled, we encourage you to contact us first so that we can investigate your concerns.

You also have the right to lodge a complaint with the UK's data protection supervisory authority:

Information Commissioner's Office (ICO)

Website: https://ico.org.uk/

Telephone: 0303 123 1113

You may contact the ICO if you believe that your personal information has been processed in a manner that does not comply with applicable data protection legislation.
 

19. Contact Us

For questions, requests or concerns relating to this Privacy Policy or the handling of your personal information, please contact:
 

Harley Street Pathology Services Limited

134–136 Harley Street
London, W1G 7JY
United Kingdom

General Email: hello@hspathology.com
Compliance Email: sonal@hspathology.com
Telephone: 020 7100 2727

End of Privacy Policy