Privacy Notice

Last updated: August 2026

At 300KYA, we take your privacy and confidentiality seriously. This Privacy Notice explains what personal information we collect, why we collect it, how we use and protect it, who we may share it with, and your rights.

Who we are

300KYA is an independent healthcare service registered with the Care Quality Commission (CQC) to provide diagnostic and screening procedures.

300KYA provides private, appointment-based specimen collection services for adults aged 18 and over.

For data protection purposes, 300KYA is responsible for the personal information it collects and uses in connection with the service.

Contact details

300KYA
67 Light Buildings
Lumen Court
Preston
PR1 2RA

Email: info@300kya.com
Telephone: +44 7495 213422

Information we may collect

Depending on how you use our service, we may collect information including:

  • Your full name

  • Date of birth

  • Contact details

  • Address and appointment location

  • Booking and payment information

  • Identification information where required

  • Consent documentation

  • Relevant health and clinical information

  • Information relating to the test requested

  • Specimen collection information

  • Laboratory request information

  • Laboratory test results

  • Communications between you and 300KYA

  • Complaints, incidents or safeguarding information where applicable

Health information and information concerning a person's sex life or sexual orientation can constitute special category personal data and receives additional protection under data protection law.

Why we use your information

We use personal information where necessary to:

  • Manage enquiries and bookings

  • Confirm your identity

  • Provide the specimen collection service

  • Obtain and document informed consent

  • Complete laboratory request documentation

  • Identify, label and transport specimens safely

  • Arrange laboratory testing

  • Receive and securely provide laboratory reports

  • Communicate with you about your appointment or service

  • Maintain appropriate clinical and business records

  • Manage complaints, incidents and safeguarding concerns

  • Meet our legal, regulatory and professional obligations

  • Maintain and improve the safety and quality of our service

Our lawful basis

We only process personal information where we have an appropriate lawful basis under UK data protection law.

Depending on the purpose, this may include processing necessary to provide the service you have requested, to comply with our legal obligations, or for other applicable lawful purposes.

Because healthcare information is special category data, we also identify an appropriate condition under Article 9 of the UK GDPR before processing this information.

We maintain records of the lawful bases and special-category conditions that apply to our processing activities.

Who we may share information with

We only share personal information where it is necessary and lawful.

This may include:

  • Our contracted diagnostic laboratory, where necessary for testing and reporting

  • Service providers acting on our behalf, where appropriate safeguards are in place

  • Healthcare professionals or services where you have authorised the disclosure or where another lawful basis applies

  • Safeguarding authorities where disclosure is necessary and lawful

  • Police, courts, regulators or other authorities where disclosure is required or permitted by law

We do not routinely share your laboratory results with your GP, employer, insurer, family members or other third parties without an appropriate lawful basis.

We will not disclose your results to another person simply because they request them.

Safeguarding and disclosure without consent

Confidentiality is important, but it is not absolute.

There may be exceptional circumstances where information needs to be shared without your consent, for example where there is a serious safeguarding concern, an immediate risk of serious harm, or where disclosure is required or otherwise permitted by law.

Where information must be shared, we will only share information that is necessary and relevant to the situation and will document the reason for the disclosure.

How we protect your information

300KYA uses appropriate physical, organisational and technical safeguards to protect personal information.

These include:

  • Restricted access to patient records

  • Secure storage of paper clinical records

  • Locked filing arrangements

  • Password-protected devices

  • Device encryption

  • Secure handling and transportation of documentation

  • Controlled access to laboratory systems

  • Confidentiality procedures

  • Appropriate disposal of confidential information

Personal information must not be stored on unauthorised devices or sent through unauthorised communication channels.

WhatsApp and electronic communication

300KYA may use WhatsApp Business for limited administrative communication, such as appointment confirmations, reminders and arrival updates.

We do not routinely use WhatsApp to send laboratory reports or completed clinical documentation containing sensitive health information.

How long we keep your information

We retain patient and clinical records in accordance with applicable legal, regulatory and professional record-retention requirements and our Records, Information Governance & Data Protection Policy.

Records are securely destroyed when the applicable retention period has expired unless there is a legal, regulatory or other justified reason to retain them for longer.

Your data protection rights

Depending on the circumstances, data protection law gives you rights over your personal information. These may include the right to:

  • Be informed about how your information is used

  • Request access to your personal information

  • Ask us to correct inaccurate or incomplete information

  • Request deletion of information in certain circumstances

  • Request restriction of processing in certain circumstances

  • Object to certain processing

  • Request data portability where applicable

Some rights do not apply in every circumstance, particularly where healthcare records must be retained because of legal or regulatory requirements.

To exercise your rights, please contact 300KYA using the details above.

Complaints about your personal information

If you are concerned about how 300KYA has handled your personal information, please contact us first so that we can investigate your concern.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator.

Further information is available from the Information Commissioner's Office.

Changes to this Privacy Notice

We may update this Privacy Notice when our services, systems, legal requirements or data-processing activities change.

The latest version will always be available on the 300KYA website.

Last reviewed: August 2026