Privacy Policy

For Singapore services:

For United Kingdom services:

The responsible Camtech entity for other regions will be identified in the applicable product or regional notice.

Depending on the service, we may collect identity and contact details, account and order information, payment and delivery details, health and wellness information, test results, genetic or biomarker information, photographs, biological samples, device information, usage data, cookie information and communications with us.

Health, genetic and biometric data are treated as special category / sensitive personal data and are handled with additional protections described below.

If you provide information or a sample relating to another person, you must have the necessary authority and consent.

We use personal data for the purposes below. Where the UK GDPR applies, the lawful basis for each purpose is shown in brackets; where the Singapore PDPA applies, we rely on your consent or an applicable exception under the PDPA.

• Provide products, services, reports and consultations [performance of a contract].
• Process orders, payments, deliveries and sample returns [performance of a contract].
• Analyse samples and provide test or wellness information [performance of a contract; for health and genetic data, your explicit consent].
• Provide customer support and maintain account security [legitimate interests; legal obligation].
• Prevent fraud, improve our services and meet legal obligations [legitimate interests; legal obligation].
• Send marketing communications where permitted and, where required, with your consent [consent; legitimate interests].

For special category data (health, genetic, biometric), we additionally rely on your explicit consent, or on grounds relating to health/medical services or substantial public interest as permitted by law.

We may use aggregated or anonymised information, which no longer identifies you, for quality assurance, statistics and service improvement.

Genetic, health and biological-sample information is handled as particularly sensitive. We use it only for the stated service, quality assurance, safety, legal requirements or a separately consented purpose.

We do not sell identifiable genetic information or test results to advertisers, employers, insurers, data brokers or unrelated commercial organisations.

We will not use identifiable genetic information, biological samples or uploaded health images to develop or train artificial-intelligence or machine-learning models (including general-purpose AI systems) unless we have a valid lawful basis and, where the law requires it, your separate explicit consent. This restriction does not prevent us from using fully anonymised or aggregated data that can no longer identify you.

Samples and results are retained only as long as reasonably necessary for the relevant service, quality checks, investigations, legal requirements or separately consented purposes:

• Biological samples are securely destroyed once analysis is complete and any short re-test window has passed, typically within 30 days, unless a longer period is required by the applicable product, accreditation standard or law (for example, accredited relationship tests may require retention for up to 6 months).
• Test results are retained for up to 10 years to meet clinical record-keeping and legal requirements, after which they are securely deleted or anonymised.

Where a specific product or consent notice states a different period, that period applies.

Genetic and wellness reports are informational and are not, by themselves, a medical diagnosis.

Some test and wellness results are generated using automated analysis of your sample or data. These results are reviewed or validated by qualified personnel or laboratory processes before being issued and are not solely automated decisions that produce legal or similarly significant effects on you. Where any such solely automated decision-making does occur, we will tell you and offer your rights under applicable law, including the right to request human review.

Our services are not directed to children. We do not knowingly collect data from anyone under 13, in either the United Kingdom or Singapore, without parental or guardian consent. Where a service is available to a minor, it must be arranged and consented to by a parent or legal guardian, and we process the minor’s data only on that basis. If you believe we hold a child’s data without proper authority, contact us and we will investigate and delete it where required.

We may share necessary information with laboratories, healthcare professionals requested by you, payment and delivery providers, technology and hosting providers, customer-support providers, security and analytics providers, Camtech group companies, and regulators or authorities where legally required.

Some recipients may be located outside your country. Where we transfer personal data internationally, we use the safeguards required by applicable law — such as transfers to countries with an adequacy decision, UK International Data Transfer Agreements (or the UK Addendum to the Standard Contractual Clauses), or comparable contractual protections meeting the requirements of the Singapore PDPA. You may request further information about these safeguards using the contacts above.

We retain personal data only as long as reasonably necessary for the purposes described in this policy, including legal, accounting, quality, safety and dispute-resolution requirements. Indicative periods: account and order records for up to 10 years after your last transaction (to meet tax, accounting and clinical record-keeping obligations); marketing preferences until you unsubscribe; sample and result retention as set out in the Genetic information section.

When information is no longer required, we securely delete or anonymise it, and securely destroy remaining biological samples where applicable. We use reasonable administrative, technical and physical safeguards, but no method of storage or transmission is completely secure.

We maintain procedures to detect, investigate and respond to personal data breaches. Where a breach is likely to result in a risk to your rights or is otherwise notifiable, we will notify the relevant regulator and, where required, affected individuals without undue delay and within the timeframes set by applicable law, including notification to the Personal Data Protection Commission and affected individuals under the Singapore PDPA, and to the Information Commissioner’s Office within 72 hours under the UK GDPR.

Depending on your location and applicable law, you may request access to, or correction, deletion, restriction or portability of, your personal data, withdraw consent, object to certain uses, request destruction of a remaining sample, and unsubscribe from marketing.

To exercise any right, contact us using the details above. We may need to verify your identity and may retain information where required by law. We aim to respond within one month (UK) or within the timeframe required under the PDPA (Singapore); we will tell you if we need longer.

If you have a complaint, please contact Camtech in the first instance so we can try to resolve it. This does not affect your right to complain to the applicable regulator at any time, including the Personal Data Protection Commission in Singapore (pdpc.gov.sg) or the Information Commissioner’s Office in the United Kingdom (ico.org.uk).

We use necessary cookies to operate our sites, and, where permitted and (where required) with your consent, functional, analytics and advertising cookies. You can manage or withdraw your cookie consent at any time through our cookie banner or browser settings.

We may update this policy when our services, technology, suppliers or legal obligations change. The updated version will be published with a new effective date, and we will notify you of material changes where required by law.