Automatic deletion of your data after eight years

At Medichecks, we keep your data only for as long as necessary to meet our legal, medical, and regulatory obligations.

In line with the UK GDPR and healthcare regulatory requirements, we securely delete your personal data and remove personal identifiers once it is no longer required.

This page explains how our automatic data erasure process works once your account has been inactive for eight years.

Why eight years?

Medichecks and our partner laboratories are required to keep medical test records for eight years to meet healthcare regulations and professional standards. This is to make sure your results are available if they ever need to be reviewed and to support the safe, regulated delivery of our services.

Once eight years have passed and your account has remained inactive, we begin the automated data erasure process described below.

The eight-year erasure process

When your account has been inactive for eight years, our automated system begins the deletion process.

You will receive three email notifications to allow time to download your information or keep your account active.

1. Initial notification (28 days’ notice)

We will send an email informing you that your data is scheduled for deletion in 28 days.
During this notice period you may:

• Download your reports or results, or
• Place a new order, which will automatically cancel the deletion and keep your account active.

2. Reminder notification (7 days before deletion)

If no new order is placed, we will send a reminder email seven days before your data is deleted.

3. Final notification (on the day of deletion)

On the day of deletion, we send a final email confirming that your personal data will be deleted, and personal identifiers removed from our systems that day.

If you place a new order at any point during this process, the deletion will be cancelled.

What happens to your data

Deletion and de-identification

When the deletion date arrives, our automated system performs the following actions:

• Your account is disabled in our internal systems.
• Direct personal details such as your name, address, date of birth, email address, and telephone numbers are removed from our systems.
• Reports, documents, and correspondence held by Medichecks are permanently deleted.
• Only limited, non-identifiable system records are retained to maintain the integrity of our systems.

Internal system records and test results 

• Laboratory test result values stored in our internal systems are de-identified by removing personal details.
• These de-identified results may be used for quality assurance, service improvement, and statistical analysis.
• They are never used for marketing or profiling and cannot be used on their own to identify you.

Erasure from our trusted partners

We securely delete your data from:

• Bloomreach
• Shopify
• Zendesk

These deletions are completed through controlled API integrations and monitored within our internal systems.

You do not need to take any action.

Audit confirmation

Our systems record the completion of each deletion activity.
Any exceptions are investigated and resolved by our technical teams.

Backups and disaster recovery

• Deleted data will age out of encrypted backups as part of our standard retention schedule.
• Backups are highly restricted and used only for operational continuity.
• If a system restoration ever occurs, your deletion will be re-applied to ensure deleted data is not reinstated.

After deletion

Once the process is complete:

• Your personal data will no longer be directly identifiable in Medichecks systems.
• Anonymous or aggregated data may continue to be used for statistical or modelling purposes.
• If you wish to use Medichecks again, a new account will be required.

Partner laboratories

Partner laboratories retain identifiable medical test records for eight years to meet their own legal, regulatory, and professional obligations.

Once their retention period expires, they are required to securely dispose of those records in accordance with applicable healthcare regulations and standards.

This deletion schedule is managed independently by each laboratory and aligns with the same retention principles that govern Medichecks’ own processes.

Further information

• For more on your rights, see the ICO’s guidance: Your right to get your data deleted.
• If you have concerns about how we handle your deletion request, please contact Customer Care. You may also contact the Information Commissioner’s Office (ICO).