Biovance

Privacy Policy

BIOVANCE GROUP LTD — PRIVACY POLICY
Effective Date: 15 September 2026
Version: 2.0

  1. Who We Are and How to Contact Us
    Biovance Group Ltd (“Biovance”, “we”, “us”, or “our”) is a company registered in England and Wales. We act as the Data Controller in respect of your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
  • Registered Office Address: 22 Acorn Lane, EN6 4JQ
  • Primary Contact Email: hello@biovance.co.uk
  • Operating Model: We operate as a mobile and digital clinical health practice offering diagnostic blood biomarker analysis, epigenetic profiling, and longevity consultations. We do not maintain a physical public walk-in clinic or direct telephone intake line; all customer support, clinical queries, and statutory data subject rights requests are managed centrally and securely through hello@biovance.co.uk.
  1. Supervisory Authority Registration
    Biovance Group Ltd is registered as a Data Controller with the UK Information Commissioner’s Office (ICO).
    You have the statutory right to lodge a complaint at any time with the ICO, the UK supervisory authority for data protection:

  1. If you have any concerns regarding how your data is handled, please contact us at hello@biovance.co.uk first so we can resolve the matter directly.
  1. Personal Data We Collect
    Standard Personal Data:
  • Identity Data: First name, last name, date of birth, biological sex, and gender identity.
  • Contact Data: Billing address, home or dispatch address for testing kits and mobile phlebotomist visits, and email address.
  • Financial & Transaction Data: Payment card details and transaction records. Card payments are handled via an encrypted, PCI-DSS compliant third-party payment gateway; we do not store full payment card numbers on our internal systems.
  • Communications Data: Correspondence and records of communications sent to or received from hello@biovance.co.uk.
  • Technical Data: IP address, browser type, operating system, and interaction details captured through strictly necessary and consented website cookies.
    Special Category Data (Article 9 UK GDPR):
    Due to the nature of our diagnostic and health optimisation services, we process sensitive health and genetic data:
  • Biomarker & Blood Results: Lipid, hormonal, metabolic, haematological, inflammatory, and nutritional markers processed by our accredited third-party partner laboratories.
  • Biological Age & Epigenetic Data: DNA methylation data, biological aging metrics, and cellular age reports.
  • Genetic Data: Raw sequencing files, polygenic risk scores, single nucleotide polymorphisms (SNPs), carrier statuses, and wellness/trait predispositions.
  • Clinical & Consultation Information: Relevant health history, lifestyle factors (sleep, nutrition, exercise, stress levels) disclosed in pre-assessment questionnaires or consultations, and clinical practitioner notes.
  1. How Your Data Is Collected
  • Direct Interaction: When you purchase a panel, complete digital intake questionnaires, or communicate with us via email.
  • Mobile Phlebotomy Appointments: When a mobile phlebotomist collects your biological sample (venous blood, buccal swab, or saliva) at your designated address.
  • Accredited Laboratory Partners: When test reports and biological metrics are returned to us following laboratory analysis.
  • Automated Technologies: When you interact with our website, via necessary technical cookies and chosen analytical tracking.
  1. Lawful Bases for Processing
    Under UK GDPR, we rely on the following lawful bases: Data Type Lawful Basis (Article 6 UK GDPR) Special Category Condition (Article 9 UK GDPR) Order Fulfilment & Logistics Article 6(1)(b) Contract: Necessary to deliver the testing kits, book phlebotomy, and issue results. Not Applicable HMRC Financial Accounting Article 6(1)(c) Legal Obligation: Mandatory retention of invoicing and transaction records. Not Applicable Diagnostic & Genetic Processing Article 6(1)(b) Contract: Necessary to provide the contracted diagnostic services. Article 9(2)(a) Explicit Consent: Freely given, unambiguous, and informed explicit consent obtained prior to sample processing. Clinical Record Retention Article 6(1)(f) Legitimate Interests: Maintaining accurate clinical history and governance. Article 9(2)(f) Legal Claims: Necessary for the establishment, exercise, or defence of legal claims under the Limitation Act 1980. Marketing Communications Article 6(1)(a) Consent: Freely given opt-in via an un-ticked checkbox. Not Applicable
  2. Human Tissue Act 2004 & Sample Handling
  • Qualifying Consent: In accordance with Section 45 of the Human Tissue Act 2004 (HTA), physical bodily material containing human cells is held and analysed for DNA only with your explicit qualifying consent, gathered prior to sample processing.
  • Physical Sample Destruction: Biovance Group Ltd does not store physical biological samples at 22 Acorn Lane. All biological specimens are couriered directly to accredited diagnostic laboratory facilities. Samples are incinerated and securely destroyed in accordance with UK clinical waste standards within 30 to 60 days of analysis completion, unless strict regulatory accreditation audits require brief holding periods.
  1. Data Sharing and Disclosures
    We do not sell, rent, or trade your personal, medical, or genetic data. Data is shared strictly as necessary with the following entities:
  • Diagnostic Laboratory Partners: UKAS-accredited and CQC-registered laboratories that analyse biological samples and generate diagnostic reports. Laboratories act as independent Data Controllers or joint controllers for the analytical phase.
  • Mobile Phlebotomy Contractors: Certified phlebotomists who receive your name, address, and contact details strictly to conduct home or workplace collection visits.
  • Independent Genetic Counsellors & Clinicians: Only where you explicitly consent to an external medical referral or review.
  • Service & IT Processors: Third-party cloud providers, encrypted communication tools, and payment gateways operating under UK GDPR Article 28 Data Processing Agreements.
  • Statutory & Legal Bodies: Law enforcement or regulatory authorities solely where legally required by UK statute or court order.
  1. Data Retention Schedule
    To balance data minimisation with clinical governance and the Limitation Act 1980 (which sets statutory time limits for clinical negligence and breach of contract claims), our retention periods are:
  • Diagnostic Reports, Biomarkers & Consultation Records: Retained for 8 years following the date of your last consultation or report delivery, matching UK private medical records and clinical governance guidelines.
  • Physical Biological Specimens: Destroyed by partner laboratories within 30–60 days post-testing.
  • Invoices and Financial Transactions: Retained for 7 years in compliance with HMRC statutory audit requirements.
  • Pre-sale Email Inquiries: Retained for 12 months from the date of last correspondence sent to hello@biovance.co.uk.
  • Marketing Data: Retained until you withdraw consent or click “unsubscribe”.
  1. Your Legal Rights Under UK GDPR
    Under the Data Protection Act 2018 and UK GDPR, you have the right to:
  • Access: Request a copy of the personal data held about you (Subject Access Request).
  • Rectification: Request correction of inaccurate or incomplete personal records.
  • Erasure (“Right to be Forgotten”): Request deletion of your personal data. Note: This right does not override Biovance Group Ltd’s legal right to retain clinical records under Article 9(2)(f) for defending potential legal claims.
  • Restriction: Request the restriction of processing while an accuracy or legal dispute is reviewed.
  • Portability: Request the transfer of your raw personal data to another service provider in a structured, machine-readable format.
  • Withdraw Consent: Withdraw consent at any time for data processed under Article 9(2)(a). Withdrawal does not invalidate processing carried out prior to withdrawal.
    To exercise these rights, submit your request in writing to hello@biovance.co.uk. We will verify your identity and respond within one calendar month.
  1. Technical Security Measures
    We enforce rigorous security standards to safeguard special category health data:
  • AES-256 encryption for sensitive diagnostic data at rest and TLS 1.3 encryption for data in transit.
  • Pseudonymisation of test requisition forms sent to third-party processing laboratories.
  • Role-based access controls and mandatory multi-factor authentication (MFA) across all administrative tools.
  • Contractual non-disclosure and confidentiality terms binding all personnel and contractors.
  1. International Transfers
    Data is primarily stored and processed within the United Kingdom or the European Economic Area (EEA). If any technical provider processes data outside the UK/EEA in a jurisdiction lacking a UK Adequacy Decision, we ensure statutory protections are in place via the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses (SCCs).
  2. Marketing Communications
    We only send educational articles, newsletters, or marketing updates if you have positively opted in via an un-ticked consent box. You may opt out at any time by clicking the unsubscribe link in the footer of any marketing email or by emailing hello@biovance.co.uk. Service-related notifications (order tracking, phlebotomy scheduling, diagnostic results) will continue regardless of your marketing preferences.
  3. Children’s Data
    Our testing services are exclusively available to individuals aged 18 years and older. We do not knowingly solicit, process, or collect personal data from minors. If we identify that data from an individual under 18 has been submitted, it will be purged immediately.
  4. Changes to This Privacy Policy
    We may update this policy periodically to reflect operational, laboratory, or legislative amendments. The updated version will be published on our website with a revised effective date. For material changes affecting the scope or handling of special category health and genetic data, active clients will receive direct advance notice via email.
  5. Contact Details
    For all data protection requests, clinical record inquiries, or privacy questions:
  • Legal Entity: Biovance Group Ltd
  • Registered Office Address: 22 Acorn Lane, EN6 4JQ
  • Email: hello@biovance.co.uk
  • Supervisory Authority: Information Commissioner’s Office (ICO) — ico.org.uk