**Effective Date:** September 2, 2025

## 1. Data Controller Information
Hilmi Laboratory Services (a subsidiary of Hilmi Health System) is the data controller for your personal information. Our registered office is located at:
5 Brayford Square, London, E1 0SG
**Data Protection Officer:** privacy@hilmilab.co.uk

## 2. Information We Collect
### 2.1 Personal Information
We may collect the following categories of personal information:
– **Identifiers**: Name, title, date of birth, gender, unique patient identifiers
– **Contact Information**: Address, email address, telephone number
– **Financial Information**: Payment card details (processed securely by our payment provider), transaction history
– **Special Category Data**: Health information, medical history, genetic data, biometric data, laboratory results
– **Technical Information**: IP address, browser type, device information, usage data through cookies and similar technologies

### 2.2 Special Category Data
Due to the nature of our services, we process special category data as defined by UK GDPR. This includes health information, genetic data, and biometric data. We process this information under Article 9(2)(h) of UK GDPR – provision of health or social care or treatment .

## 3. How We Use Your Information
We use your personal information for the following purposes:

| Purpose | Legal Basis |
|———|————-|
| Providing laboratory services | Performance of a contract |
| Processing payments | Performance of a contract |
| Communicating results | Legal obligation (healthcare provision) |
| Quality control and improvement | Legitimate interests |
| Regulatory compliance | Legal obligation |
| Research (with consent) | Consent |

## 4. International Data Transfers
Certain specialized laboratory analyses may be processed by our trusted partner laboratories in the European Union. When we transfer your personal data to EU countries, we ensure that:
– The European Commission has issued an adequacy decision confirming the country provides an adequate level of protection; or
– We use appropriate safeguards such as standard contractual clauses approved by the UK government

All our EU partner laboratories are contractually bound to protect your data to the same standards as we are under UK law, including UK GDPR and Data Protection Act 2018 .

## 5. Data Retention
We retain personal data in accordance with our data retention policy and legal requirements:
– **Laboratory records**: 10 years from last treatment or as required by UK healthcare regulations
– **Financial records**: 7 years as required by UK tax law
– **Research data**: As specified in research-specific privacy notices

After the retention period expires, we securely delete or anonymize your personal data.

## 6. Your Data Protection Rights
Under UK data protection law, you have rights including:
– **Right of access**: You have the right to request copies of your personal information
– **Right to rectification**: You have the right to request correction of inaccurate information
– **Right to erasure**: You have the right to request deletion of your personal data in certain circumstances
– **Right to restriction of processing**: You have the right to request limiting how we use your data
– **Right to data portability**: You have the right to request transfer of your data to another organization
– **Right to object**: You have the right to object to certain processing activities

To exercise any of these rights, please contact our Data Protection Officer at contact@hilmilab.co.uk.

## 7. Data Security
We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:
– Encryption of data in transit and at rest
– Regular security assessments and testing
– Access controls and authentication mechanisms
– Staff training on data protection
– Business continuity and disaster recovery plans

## 8. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. The updated version will be indicated by an updated “Effective Date” at the beginning of this policy. We will notify you of any material changes by posting the new Privacy Policy on our website and, where appropriate, through other communication channels .