Privacy policy – Bowel Cancer Test

Controller: Pop Up Docs Limited, registered in England, company number 13147400, 28-29 Wilcox Close, London, SW8 2UD.
CQC provider ID: 1-11854805327.
Contact: hello@bowelcancertest.co.uk. Last updated: August 2026.

Not yet legally reviewed. This is an accurate description of how the service actually behaves, written to be checked by a data protection adviser rather than published as it stands. The ICO registration number, the named data protection contact, the DPIA and the processor agreements with Stripe, Semble and TDL all need completing before launch.

The short version

The suitability questions on the order page and the symptom checklist run entirely in your browser. Your answers are never sent to us, never stored, and never logged.
We collect only what is needed to post you a kit and identify your sample: name, date of birth, sex, contact details and delivery address.
No health information is collected by this website. Your medical history is taken by the GP during the consultation and is held in the clinical record in Semble, not on the site. We remain responsible for that record.
Your card details go directly to Stripe. We never see or store them.
We do not sell your data, we do not share it for advertising, and we do not add you to a marketing list without asking.

What we collect and why

What	Why	Lawful basis
Name, date of birth, sex	To identify your sample correctly at the laboratory and to create your clinical record	Article 6(1)(b) contract, and Article 9(2)(h) health care
Delivery address	To post your kit	Article 6(1)(b) contract
Email and phone number	To confirm dispatch, send your result and arrange your consultation	Article 6(1)(b) contract
A timestamp confirming you completed the suitability questions	To record that the check was done. Your answers are not recorded, only that you finished	Article 6(1)(f) legitimate interests, clinical safety
Your test result and the GP report	To provide your result and the care that follows it	Article 6(1)(b) contract, and Article 9(2)(h) health care
Payment reference	To reconcile your order. Only an order reference goes to Stripe, never clinical information	Article 6(1)(c) legal obligation, financial records

Who we share it with

The Doctors Laboratory, to analyse your sample. They receive the identifying details printed on the request form.
Semble, the practice management system your clinical record is held in. Semble is our processor, which means they store and handle the record on our instructions. The record itself remains ours as controller, and our duties towards it do not transfer to them.
Stripe, to take payment. Stripe receives your payment details and an order reference. Stripe does not receive any clinical information.
Your NHS GP, if your result is raised, so that they can act on it. This happens with your consent, which we ask for at the point of ordering.

We do not sell your data and we do not share it with advertisers or data brokers.

How long we keep it

Unpaid or abandoned orders: 48 hours, then deleted. These hold a name and a delivery address and nothing clinical, so there is no reason to keep them.
Clinical records, meaning your result, your GP report and the notes from your consultation: 8 years after your last contact with us, in line with the retention schedule in the Records Management Code of Practice for Health and Social Care.
Financial records: six years, as required for tax purposes.

Where these actually sit. This website holds no clinical information at all. Your result, report and consultation notes live in Semble, and your card details live with Stripe. That is a fact about storage rather than about responsibility: Pop Up Docs Limited is the data controller for all of it, both are our processors acting on our instructions, and the retention periods above apply to the record wherever it is kept.

We cannot delete a clinical record on request within that period. Regulation 17 of the Health and Social Care Act 2008 regulations requires a registered provider to securely maintain accurate and complete records, and the retention periods in the Records Management Code are minimums rather than targets. You can still ask for a copy, ask us to correct anything inaccurate, and object to uses that are not part of your care.

Your rights

Under UK GDPR you can ask us for a copy of your data, ask us to correct it, ask us to delete it, object to how we use it, or ask us to restrict its use. Some of these are limited where we have a legal duty to retain clinical records. Write to hello@bowelcancertest.co.uk and we will respond within one month.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

Cookies and tracking

To complete. This section must describe what actually runs on the live site. If any analytics, advertising pixel or session recording is added, a compliant consent banner is required before it loads. Nothing of that kind is present in the current build.

Security

The site is served over HTTPS. Clinical information is held in Semble rather than on this website. Card details are handled entirely by Stripe and never reach our systems. The internal order dashboard is not publicly accessible.