Deleting your data (right to erasure)

You’re in control of your personal data. If you’d like us to delete your Medichecks account, we’ll do that – and we’ll also delete or remove personal identifiers from the information we no longer need.

Sometimes, we must keep certain records for a set period to meet legal, regulatory, or professional requirements. This page explains what we can delete straight away and what we may need to keep and why.

All of this falls within your rights under the UK GDPR (Article 17), sometimes called the “right to be forgotten”.

When you can request deletion

You can ask us to delete your personal data at any time.

In most cases, if you no longer want a Medichecks account, we will delete the personal information we hold about you such as:

• Your account details and contact information
• Reports stored in your online account

When we can't delete everything immediately

There are a few situations where we may need to keep some information for a fixed period:

• Partner laboratory records (test results): our partner laboratories must retain certain medical test records (including test results) for 8 years under professional and legal obligations. These records cannot be deleted before that time has passed.
• Regulatory and tax records: we must keep some transaction and payment records to comply with UK laws. For example, HMRC requires us to keep financial records (such as invoices, payments, and VAT records) for up to 6 years.
• Legal claims: If your information is relevant to an ongoing complaint, investigation, or legal claim, we may need to keep it until the matter is resolved.
• New orders during the deletion period: If you place a new order during the 7-day pending deletion period, your deletion request will be cancelled so that we can process your new test.

Once these obligations end and if no new orders are placed during the 7-day period your remaining data will be securely deleted.

How to request deletion

Contact Customer Care:

• Email: customer.care@medichecks.com
• Telephone: 03450 600 600

To protect your information, we will ask you to verify your identity.

We will confirm we’ve received your request and send you an email confirmation that your deletion will be completed within 28 days.

What we delete

When your deletion is actioned, we:

• Delete personal account data we control, such as contact details, addresses, communications stored by Medichecks.
• Delete reports in your Medichecks account. Anything you can view or download from your online account will be permanently deleted and cannot be recovered.
• Delete all other personal data we hold or remove personal identifiers, unless we are legally required to keep certain records for a fixed period.

Test results in our internal systems

• Laboratory results processed through our internal systems are de-identified. This means we remove direct personal identifiers (such as your name and full date of birth) and replace them with a reference ID, so the results cannot be linked back to you without additional information provided by you.
• The test values (for example, blood test measurements) remain in a non-identifiable form.
• We may use these non-identifiable records for quality assurance and service improvement.
• We don’t use retained records for marketing or profiling.

Deletion from partners and service providers

We use trusted service providers to operate our services, currently including Bloomreach, Shopify, and Zendesk.

• As part of your deletion, we trigger erasure requests to these providers and ensure they are completed as part of our internal process. You do not need to contact them separately.

Our process (step-by-step)

1. Log & confirm - we log your request in our secure system and send you an email confirmation. This confirms that your deletion will be completed within 28 days.
2. 7-day pending period – this gives you time to download any reports or results you wish to keep.
3. If you place a new order during this period, we’ll cancel the deletion request
4. Disable account - after 7 days (if no new orders are placed), we disable your account.
5. Third-party erasure - we send deletion requests to partner systems (Bloomreach, Shopify, Zendesk) and ensure they are completed as part of our process.
6. Final deletion - we permanently delete your personal data in our systems and retain only the limited records required by law.

Backups and disaster recovery

Your personal data will age out of backups in line with our normal backup rotation cycle.

Backups are encrypted and access controlled. We do not restore deleted personal data except in a disaster recovery event; if a restore occurs, your deletion request will be re-applied.

Security and assurance

• Deleted data cannot be accessed through our systems.
• Any records we must retain are restricted and access controlled.
• We do not use any retained information for marketing or profiling.

Partner laboratories (test results)

Where your tests are carried out by partner laboratories, those laboratories must retain certain medical records (including identifiable test results) for eight (8) years in line with professional and regulatory requirements for healthcare providers, including guidance issued by the Royal College of Pathologists.

This retention is required to meet healthcare regulatory obligations and is a lawful exemption under UK GDPR Article 17(3)(b), which provides that the right to erasure does not apply where processing is required to comply with a legal or regulatory obligation.

This does not affect the deletion of your Medichecks account data.

Further information

• For more on your rights, see the ICO’s guidance: Your right to get your data deleted.
• If you have concerns about how we handle your deletion request, please contact Customer Care. You may also contact the Information Commissioner’s Office (ICO).