How is my privacy maintained?

Your privacy is protected at every stage — from the basis on which we process your data, to how we store it and who we share it with.

• We only process your data where the law allows. To provide your tests and care we rely on our contract with you (Article 6(1)(b)). Because health data is sensitive ("special category"), we process it for the provision of health care (Article 9(2)(h)) or on your explicit consent (Article 9(2)(a)) — for example marketing or the OVARI biobank. Marketing is based on your consent, and some operational and analytics processing relies on legitimate interests, which you can object to at any time.
• Your data is kept secure. It's encrypted in transit and at rest, access is strictly limited on a role-based, least-privilege basis (with multi-factor authentication on key systems), and this all sits within our ISO/IEC 27001-certified information security management system.
• We're careful about who we share it with. We only share data with vetted suppliers under Article 28 data processing agreements (e.g. our laboratory, clinical partners, support and messaging tools), who can only use it on our instructions. We never sell or rent your data. We only share it more widely with your consent or where we're legally required to (e.g. regulators, or to protect someone's safety). Any transfers outside the UK/EEA are protected by Standard Contractual Clauses + the UK Addendum.
• You stay in control. You can access, correct, delete, restrict or object to the use of your data, or ask for a copy — just contact privacy@hertilityhealth.com. We also have a Data Protection Officer and an EU representative, and we run Data Protection Impact Assessments for higher-risk processing.