Legal
Last updated
Hysteron Ltd ("Hysteron", "we", "us", "our") is committed to protecting your privacy and to handling your personal data transparently and with care. This Privacy Policy explains how we collect, use, store, share and protect your personal data, including your health data, and sets out your rights under the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 ("PECR").
This Privacy Policy applies to all users of the Hysteron platform, including our marketing website (hysteron.co.uk) and our authenticated application (app.hysteron.co.uk).
Hysteron Ltd is the controller of your personal data.
Company Number: 15774204
ICO Registration: ZB900497
Data Protection Contact: Verity Fotheringham (info@hysteron.co.uk)
We will never sell your personal data. Your health information is sensitive, and it belongs to you.
Our services are intended for adults. You must be at least 18 years old to create an account and use our testing services. By creating an account, you confirm that you meet this requirement.
Our marketing website is publicly accessible. We apply the principles of the ICO's Age Appropriate Design Code to it, including high privacy settings by default, no nudge techniques, and not placing cookies on your device at all.
Account information: name, email address, date of birth and, where you provide them, phone number and postal address.
Home visit address: where you choose home collection, the address at which you would like the phlebotomist to visit. We do not ask for an address where you choose a partner clinic.
Health information: medical history, symptoms, menstrual cycle data, lifestyle information and medication use, provided through our clinical questionnaire. This is special category data under Article 9 of UK GDPR, and we apply the highest level of protection to it throughout our systems.
Ethnicity: where you choose to answer the relevant question in our clinical questionnaire. This is also special category data, and we protect it in the same way as your health information.
Payment information: billing address. Stripe processes your payment card details securely. They are never sent to, seen by or stored on Hysteron's servers.
Communications: any correspondence you have with us by email or through other channels.
Where you hold a monthly Plan, we keep a record of the commercial relationship alongside your health data. This includes:
Recurring payment authority status: whether you have an active recurring payment authority with our payment processor, when you set it up, and a reference to it. We do not hold your card details.
Billing state: which Billing Month you are in, when your next payment is due, whether your account is in good standing, in arrears or paused, whether you are within or beyond your Minimum Term, any Introductory Offer that applies, and your chosen Collection Route. Where you pause your Plan, we record when the pause began, how long it lasts and the revised end date of your Minimum Term.
Payment failure history: a record of any unsuccessful payment, when we retried it and the outcome. We keep this so that we can tell you what is happening to your Plan and resolve any billing dispute.
Your express request record: where you asked us at checkout to begin your service within the fourteen-day cancellation period, we keep a record of that confirmation, including the wording you were shown and when you gave it. We keep this record because it evidences a request that affects your legal rights, and we may need to produce it.
Your test entitlement ledger: how many tests you have been granted, when each was granted and claimed, and the date of your most recent blood draw. The ledger determines whether you can book. We hold the draw date so that we can tell you how long it has been since your last test and what that means for your next set of results.
Website visits: we count visits to our website with Plausible Analytics, which works without cookies and without identifying you. It records the pages visited, with any health-related page addresses made general, and the website or campaign that brought you to us.
App analytics: only if you agree to analytics in your account settings, we record a short code for each step of signing up and booking a test that you reach, and the campaign that brought you to us. This never includes your name, email address, health answers or results.
Device information: IP address, browser type and operating system, which our servers receive when you connect to our website or application.
Advertising measurement: only if you switch analytics on, we also tell Meta and Google that you signed up and when, along with the code their advert added to the link you clicked, so that they can match your sign-up to that advert. See Advertising Partners under Sharing Your Information.
Laboratory results: biomarker results from our accredited laboratory partner, Nationwide Pathology. When Nationwide Pathology returns your results to us, we process them to deliver your health report. We obtain this data from a third party on your behalf, and we inform you of that processing here in accordance with Article 14 of UK GDPR.
Appointment information: appointment details from Nationwide Pathology and its network of clinics and mobile phlebotomists.
Sign-in with Google or Apple: if you choose to sign in with Google or Apple, they share your name, email address and an account identifier with us so that we can create your account and sign you in. Signing in this way also tells Google or Apple that you have an account with Hysteron. Because Hysteron is a women's health service, we only do this with your explicit consent (Article 9(2)(a) UK GDPR), which you give each time you choose the Google or Apple button. Google and Apple are based in the United States, and these transfers rely on the UK Extension to the EU-US Data Privacy Framework. You can stop at any time by signing in with your email address and password instead.
Payment providers: confirmation from Stripe, and where you pay for a Single Test through Klarna, from Klarna, that a payment has succeeded or failed.
UK GDPR requires us to have a lawful basis for every processing activity. We rely on the following.
Performance of a contract (Article 6(1)(b)): to provide our testing service, manage your account and fulfil your orders. Where you hold a Plan, our contract with you is an ongoing relationship, and this basis covers taking your monthly payment, maintaining your recurring payment authority, keeping your test entitlement ledger, telling you when a test becomes available, telling you when a payment has failed, arranging your home visit where you have chosen home collection, and managing any pause or cancellation.
Explicit consent (Article 9(2)(a)): to process your special category data, including your biomarker results and questionnaire responses, in order to deliver your results and health reports. We ask for this consent separately and specifically at registration.
Legitimate interests (Article 6(1)(f)), and research purposes with appropriate safeguards (Article 9(2)(j)): to contribute your pseudonymised health data to our longitudinal research dataset. You can turn research off at any time in your account settings, and you may use Hysteron fully without contributing to research. See Research below.
Consent (Article 6(1)(a) and PECR regulation 22): to send you the Hysteron newsletter and other general marketing emails, where you have opted in.
Legitimate interests (Article 6(1)(f)) and the PECR soft opt-in (regulation 22(3)): to send you Product updates about our own services similar to those you have bought, as described under Communications below. We have carried out and documented a legitimate interests assessment for this processing.
Legitimate interests (Article 6(1)(f)): to keep our platform working and secure, including improving the platform, developing new features, troubleshooting technical issues, and protecting against fraud and unauthorised access to accounts. We rely on this basis only for data that is not health data, and we have balanced our interests against your rights and interests. You may object to this processing at any time (see Right to Object below).
Legitimate interests (Article 6(1)(f)): to count visits to our website without cookies, so that we can understand how people find us.
Consent (Article 6(1)(a) and PECR regulation 6): to record when our marketing emails are opened and which links are clicked, where you agreed to this when signing up to those emails.
Consent (Article 6(1)(a)): to record analytics in our app, where you have switched analytics on in your account settings. You can switch it off at any time.
Consent (Article 6(1)(a)) and explicit consent (Article 9(2)(a)): to tell Meta and Google about your sign-up, where you have switched analytics on in your account settings, so that we can see which of our adverts work. Hysteron is a women’s health service, and an advertising platform that learns you signed up with us could draw conclusions about your health. For that reason we ask for your explicit consent, and we send nothing until you give it. You can switch it off at any time.
Legal obligation (Article 6(1)(c)): to keep financial records for the periods required by HM Revenue & Customs, and to respond to lawful requests from public authorities.
We use your personal data to:
Provide our services: process your orders, manage your Plan, arrange your blood draw, deliver your biomarker results, generate your personalised health reports and enable you to track your results over time.
Communicate with you: send results notifications, appointment confirmations and reminders, billing and entitlement notices and service updates, and respond to your enquiries.
Improve our platform: understand how people find us and where they stop when signing up, so we can make it easier, develop new features and troubleshoot technical issues. We do not use your health data for this purpose.
Measure our advertising: where you have agreed, tell Meta and Google when someone who clicked one of our adverts signs up, so that we know which adverts to keep running.
Keep our platform safe and secure: protect against fraud and unauthorised access. We do this under legitimate interests.
Comply with legal obligations: meet our regulatory obligations and respond to lawful requests from public authorities.
We send three kinds of email, and each is handled differently.
Service messages relate to the agreement you have with us. They include results notifications, account verification and password reset emails, order and payment confirmations, appointment confirmations and reminders, notice that a test entitlement has been granted, notice that a payment has failed, notice of a change to your price, the six-monthly reminder that your Plan is active and how to cancel it, and acknowledgement of any data protection request. We send these under performance of a contract. They contain no marketing, and you cannot switch them off while you hold an account with us, because they tell you about a service you have bought. We send service messages through Mailgun.
Product updates are occasional emails about new tests and improvements to the service you already use. Where you have bought from us, we may send you Product updates under the PECR soft opt-in, provided that we gave you a clear opportunity to refuse them when we collected your details. You can switch Product updates off at any time from your account settings or from the link in any Product updates email, and doing so will not affect your tests or results. We also send Product updates to anyone who has agreed to receive them, for example by turning them on in their account settings or by signing up to our emails.
The Hysteron newsletter contains our articles and news about women's health. We send it only where you have opted in, either when creating your account or by signing up on our website. You can unsubscribe at any time from your account settings or from the link in any newsletter.
We send Product updates and the newsletter through Mailchimp. Each is a separate preference, and switching one off leaves the other unchanged. When you change a preference, we keep a record of the change, the date and time, and the wording you were shown at the time, where one was shown.
Where you agreed to it when signing up, our marketing emails tell us when they are opened and which links are clicked, so that we can see what is useful. Unsubscribing stops this along with the emails.
Unless you turn it off, we contribute pseudonymised health data to a longitudinal research dataset designed to advance understanding of women's health during perimenopause and menopause. We do this on the basis of our legitimate interests in advancing research into women's health, with the safeguards described below.
Important: research data is pseudonymised, not anonymous. We replace your name, email address and other direct identifiers with a coded research identifier, and we generalise details such as your exact age (to an age band) and location (to a region). We retain a secure, separately stored linking mechanism that could in principle reconnect research data to your identity. This mechanism exists so that we can honour your right to have your research data deleted.
Because we retain this linking capability, UK GDPR continues to apply to the research dataset, and all of your data protection rights, including the right to erasure, apply to it.
You can turn research off, or back on, at any time in your account settings. When you turn it off, we immediately exclude all of your data from research use. Turning research off does not affect your access to your own results or the service we provide to you. You may also ask us to erase your research data entirely.
We do not currently have any active research partnerships. We will update this Privacy Policy and notify existing users before any research partnership begins.
We ask for three separate permissions, and you also have a research switch. Each is independent of the others, and withdrawing one does not affect the others.
Acceptance of our Terms and Conditions. This is required to use the service.
Explicit consent to process your special category data in order to deliver your results and health reports. This is required to use the testing service.
Your choices for the Hysteron newsletter and Product updates, as described under Communications above. Neither is required, and every marketing email contains an unsubscribe link.
Research switch: we include your pseudonymised data in our research dataset on the basis of our legitimate interests, as described under Research above. You can turn this off, or back on, at any time in your account settings.
You can also turn app analytics on or off at any time in your account settings. The same switch controls whether we tell Meta and Google about your sign-up.
You can manage your research, analytics and email choices in your account settings at any time. To withdraw your consent to us using your health data, contact us or use "Delete my account" in your account settings. We need this consent to provide our service, so withdrawing it means we close your account.
We will never sell your personal data to any third party.
We share personal data only where necessary to deliver our services. Each provider acts under a data processing agreement or equivalent contractual safeguards.
If we establish research partnerships with universities, academic institutions or other research organisations, research partners will receive only pseudonymised data from the research dataset. They will never receive your name, email address, postal address or any other direct identifier. Any such sharing will be subject to a formal data sharing agreement and, where applicable, research ethics approval. We will update this Privacy Policy and notify existing users before any research partnership begins.
We may disclose your information where the law requires it, in response to a court order or other legal process, to protect the rights, property or safety of any person, to prevent fraud, or to comply with the requirements of a regulator such as the Information Commissioner's Office.
If Hysteron is acquired by or merged with another organisation, your data may transfer as part of that transaction. We will notify you before your data becomes subject to a different privacy policy.
We keep your personal data only for as long as we need it to provide our services and to meet the legal obligations that follow from having provided them.
Where you hold a Plan, our relationship with you is ongoing, so we measure retention from the end of the contractual relationship. The contractual relationship ends on the latest of the date your Plan ends, the date any remaining test entitlement is used or lapses, and the date any outstanding query about your account is closed.
Account and health data: retained for the lifetime of your account. When you ask us to delete your account, we do so within one month of your request. Ending a Plan does not delete your account or your data. You keep your results and history unless you ask us to delete them.
Billing and Plan records: your billing state, payment authority status, payment failure history and test entitlement ledger are kept for the duration of the contractual relationship. If you ask us to delete your account, we reduce these records to the order and payment details described under Right to Erasure below. The date of your most recent blood draw is held with your health data and deleted with it.
Financial records: we keep records of each payment for 6 years after the end of the financial year in which it was made, as HM Revenue & Customs requires. On a Plan, each monthly payment carries its own retention period.
Consent records: kept for the duration of the contractual relationship and for 2 years after it ends, or for 2 years after your account is deleted if later, so that we can evidence the consents you gave or withdrew.
Express request record: the checkout confirmation described under Information We Hold About Your Plan is kept for 6 years from the end of the contractual relationship, because it determines your refund position and the limitation period for any claim arising from it runs from the end of the contract.
Record of a data protection request: where you ask us to delete your account or exercise another right, we keep a record of the request and our reply, for 6 years, so that we can show we responded correctly.
Deletion list: where you ask us to delete your account, we keep your email address on a list of deleted accounts, for 6 years, so that we can delete your data again if we ever need to restore our systems from a backup (see Right to Erasure below).
Research data: unless you have turned research off, your pseudonymised research data is kept for as long as the research purpose continues, subject to your right to turn research off or request erasure at any time.
Marketing preferences: if you unsubscribe, we act on it promptly. We keep a record of your withdrawal for 2 years so that we can demonstrate compliance.
Backups: we keep backup copies of our systems for disaster recovery. Backups are retained for up to three months and are then permanently overwritten. See Right to Erasure below.
Under UK GDPR, you have the rights set out below. We will respond to any request within one calendar month of receiving it. Where a request is complex or you have made several requests, we may extend this by up to two further months, and we will tell you within the first month if we need to.
You may ask for a copy of the personal data we hold about you. Your account dashboard gives you access to your results, questionnaire responses, order history and test entitlements at any time. For a full copy of your data, use "Download my data" in your account settings or contact us at info@hysteron.co.uk, and we will send it to you within one month.
You may correct inaccurate or incomplete personal data through your account settings or by contacting us. You cannot alter your biomarker results, because they are laboratory results, but we will correct any error in the transmission of laboratory data through a documented process. If you believe your test entitlement ledger or billing state is wrong, contact us and we will investigate and correct it.
You can ask us to delete your personal data at any time, using "Delete my account" in your account settings or by contacting us at info@hysteron.co.uk. We will delete it within one month across all of our systems, including the research dataset if you have contributed to it, and confirm to you by email when it is done. The backup arrangements described below apply.
When we delete your account, we delete your results and report files, your questionnaire responses and other health data, your notifications and your profile. We also instruct our processors to delete your data.
We keep four records, because the law requires them, because we need them to defend a claim, or because we need them to make sure your deletion holds:
your orders, reduced to the payment details only (the date, the amount, what was purchased and the payment reference), as required by HM Revenue & Customs.
the record of the consents you gave and withdrew, and the express request you made at checkout, each kept for the period given under Data Retention.
a record of your deletion request and our reply.
your email address, on a list of deleted accounts. We keep nothing else on this list.
None of these records contains your health data, and we use them only for the purposes stated.
Backups. Our systems keep backup copies for disaster recovery for up to three months. We cannot remove one person's data from a backup, so your deleted data may remain in a backup for up to three months after we delete it from our live systems. Backups are encrypted and access-restricted, we never use them for any other purpose, and they are permanently overwritten at the end of the retention period. If we ever need to restore from a backup, we will use our list of deleted accounts to delete your data again before anyone is able to use the restored system.
You may ask us to store your data but not otherwise process it in certain circumstances, for example while we investigate a concern you have raised about its accuracy.
You can ask for your data in a structured, machine-readable format to transfer to another service, and we will send it to you within one month. Use "Download my data" in your account settings or contact us at info@hysteron.co.uk.
You may object to processing we carry out under legitimate interests, including the platform and security processing described under Lawful Basis for Processing. You may object to Product updates at any time, and we will stop sending them. You may object to research use at any time by turning research off in your account settings, and we will stop immediately. Where we rely on consent, including for the newsletter, app analytics and advertising measurement, you may withdraw consent as described below.
Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before you withdrew. You can withdraw consent as easily as you gave it, through your account settings.
You can manage your consents, request a copy of your data and ask us to delete your account from your account settings. To exercise any other right, or if you would rather not use your account settings, email info@hysteron.co.uk. We may ask you to confirm your identity before acting on a request. We do not charge a fee for handling a request unless it is manifestly unfounded or excessive.
We take the security of your data seriously, particularly because we process health information. Our measures include:
encryption of all data at rest and in transit.
role-based access controls, so that only authorised personnel can access personal data, and only the minimum data their role requires.
data protection training for all staff before they are given access to personal data.
No transmission over the internet or method of electronic storage is completely secure. We take all reasonable steps to protect your data and maintain standards appropriate to the sensitivity of the data we hold.
Our system decides automatically whether you can book an appointment. It checks two things: your billing state (whether your account is in good standing) and your test entitlement ledger (whether you hold an unclaimed entitlement). If both conditions are met, booking opens. If either is not met, booking remains closed and your account tells you why and, where relevant, the date on which it will open.
We also show you how long it has been since your last blood draw and what that means for your next set of results. This information helps you decide. It does not prevent you from booking.
Our health reports are also generated automatically, using rule-based interpretation of your biomarker values against reference ranges, your own previous results and your questionnaire answers. They give you information and context. They do not diagnose, confirm, screen for or rule out any condition, and they produce no decision about you.
Article 22 of UK GDPR applies to a decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you. We have assessed the booking decision against that test and concluded that Article 22 does not apply, for the following reasons.
The booking decision is solely automated. Its effect, however, is on the availability and timing of a service you have bought, and not on your legal rights or status. An entitlement that you cannot book today is not lost and does not expire while your Plan is active. Where booking is closed because a payment has failed, it reopens as soon as the payment succeeds, and your entitlement is preserved. The decision involves no exclusion from the service, no pricing consequence and no profiling.
We have considered the arrears condition with particular care. It does not affect any appointment already booked, triggers no fee, creates no debt that we pursue, is not reported to any credit reference agency, and ends as soon as the payment succeeds. We therefore consider that it does not produce a legal or similarly significant effect.
Whether or not Article 22 applies, you may ask a member of our team to review any automated outcome. If you believe your account shows the wrong billing state, the wrong number of entitlements or the wrong date, email info@hysteron.co.uk. We will check it, tell you what we found and correct it if it is wrong.
If we introduce any automated decision-making in future that could produce legal or similarly significant effects, we will update this Privacy Policy, carry out a Data Protection Impact Assessment and put appropriate safeguards in place.
Our website (hysteron.co.uk) does not place cookies or store anything on your device, so there is no cookie banner. We count visits with Plausible Analytics, which works without cookies and without identifying you.
Our app (app.hysteron.co.uk) uses only the essential cookies and storage needed to sign you in and keep you signed in. You can turn analytics on or off at any time in your account settings.
We do not use advertising cookies or tracking pixels on our website or in our app. Where you have agreed, our own servers tell Meta and Google about your sign-up, as described under Advertising Partners. If we ever add advertising cookies or pixels, we will update this Privacy Policy and ask for your consent where the law requires it before doing so.
We store and process your data primarily in the United Kingdom and the European Economic Area. Our service email provider, Mailgun, uses EU infrastructure, and our analytics provider, Plausible, is hosted in the EU.
Some of our providers are based in, or may transfer data to, the United States:
Mailchimp (Intuit Inc.): we rely on the UK Extension to the EU-US Data Privacy Framework, under which Intuit is certified and Mailchimp is a covered service. If that framework ceases to cover the transfer, the International Data Transfer Addendum issued by the ICO, which forms part of our agreement with Mailchimp, applies as a fallback. Mailchimp may also transfer data to other countries in which it or its sub-processors operate, subject to the same safeguards. We have carried out and documented a transfer risk assessment for this processing.
Stripe: we rely on the UK Extension to the EU-US Data Privacy Framework or on the International Data Transfer Addendum, as applicable.
Google (Google Workspace and sign-in with Google) and Apple (sign-in with Apple): we rely on the UK Extension to the EU-US Data Privacy Framework.
Meta (Meta Platforms, Inc.): we rely on the International Data Transfer Addendum issued by the ICO, which forms part of Meta’s terms for advertisers.
Google Ads (Google LLC): we rely on the UK Extension to the EU-US Data Privacy Framework.
If any transfer mechanism we rely on is invalidated, we will put an alternative safeguard in place or move the affected processing to a provider based in the United Kingdom or European Economic Area.
We may update this Privacy Policy from time to time. We will notify you of material changes by:
publishing the updated policy on our website with a new date.
emailing you at your registered email address for significant changes.
asking for your consent again where the law requires it.
If you are unhappy with how we have handled your data, please contact us first at info@hysteron.co.uk so that we can try to resolve your concern.
You also have the right to complain to the Information Commissioner's Office (ICO):
Website: ico.org.uk
Telephone: 0303 123 1113
If you have questions, concerns, or requests about this Privacy Policy or our data practices:
Email: info@hysteron.co.uk
Data Protection Contact: Verity Fotheringham
ICO Registration: ZB900497
Hysteron Ltd, Company Number 15774204