Privacy Policy

The Diagnostic Initiative Ltd, trading as Diagin, is a company registered in England and Wales (company number 15646555) with its registered office at 61 Bridge Street, Kington, HR5 3DJ, United Kingdom.

For the purposes of the UK GDPR and the Data Protection Act 2018, we are the data controller for the personal data described in this policy, except where we act as a data processor on behalf of an organisation that uses Diagin to order tests for its own people. Where we act as a processor, that organisation’s own privacy notice governs how your data is used, and our contract with them governs what we may do with it.

You can reach us about anything in this policy at customerservice@diagin.co.uk.

This policy covers four groups of people:

• Client organisation users — staff at employers, clinics and other organisations who sign in to Diagin to order diagnostic tests and download reports.
• Test recipients and patients — the individuals a test is ordered for, whether their details are entered by their organisation or by themselves through a secure link we email them.
• Mental health booking visitors — people who request an appointment with a clinician through our mental health pages.
• Website visitors — anyone browsing our public pages or submitting a callback request.

Account and sign-in data

We do not use passwords. To sign in, you enter your work email address and we email you a one-time code. We store your email address, the code and the time it was issued and used, and we set a signed session cookie (_dgtoken) containing your email address, your organisation and whether your account has internal staff access.

Client organisation and contact data

Organisation name, address, postcode, telephone, website and billing details, together with the names, job titles, email addresses, telephone numbers and our account notes for the individuals who act as contacts at that organisation.

Patient and test recipient data

• Identity: title, forename, surname, date of birth, sex at birth and gender.
• Contact: email address, telephone number, home address, city and postcode.
• Clinical: clinical details, current medications and supplements, travel history, the tests requested, sample collection details, laboratory results, reference flags and clinician comments on your report.
• Consent: confirmation that consent to testing has been obtained.

Mental health booking data

Your name, email address, telephone number, the appointment time you request, and any free-text notes you choose to add to your booking. We do not ask for clinical information in that notes field; please share only what you are comfortable sending by email.

Payment data

Payments are taken by Stripe on their own hosted checkout. We never see, receive or store your card number or security code. We store the Stripe customer and checkout session identifiers, the amount paid, any discount applied, and which order the payment relates to.

Technical and usage data

Pages viewed, actions taken in the product (for example signing in, submitting a request or downloading a report), error reports, and session replay of your interactions with our interface. See section 9.

Enquiry data

If you submit the callback form, we collect your name, business name, email address and telephone number.

We only use personal data where the law allows. Our purposes and lawful bases are:

• Providing the testing service — processing test requests, arranging sample collection, producing and delivering reports. Lawful basis: contract, or legitimate interests where the contract is with your organisation rather than with you.
• Booking and managing appointments — confirming, proposing and rescheduling appointments and placing confirmed ones in the clinician’s calendar. Lawful basis: steps taken at your request prior to entering a contract.
• Authenticating you and keeping accounts secure. Lawful basis: legitimate interests in securing our service.
• Taking payment and keeping financial records. Lawful basis: contract and legal obligation.
• Responding to enquiries. Lawful basis: legitimate interests in answering people who contact us.
• Improving and securing the product through analytics and error monitoring. Lawful basis: legitimate interests, and consent where required for cookies and similar technologies.
• Meeting our legal and regulatory duties, including clinical record keeping and accounting. Lawful basis: legal obligation.

We do not sell personal data, and we do not use it to build advertising profiles or to make automated decisions that produce legal or similarly significant effects about you.

Diagnostic results, clinical details, medication and supplement histories, clinician comments and anything you tell us in connection with a mental health appointment are special category data under Article 9 of the UK GDPR.

We process that data on the basis of Article 9(2)(h) — the provision of health care and treatment and the management of health care services — read with Schedule 1, Part 1 of the Data Protection Act 2018, and it is handled by or under the responsibility of people who owe a duty of confidentiality. Where that basis does not apply, we rely on your explicit consent, which you can withdraw at any time by contacting us.

Diagin uses the Google Calendar API so that appointments booked through our mental health pages land directly in the clinician’s practice calendar, and so that we only ever offer you times the clinician is genuinely free.

Whose Google Account is involved

The only Google Account connected to Diagin is the practice’s own account, connected once by the clinician who owns the calendar. Website visitors and client organisation users never sign in with Google, are never shown a Google consent screen, and no data from a visitor’s own Google Account is ever requested or accessed.

The scope we request and why

We request a single scope, https://www.googleapis.com/auth/calendar. Google requires this scope for the two operations we perform: reading free/busy information requires it, and it is also what authorises creating the confirmed appointment event. We request no other Google scope. Diagin does not request or access Gmail, Google Drive, Google Contacts, Google profile data, or any other Google service.

What we read from Google

We call the Calendar free/busy endpoint to retrieve busy time intervals only — the start and end times during which the clinician is unavailable. We do not receive, and we do not store, event titles, descriptions, locations, attendees, invitations or any other content from the clinician’s calendar. Free/busy data is used in memory to calculate the bookable slots shown to you, and is never written to our database.

What we write to Google

When an appointment is confirmed by both parties, we create a single calendar event on the clinician’s calendar. That event contains the appointment start and end times, your name in the event title, your email address as an attendee, and any notes you added to your booking in the event description. Google then emails the calendar invitation to you and to the clinician. From Google we store only the identifier of the event we created, so that we can keep it in step with the booking.

How the connection is stored and secured

The Google credentials (client ID, client secret and the practice’s long-lived refresh token) are held as encrypted environment secrets on our hosting platform, never in our source code and never in our database. Only server-side code can use them; they are never exposed to a browser. Access tokens are short-lived and refreshed automatically. The clinician can revoke Diagin’s access at any time from their Google Account permissions page at myaccount.google.com/permissions, which immediately and permanently ends our ability to read or write that calendar.

Limited Use disclosure

Diagin’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular, we do not transfer or sell Google user data to third parties for advertising, market research, credit assessment or any similar purpose; we do not use it to serve advertisements; we do not allow humans to read it, except with the clinician’s explicit consent for a specific support request, where it is necessary for security purposes such as investigating abuse, to comply with applicable law, or where the data has been aggregated and anonymised; and we do not use Google user data to develop, improve or train generalised artificial intelligence or machine learning models.

We share personal data only with the service providers we need to run Diagin. Each is bound by contract to process data on our instructions, keep it secure and use it for no other purpose:

• Microsoft (Azure and Office 365) — hosting, database and the email we send to you. Receives all of the data described above.
• Google (Calendar API) — appointment name, email address, booking notes and times, as set out in section 6.
• Stripe — payment processing. Receives the payer’s email address, the organisation name and the order reference, and handles card details directly.
• PostHog (EU region) — product analytics and error monitoring. See section 9.
• Trigger.dev — the background job service that sends scheduled invitation emails. Processes recipient email addresses.
• Our website development partner — receives callback enquiries submitted through the contact form, and provides technical support under contract.
• Laboratory and clinical partners — where analysis of a sample or clinical oversight of a result requires it.

We will also disclose personal data where we are required to by law, by a regulator or by a court, and to professional advisers or an acquirer in connection with a sale or reorganisation of our business.

Our hosting, database and analytics are located in the United Kingdom or the European Economic Area. Some of our providers — including Google and Stripe — are based in the United States and may process personal data there or elsewhere outside the UK.

Where personal data leaves the UK, we rely on UK adequacy regulations or on the International Data Transfer Addendum to the European Commission’s Standard Contractual Clauses, together with appropriate technical safeguards. You can ask us for a copy of the safeguards that apply to a particular transfer.

Strictly necessary cookies

We set a single essential cookie, _dgtoken, to keep you signed in. It is HTTP-only, expires after seven days, and cannot be switched off without breaking sign-in.

Analytics

We use PostHog, hosted in the European Union, to understand how the product is used and to detect errors. PostHog records page views, product events, error reports and session replays of interactions with our interface. For signed-in users these are associated with your email address so that we can support you and investigate problems on your account; for other visitors they are associated with an anonymous identifier.

Analytics data is not used for advertising and is never sold. You can prevent analytics collection by enabling the “Do Not Track” setting in your browser, by using your browser’s tracking protection, or by writing to us at customerservice@diagin.co.uk and asking us to exclude you.

• Health records, test requests and reports — retained for 8 years after the date of the test, in line with UK guidance on the retention of adult health records.
• Appointment records — retained for 8 years after the appointment; cancelled and expired holds are removed much sooner.
• Financial and transaction records — retained for 7 years, as required by UK tax law.
• Sign-in codes and session data — codes are valid for 3 minutes; the sign-in log is retained for up to 12 months for security purposes.
• Secure access links — the tokenised links we email to recipients and clinicians expire automatically and are single-use where they change a booking.
• Enquiries — retained for 24 months from your last contact with us.
• Analytics data — retained in line with our analytics provider’s standard retention period.
• Google calendar event identifiers — deleted with the appointment record they belong to.

Where we act as a processor for a client organisation, we delete or return the data we hold for them when our contract ends, unless we are required to keep it by law.

• All traffic to and from Diagin is encrypted in transit with TLS, and our database connections are encrypted.
• Access to client and patient data is scoped to your own organisation; only named administrators can see data across organisations.
• Sign-in is passwordless and one-time-code based, so there are no reusable passwords to steal.
• Links emailed to recipients and clinicians use long, unguessable, time-limited tokens.
• Credentials and API keys are held as encrypted platform secrets, never in source code.
• Reports are generated on our own servers, so patient results are not sent to a third-party document service.

No system is perfectly secure. If a breach affects your personal data and is likely to result in a high risk to your rights, we will tell you and the Information Commissioner’s Office as the law requires.

Under UK data protection law you have the right to:

• Be told how your personal data is used — this policy.
• Get a copy of the personal data we hold about you.
• Have inaccurate data corrected.
• Have your data erased, where we have no overriding legal or clinical reason to keep it.
• Restrict or object to how we use your data, including any use based on our legitimate interests.
• Receive data you gave us in a portable, machine-readable format.
• Withdraw consent at any time, where we rely on consent.

To exercise any of these rights, email customerservice@diagin.co.uk. We will respond within one month. There is no charge, and we may ask you to confirm your identity before we release health data. If your data was entered by your employer or another organisation, we may need to refer your request to them as the controller.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113. We would appreciate the chance to put things right first.

Diagin is not intended for use by children. Test requests are placed by organisations and adults, and appointments are booked by adults. Where a test is arranged for someone under 18, it is arranged through a responsible adult or clinician and the same protections in this policy apply. We do not knowingly collect data directly from children.

We may update this policy as our services change. The date at the top of the page shows when it was last revised. Where a change materially affects how we use your personal data — including any change to the Google API scopes we request or what we do with Google user data — we will tell affected users directly.

The Diagnostic Initiative Ltd
61 Bridge Street, Kington
HR5 3DJ, United Kingdom
customerservice@diagin.co.uk

You can also reach us through our contact page.