Placeholder — replace with approved text
Privacy Notice
How GI-Cognition collects and uses your personal and health data for testing, results and consultations — including that GI-Cognition's own clinicians may access your results for consultations — and your rights under UK GDPR.
Version 0.0-placeholder · effective 27 October 2026
PLACEHOLDER — replace with approved text.
Privacy Notice for GI Cognition Ltd. Approved wording is supplied by GI-Cognition and published from Admin → Settings → Policies.
How we use your data
| Data | Why we use it | Lawful basis | How long we keep it |
|---|---|---|---|
| Account and contact details | Create and run your account, deliver kits, contact you about orders, results and appointments. | Contract | For the life of the account, then 6 years (to confirm) |
| Consultations, clinical notes and prescriptions | Provide consultations with GI-Cognition's own clinicians, who may also see your test results and order history. | ContractHealth or social care — Art. 9(2)(h) | 8 years (to confirm) |
| Data protection requests and complaints | Handle your data protection rights and complaints. | Legal obligation | 6 years (to confirm) |
| Health questionnaire answers | Help the laboratory and our clinicians interpret your result. | ContractExplicit consent — Art. 9(2)(a) | As medical records: 8 years (to confirm) |
| Marketing preferences | Send occasional marketing emails only if you've opted in (PECR). | Consent | Until you withdraw, then the record of your choice for 2 years (to confirm) |
| Patient details | Identify the person a test or consultation is for, apply age rules and the right reference ranges. | ContractHealth or social care — Art. 9(2)(h) | As medical records: 8 years (to confirm) |
| Payments and invoices | Take payment, issue invoices and keep accounting records. | Legal obligation | 6 years after the financial year (to confirm) |
| Samples, kits and test results | Carry out the test and give you your results securely. | ContractHealth or social care — Art. 9(2)(h) | 8 years (to confirm) |
| Security, sign-in and audit records | Keep accounts and patient data secure, detect misuse and evidence how data is handled. | Legitimate interests | Audit log 6 years, security events 2 years (to confirm) |
| Service emails and notifications | Tell you about your orders, results and appointments (service messages, not marketing). | Contract | 2 years (to confirm) |
You can download your data, correct it, ask us to erase it, withdraw consent and make a complaint from Privacy & Data in your portal. You can also complain to the Information Commissioner's Office (ico.org.uk).
GI Cognition Ltd is the data controller. Contact: 516, 100 High Street, Southgate, London, N14 6BN, United Kingdom. Company No. 10079482.