Terms, Conditions and Privacy

At freetest.me we are dedicated to safeguarding and preserving your privacy when visiting our site or using our services. This privacy policy, together with our terms of use, provides an explanation as to what happens to any personal data that you provide to us, or that we collect from you.

We update this Policy from time to time so please do review this Policy regularly, and before consenting to future services.Importantly, your information may be shared with third-parties (such as your local NHS Trust) who we partner with to deliver services such as your onward care. This will always be made clear to you when you use our service and is explained in more detail below.

Information About Our Organisation

Freetest.me is operated by Preventx Limited, who is the data controller for the service.

Preventx and its partners make decisions on what data is processed and how this is done.

These decisions are undertaken in accordance with the General Data Protection Regulation (GDPR) and the Data Protection Act 2018.

For all requests regarding the control of your data, please contact our Data Protection Officer:

[email protected]

Preventx Limited
Meadowhall Business Park
Carbrook Hall Road
Sheffield
S9 2QE

The Purposes of Processing

We process your data in order to deliver the freetest.me service to you. You are asked for your consent for us to process your data in order to register with our services, receive test kits, etc.

Lawful Basis for Processing

In order to access our services, we ask for your consent and this is the primary basis on which we process your data.

However, in most cases we process your data in order to provide services for the prevention, diagnosis and treatment of illness in line with the Health and Social Care Act (2012) which are funded via your local authority or NHS Trust.

Additionally, some of the data we collect is processed in the public interest such as to provide mandatory national data to Public Health England.

What Data We Collect

The information that we collect and store relating to you is primarily used to enable us to provide our services to you, which you have explicitly ordered or requested. For example, to request a free sexual health test you will be asked a number of questions, including some personal questions. In some cases, you may opt-out of certain questions.

The information you give will be recorded and includes details such as your name, address, date of birth, contact information (e.g. telephone number).

Special category data may also be collected including items such as ethnicity, gender identity, responses to medical and safeguarding screening questions, medical testing history, details of attendance with health providers that may have provided treatment.

Your data is stored in the UK on secure servers which are firewalled from both the NHS N3/HSCN network and the public internet and all personal data is transferred securely. There is no transfer of data to any countries or international organisations.

In addition to the above, by accessing our website we also collect some information about your visit such as details of the resources that you access, including, but not limited to, traffic data, location data, weblogs and other communication data.

Recipients of your Personal Data

In the case of most of our free testing services, your data will be accessible (along with your results) by the nominated provider for patient management. Such providers will be responsible for your ongoing care, for example if you require treatment or further testing.

A full list of providers has not been included as this may change over time and will depend on your geographic location in the UK and the services you wish to use. Instead, we will explicitly and clearly inform you of the provider responsible for your record before you complete your order.

The provider is usually the funding organisation, or a specialist sexual health charity who are partnered with us to manage patients testing via freetest.me, however this can change over time due to new commissioning and service migrations. Both freetest.me and any providers managing results adhere to strict privacy guidelines in order to protect your data, and all information will be treated in strict confidence by the current or future service providers.

Please be advised that we never reveal information about identifiable individuals to other parties outside of our standard pathway (as described above) but we may, on occasion, provide them with aggregate or anonymous statistical information about our visitors.

Our partners who provide treatment and care (as described in more detail above) can securely access your full personal record and test results. The organisations that we share your information with must comply with data protection law.

The local authorities who fund the service and the Department of Health (including Public Health England) receive anonymised and/or aggregate data only.

Why and When we Contact You

Depending on your contact preferences we may notify you by SMS or email:

• Once that we have dispatched your self-sampling kit.
• Up to three times if you do not return your test kit promptly.
• When your kit has arrived at the laboratory, and when your results are ready.
• Once in the future to remind you to get tested again unless you’ve opted out.

Where you may require treatment or onward care, or in certain circumstances where our system determines you may need additional support (for example if we believe you may be at risk) our partners will make direct contact with you. If our partners are unable to contact you by phone or email, a letter may be sent to the address your kit was dispatched to. If our clinical partners really need to contact you regarding treatment or onward care and are unable to do so (i.e. after a number of unsuccessful attempts) they may contact your GP to ensure you can receive the care you need.

Please note: we are not able to provide any written confirmation of results.

Legal Disclosure

Sometimes we have a legal duty to provide personal information to other organisations.

We may also share your personal information when we consider/believe that there is a good reason to do so, which is more important than protecting your privacy. This doesn’t happen often, but in these circumstances, we may share your information:

• to find and stop crime and fraud; or
• if there are serious risks to the public, our staff or to other professionals.
• to protect a child; or
• to protect adults who are thought to be at risk, for example if they are frail, confused or cannot understand what is happening to them.

For all these reasons, the risk must be serious before we can override your right to privacy.

If we are worried about your physical safety or feel we need to take action to protect you from being harmed in other ways, we or our partners will discuss this with you and, if possible, get your permission to tell others about your situation before doing so.

We may still share your information if we believe the risk to others is serious enough to do so.

If this is the case, we will make sure that we record what information we share and our reasons for doing so. We will let you know what we have done and why, if we think it is safe to do so.

Duration of Storage

We will only hold your personal information for as long as it is necessary to fulfil our legal duties or business purposes.

In line with national clinical guidelines, your record will be retained for a minimum of 8 years after the last recorded entry. If you are aged 16 or 17 years your record will be retained for a minimum of 8 years after your 18th birthday.

After that point, your personal identifying information (e.g. name, house number, street name, telephone number and email) will be removed to provide an anonymised data set for statistical and research purposes only.

Use of Your Data for Research and Service Improvement

To help improve sexual health services and contribute to vital public health research, we may use your information in the following ways. We are committed to ensuring your privacy is protected at all times.

Anonymised Data for Statistics and Planning

We routinely use data that has been fully anonymised or aggregated for statistical purposes. Anonymised data has had all personal identifiers removed so that you cannot be identified from it. This information is used to help us plan and improve our services and may be shared with our NHS and local authority partners, as well as national bodies like NHS England and the UK Health Security Agency (UKHSA), to monitor public health trends.

Ethically Approved Research Projects

From time to time, we may partner with reputable research organisations, such as universities, NHS Trusts, or public health bodies, on specific research projects. This research is always designed to be in the public interest, for example, to develop new tests, improve treatments, or better understand sexual health.

Where these projects use patient data, this is typically de-identified (pseudonymised) data. This means direct identifiers like your name and address are removed and replaced with a unique code to protect your privacy. This type of data sharing only happens under strict controls, including robust data sharing agreements and formal approval from an independent Research Ethics Committee.

Clinical Trials or Specific Studies

In the rare event that a research project requires the use of personally identifiable information, you would be contacted directly with detailed information about the study. Your identifiable data will never be shared for a research trial without your explicit and informed consent for that specific project. You would be given full details of the study, the opportunity to ask questions, and would be under no obligation to participate.

Your Rights

The law gives you a number of rights in relation to what personal information is used by Preventx, and how it is used. These rights allow you to ask us to:

• provide you with a copy of the personal information that we hold about you
• correct personal information about you which you think is inaccurate
• delete personal information about you if you think we no longer should be using it
• stop using your personal information if you think it is wrong, until it is corrected
• transfer your personal information to another provider in a commonly used format
• review automated decision-making processes that have been used to make decisions about you.

The right to withdraw consent and the right to erasure may not apply due to the nature of the services being provided and our basis in law for processing this data. We will consider requests to remove personal identifying information from your record to ensure that the data we do retain is anonymised, while enabling us to meet our statutory requirements.

You have the right to lodge a complaint with a supervisory authority. For independent advice about data protection, privacy and data sharing issues, you can contact the Information Commissioner’s Office (ICO) at http://www.ico.org.uk.

Automated Decision-Making

We use automated decision-making to confirm eligibility for the services you may wish to access, for example based on your geographic postcode of residence and age.

We also use automated decision making, based on national clinical guidelines, to determine whether our services are appropriate for your individual circumstance and to determine which type of test kit is most suitable for you.

If the automated decision-making process determines that you are not suitable for the service, you will be provided with information about accessing care from a physical clinic.

Use of Cookies

A cookie is a small amount of data, which often includes a unique identifier that is sent to your computer or mobile phone (referred to here as a "device") browser from a website's computer and is stored on your device's memory.

We require cookies to be enabled so we can keep track of your progress through the request procedure. No personal or confidential information is stored in cookies, only a temporary and unique identification code which is only active whilst you are visiting the site and deleted promptly after.

Sub-processors

Please note that Preventx uses Royal Mail as a sub-processor. Royal Mail will have access to your name, address and phone number. This is for the purposes of posting you one of our kits and letting you know when your kit will arrive. Royal Mail will be aware that the parcel will come from a Preventx sexual health service. We can confirm that we have the appropriate documentation in place to support this sharing of information and that Royal Mail are held to the same secure standards that you would expect from us. Royal Mail do not have access to any health information.

Laboratory Testing

Your sample will be tested in Preventx's specialist laboratory and in accordance with the laboratories quality system. Standard testing carried out via the freetest.me service is accredited to international standards, and more information can be read in the Preventx Laboratory Services document (https://www.preventx.com/laboratory).

In some cases, we may use non-accredited tests to supplement your screening, however this would only ever be in agreement with doctors of clinicians (for example, pharyngeal swab testing may be recommended but falls outside 'off label' and outside of our accreditation).

Please note that some test samples may be retained by the laboratory after testing for internal studies and verification purposes (such as performing equipment validation). Samples used for wider validation or laboratory studies would always be fully anonymised.

Third Party Links

You may find links to third party websites on our website. These websites should have their own privacy policies which you should check. We do not accept any responsibility or liability for their policies whatsoever as we have no control over them.

Condom

We may include a male condom in your self-sampling kit. This is not something we are required to include, but though it may be useful so have included one CE marked condom free of charge. Some do's and don'ts along with instructions on using a male condom can be found via this link.