How we handle your information.

This website is operated by IVL Healthcare Ltd, trading as InstantVitaLabs, a company registered in England and Wales (Company No. 17391494), registered office: 35 Gorseyfields, Droylsden, Manchester, M43 6DZ. For the personal data collected through this website and its enquiry forms, IVL Healthcare Ltd is the controller.

For any privacy query or to exercise your rights, contact clinic@instantvitalabs.co.uk.

This website is an information and enquiry website — it is not a clinical record. Some services are delivered with, or by, separate regulated organisations, such as partner clinics or a registered pharmacy (for example, Pelican Pharmacy, operated by Medicstar (UK) Limited, a separate company). Booking, health questionnaires, test results and clinician review take place through the relevant service pathway or an external clinical booking platform, not through this website's enquiry forms.

Who is responsible for your clinical information (as controller, joint controller or processor) depends on the specific service and the arrangements in place. The responsible organisation will provide its own privacy information when you book or attend that service.

Directly from you, when you use our enquiry forms or email us:

• Name
• Email address
• Telephone number (optional)
• Clinic or business name and role (clinic enquiries)
• Service or area of interest
• Anything you choose to include in your message

From partner clinics, where applicable: business contact details of clinic staff for partnership and service administration.

Technical data: our hosting provider processes basic request information (such as IP address and browser type) needed to deliver and secure the website.

Information about health is special category data under UK GDPR. Our enquiry forms are designed for general and business enquiries only. Please do not send detailed medical records, test results or emergency information through our enquiry forms or by email. If health information is needed for a service, it will be collected through the appropriate clinical pathway, where the responsible organisation will rely on a suitable condition under Article 9 UK GDPR and the Data Protection Act 2018.

If you choose to include limited health information in an enquiry, we will use it only to respond to you and will not use it for any other purpose.

• Responding to enquiries — Article 6(1)(f) legitimate interests (answering questions about our services), or Article 6(1)(b) where you ask us to take steps before entering into a contract.
• Clinic partnership administration — Article 6(1)(b) contract, or Article 6(1)(f) legitimate interests in developing and managing business relationships.
• Running and securing the website — Article 6(1)(f) legitimate interests in keeping the site available, secure and free from abuse.
• Legal and regulatory obligations — Article 6(1)(c) where we must keep or disclose records by law.

Where we rely on legitimate interests, we have considered that the processing is limited, expected and does not override your rights. You can object at any time.

We do not sell your data or share it for third-party marketing. We use trusted service providers acting on our instructions (processors), including:

• Website hosting and infrastructure providers
• Transactional email delivery provider (to deliver form submissions to our inbox)
• Secure database hosting, where clinic partnership enquiries are stored for our partnerships team
• An AI service used by our partnerships team to help draft replies to clinic enquiries (drafts are reviewed by a person before sending)
• Microsoft 365 business email, where enquiries are received and handled

With your agreement, or where needed to respond to your enquiry, we may pass your details to a partner clinic or the relevant service provider. We may also disclose data where required by law or to regulators.

Some of our service providers may process data outside the UK. Where this happens, we rely on UK adequacy regulations or appropriate safeguards such as the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses.

Clinic partnership enquiries submitted through our form are also stored securely so our partnerships team can follow up; access is restricted to approved team members. Enquiries are kept only as long as needed to respond and for a reasonable follow-up period, then deleted or anonymised. Business partnership records are kept for the duration of the relationship and as required for legal, tax and accounting purposes.

We use appropriate technical and organisational measures, including encrypted connections (HTTPS), restricted access on a need-to-know basis, and server-side validation of form submissions.

This website uses only strictly necessary storage required for it to function and stay secure. We do not use advertising or analytics cookies, and we do not load third-party tracking scripts. Links to external sites (such as LinkedIn or booking platforms) take you to services that apply their own cookie and privacy policies. If we introduce non-essential cookies in future, we will ask for your consent first and update this notice.

Under UK GDPR you have the right to:

• Access the personal data we hold about you
• Have inaccurate data corrected
• Have your data erased, where applicable
• Restrict or object to certain processing
• Data portability, where applicable
• Withdraw consent, where processing is based on consent

To exercise any of these rights, email clinic@instantvitalabs.co.uk. We will respond within one month.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113. We would appreciate the chance to address your concerns first.

General and privacy enquiries: clinic@instantvitalabs.co.uk

Clinic partnerships: partnerships@instantvitalabs.co.uk

We may update this notice from time to time. Material changes will be shown on this page.