Privacy policy

1. Who controls your information

AIS Health Ltd operates Drug Test London.

AIS Health Ltd is the data controller for relevant processing.

Company number: 09835294.

Registered office:

4th Floor, Silverstream House
45 Fitzroy Street
Fitzrovia
London W1T 6EB

Privacy email: enquiry@drugtest.london.

2. Information we collect

We may collect:

• Names, dates of birth and contact details.
• Billing, delivery and transaction information.
• Order numbers and service communications.
• Identification details required for formal testing.
• Consent, authority and chain-of-custody records.
• Samples, laboratory results and related health information.
• Relevant medicines and declared exposure information.
• Employer, solicitor or authorised recipient details.
• Complaints, enquiries and customer-service correspondence.
• Device, browser, cookie and website-usage information.

Payment providers process complete card details securely.

We do not normally receive complete payment-card numbers.

3. Health and special-category information

Testing information may reveal sensitive health information.

UK data law gives this information additional protection.

We process it only when a lawful condition applies.

Conditions may include explicit consent, healthcare assessment or legal claims.

Healthcare processing remains subject to professional confidentiality requirements.

4. Why we use your information

We use information to:

• Process orders and payments.
• Arrange kit delivery and sample collection.
• Verify identity and record consent.
• Request and perform laboratory testing.
• Review, report and securely deliver results.
• Maintain chain-of-custody evidence where ordered.
• Answer questions and resolve complaints.
• Meet legal, regulatory and accounting duties.
• Prevent fraud, misuse and security incidents.
• Improve website performance and customer experience.
• Send marketing where permitted.

5. Our lawful bases

Our Article 6 lawful bases may include:

• Contract: providing services you requested.
• Legal obligation: meeting applicable legal duties.
• Legitimate interests: securing and improving our services.
• Consent: optional marketing and certain processing activities.

Special-category conditions are explained within section three.

You can withdraw consent where processing depends upon consent.

Withdrawal does not invalidate earlier lawful processing.

6. Tests ordered for another person

The purchaser must provide accurate tested-person details.

They must also hold appropriate authority where required.

The tested person may receive separate consent information.

Employers and professional customers may be separate data controllers.

They remain responsible for their lawful processing obligations.

7. Who receives information

We share only information needed for legitimate purposes.

Recipients may include:

• Testing laboratories and collection providers.
• Clinicians and authorised reviewing professionals.
• Shopify and website technology providers.
• Payment, email, hosting and security providers.
• Postal, courier and delivery providers.
• Professional advisers, insurers and auditors.
• Regulators, courts or authorities where legally required.
• Authorised employers, solicitors or nominated recipients.

We do not sell health information.

We do not release results without authority or legal justification.

8. International transfers

Some technology providers may process information outside the United Kingdom.

We use recognised safeguards where required.

These may include adequacy regulations or approved contractual protections.

9. Data retention

We retain information only as long as reasonably necessary.

Retention depends upon legal, clinical, contractual and regulatory needs.

Relevant factors include disputes, safeguarding and professional record requirements.

Accounting records are normally retained for legally required periods.

We securely delete or anonymise information when retention ends.

10. Security

We use proportionate technical and organisational safeguards.

Measures include access controls, secure systems and confidential handling.

No internet transmission method is completely risk-free.

Please contact us immediately about suspected unauthorised access.

11. Cookies and analytics

Necessary cookies support checkout, security and essential website functions.

Optional cookies may support analytics, preferences and advertising.

Use our cookie controls to manage optional choices.

Browser settings can also restrict cookies.

12. Marketing

We send electronic marketing only where legally permitted.

You can unsubscribe using any marketing message.

Service communications cannot always be disabled.

13. Your data rights

Depending upon circumstances, you may request:

• Access to your personal information.
• Correction of inaccurate information.
• Erasure of eligible information.
• Restriction of eligible processing.
• Objection to certain processing.
• Portable copies of eligible information.
• Withdrawal of consent.

Legal exceptions may limit particular rights.

We may verify identity before completing requests.

14. Complaints

Please contact us first about privacy concerns.

You may also complain to the Information Commissioner’s Office.

Visit ico.org.uk/make-a-complaint.

15. Children

Our online store is intended for customers aged 18 years.

Testing minors requires appropriate consent and prior arrangement.

16. Policy changes

We may update this notice when practices or laws change.

The latest version appears on this page.