Privacy Policy

Last updated: 2026-05-04 · Effective: 2026-05-04

This notice explains how Ultrasound Link Ltd (trading as Jeen Health) collects, uses, shares, retains, and protects your personal information when you use our genetic-testing services and our website at jeen.health. It is written in plain English; the defined terms in italics have the meanings the UK GDPR gives them.

Who we are

Jeen Health is a trading name of Ultrasound Link Ltd, a private limited company registered in England & Wales (company number 12147431; registered office: 1st Floor, 36 Spital Square, London, E1 6DY). Ultrasound Link Ltd is the data controller for the personal information described in this notice. We are CQC-registered and operate clinical services through our partner clinic network.

For the avoidance of doubt: all genetic testing, sample collection, clinical counselling, and clinical-result interpretation we provide is delivered under the laws of England & Wales, by clinicians regulated in the UK, operating from CQC-registered premises. Any dispute relating to the clinical service itself (separate from the data-protection rights described elsewhere in this notice) is governed by English law and falls within the non-exclusive jurisdiction of the courts of England & Wales.

For privacy questions, contact our Data Protection point of contact at my@jeen.health - we aim to respond within 5 working days.

What information we collect

We collect different categories of information depending on how you interact with us:

When you visit our website

Standard server logs (IP address, user-agent, referrer, request URL) - retained for 30 days for security and abuse monitoring.
If you create an order: the data you submit at checkout (see "When you order a test" below).
We do not run third-party advertising trackers. We do load Google Maps embeds on clinic locator pages and Trustpilot's review widget - those providers receive your IP address when their content loads.
Anonymous, first-party visit analytics: we count page views to understand which pages are used and how many visitors go on to order. This sets no cookie and stores no name, email or IP address - only a short-lived, daily-rotating identifier derived from your IP and browser that changes every day and cannot be used to identify you or follow you over time. Legal basis: our legitimate interest in improving the service.

When you order a test

Identity & contact: name, email address, phone number, billing/shipping address.
Order detail: which test, variant, quantity, price, order number, payment status.
Payment: we do not see or store your card details. Stripe (our payment processor) handles your card data directly; we receive only a token and confirmation.

When you book an appointment or test

Appointment details: chosen date / time, clinician, telehealth or in-clinic preference, the reason for booking (which test or counselling type).
Booking history: previous appointments, kits ordered, results released - visible to your assigned clinician for continuity of care.
Date of birth and other demographics needed to interpret results clinically.

When you receive genetic counselling and a test

This category includes special category data (Article 9 UK GDPR) and is treated to a higher standard:

Family and medical history you share with our genetic counsellor.
Biological samples (typically saliva, buccal swab, or blood) you provide as part of testing.
Genetic data derived from analysing those samples - variant calls, carrier status, risk scores, and the underlying sequencing data where applicable.
Clinical notes and reports from your counselling sessions and the final test report.

When you contact our team

Communication content: emails, WhatsApp / phone messages, support requests, complaints, feedback, and survey responses.
Identifiers tied to the message: the email address or phone number you wrote in from, the timestamp, and any case reference we assign.
Communications about your clinical care are stored in your patient record (30-year retention); general support enquiries are kept for 2 years from your last contact.

Why we use it (lawful bases)

What we do	UK GDPR basis
Process and fulfil your order, ship your kit, return your results.	Performance of a contract (Art 6(1)(b))
Process payment via Stripe.	Performance of a contract (Art 6(1)(b)) and legal obligation (Art 6(1)(c))
Analyse your sample, store and return your genetic results.	Explicit consent (Art 9(2)(a)) given via the consent form before testing, supported by the healthcare basis (Art 9(2)(h)) for the clinical processing itself.
Communicate with you about your order, results, and follow-up.	Performance of a contract; provision of healthcare (Art 9(2)(h)) for any clinical content.
Fraud prevention, security monitoring, audit logs.	Legitimate interests (Art 6(1)(f)) - preventing payment fraud and protecting customer data.
Comply with legal/regulatory requirements (CQC, MHRA, HMRC, ICO).	Legal obligation (Art 6(1)(c))
Send a one-off post-results invitation to leave a review on Trustpilot.	Legitimate interests (Art 6(1)(f)) - improving our services. You can opt out at any time by replying to the email.

Who we share it with

We share your information only when necessary to deliver the service, comply with the law, or with your explicit consent. Our current sub-processors and partners include:

Payment, communication, and platform providers

Stripe Payments UK Ltd - payment processing. We never see or store your card details. Privacy notice.
Resend Inc. - transactional email delivery (order confirmations, results-ready notifications). Privacy notice.
Trustpilot A/S - review invitations sent after your test concludes (you can opt out by replying to the email). Privacy notice.
Segment.io / Twilio Inc. - server-to-server event routing for the Trustpilot review-invitation pipeline. Privacy notice.
Semble - clinical appointment scheduling and patient-management system used by our clinicians for bookings and consultation notes. Privacy notice.
Railway Corp. & Cloudflare Inc. - hosting and edge infrastructure for both the shop and the marketing site. Customer data processed in EU/UK regions where available.
Microsoft Corporation - Microsoft 365 for staff email and SSO.

Clinical and laboratory partners

Where lab analysis or in-person sample collection is required, we share only the data needed to deliver the service. Where laboratories or clinics carry out the analysis or collection themselves, they may act as independent data controllers for that processing, subject to their own privacy notices, which we'll point you to during your counselling session.

Our clinical-genetics counsellors and midwives - independent registered clinicians who deliver counselling and review your results.
Inuvi - third-party at-home phlebotomy provider used when you choose the home-nurse blood-draw option. Receives only the data necessary to attend at your address and collect the sample.
Laboratory partners - accredited to ISO 15189 or equivalent. The specific lab depends on the test you ordered; we disclose it at counselling. Current panel includes:
- Randox Laboratories Ltd (UK) - clinical analytes and certain panels.
- Fulgent Genetics (US) - broad NGS panels.
- Natera Inc. (US) - NIPT (Panorama) and certain hereditary cancer tests.
- Igenomix S.L. (Spain / international) - reproductive carrier and NIPT panels.
- BillionToOne Inc. (US) - UNITY-branded prenatal screening.
- Eurofins Scientific S.E. (Luxembourg / international) - chromosomal and molecular analyses.

We do not sell your data and do not share your genetic information with insurers, employers, the Home Office, or any commercial third party. We will only disclose information to law-enforcement or regulators if compelled by a valid court order or statutory power.

EU GDPR & our EU representative

We're a UK controller, so the UK GDPR is our primary legal framework. Where we offer testing services to residents of the European Union, we additionally comply with the EU GDPR (Regulation (EU) 2016/679) for their data, including the rights described in the next section.

In line with Article 27 EU GDPR, we have appointed an EU representative for matters concerning EU-resident data subjects:

Name: Naq Cyber BV
Company registration: Registered in The Netherlands, KvK number 75310368
Address: Vlamingstraat 4, Zoetermeer, 2712 BZ, The Netherlands
Contact: Nadia Kadhim - info@naqcyber.com

EU-resident data subjects can exercise their EU GDPR rights either by contacting us directly at my@jeen.health OR by raising a Data Subject Request via our representative using the form on our EU GDPR compliance page.

International transfers

Some of our laboratory partners are based in the United States. When we transfer DNA samples or genetic data outside the UK, we rely on:

The UK's adequacy regulations where applicable (e.g. EU/EEA labs).
Standard Contractual Clauses (the UK International Data Transfer Addendum) plus a transfer risk assessment, for US labs.
Your explicit consent (Art 49(1)(a)) given on the consent form, as a secondary basis.

You can request a copy of the safeguards in place by emailing my@jeen.health.

How long we keep it

Data category	Retention period
Server access logs	30 days
Order data, invoices	7 years (HMRC requirement)
Counselling notes, clinical records, test reports	30 years from date of test, in line with NHS Records Management Code of Practice for clinical genetics records
Raw genetic data (sequencing files, variant calls)	Held by our laboratory partners under their own retention schedules - typically 25–30 years; specific term disclosed at counselling.
Email marketing / review-invitation history	2 years from last interaction, then deleted
Audit logs of admin actions	3 years

Where you ask us to delete your data (see "Your rights" below), we redact identifying information from operational records but retain a sha256 hash of your email plus a redaction record so we can demonstrate to the ICO that the request was actioned. We cannot retroactively destroy data we are legally required to retain (e.g. financial records under HMRC rules).

Your rights

Under the UK GDPR you have the right to:

Access a copy of the personal data we hold about you (a "subject access request").
Rectification - ask us to correct inaccurate or incomplete data.
Erasure - ask us to delete your personal data, subject to the retention requirements above.
Restriction - ask us to pause processing while we investigate a complaint.
Portability - receive a machine-readable copy of data you provided to us.
Object - to processing based on legitimate interests, including review-invitation emails.
Withdraw consent - for any processing where consent is the lawful basis. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

To exercise any right, email my@jeen.health. We respond to all rights requests within one calendar month (extendable to three months for complex requests; we will tell you within the first month if we need the extension).

If you are unhappy with how we have handled your personal data you can complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or by phone on 0303 123 1113.

Marketing communications

We only send marketing or product-update emails when you have explicitly opted in (e.g. by ticking the marketing box on the booking form, or by replying to a survey). You can unsubscribe at any time using the link at the bottom of any marketing email, or by emailing my@jeen.health.

Service-related communications - order confirmations, kit-shipping notices, results-ready emails, appointment reminders, and follow-up clinical communications - are essential to delivering the service you've paid for and cannot be opted out of for the duration of an active order. Once your care episode is complete and the relevant retention windows have expired, these too stop.

CCTV (in-clinic visits only)

Jeen Health's services are primarily digital and at-home. Where you attend a partner clinic for in-person blood collection or clinical services, CCTV is in use in the clinic's common areas for safety and security. The clinic operates that CCTV under its own data-protection notice; ask reception for a copy on arrival or visit londonpregnancy.com.

Our at-home and telehealth services do not involve CCTV.

Cookies

We ask before setting anything that is not strictly necessary. On your first visit a banner appears, and nothing in the analytics, marketing or functional categories runs until you choose. Closing the banner without choosing grants nothing. You can change your mind at any time using the Cookie settings link in the footer of every page.

Your choice is stored in a cookie on .jeen.health, so it applies across everything we run on this domain - the shop, the marketing pages and the Jeen Library - without asking you again.

Strictly necessary

These are set without asking, because the site cannot work without them.

jeen_consent - records the cookie choices you made on the banner. Kept for 180 days, after which we ask again.
shop_session - keeps you signed in to the admin area if you are a Jeen team member. It is never set for customers.
__stripe_mid and __stripe_sid - set on our checkout page by Stripe, our payment processor, to detect fraud. Card payment does not work without them. If you are taken to Stripe's own hosted checkout, Stripe's privacy notice governs that page.

Analytics

Our own visit analytics set no cookie at all - see "When you visit our website" above for how they work.

Separately, Google Analytics 4 (loaded through Google Tag Manager) measures how pages are used and sets its own cookies. It runs on all public pages on this domain, and only once you accept the analytics category.

Marketing

Google Ads conversion tracking and the Meta (Facebook) Pixel, also loaded through Google Tag Manager, tell us whether an advert led to a visit or an order. They run only once you accept the marketing category.

We use Google Consent Mode. Until you accept, Google's tag runs in a restricted mode that stores nothing on your device and cannot identify you; it only begins setting cookies once you have agreed to the relevant category.

Functional

Some content on our pages is served by other companies, which set cookies from their own domains. We hold that content back rather than loading it for you automatically. Each one shows a placeholder with a button, and nothing is requested from the provider until you press it - or, if you have accepted the functional category, until the page loads.

Google Maps - the partner-clinic maps on our location pages.
Doctify - patient reviews shown on product pages.

Our explainer videos are a similar case: we embed them from youtube-nocookie.com and nothing is requested from YouTube until you press play.

Security

Our infrastructure is encrypted in transit (TLS 1.2+) and at rest. Admin access is restricted to allowlisted Microsoft 365 accounts in our organisation, protected by SSO and the access controls our IT environment enforces. Customer database backups are encrypted and access-controlled. We log every administrative action and review the audit trail for unusual patterns. Our laboratory partners are accredited to ISO 15189 or equivalent and operate to the same security standards.

Children

Our services are not directed at children under 18, and we do not knowingly collect personal data from anyone under 18 through our website or checkout. Where a test is ordered for a child, the parent or guardian places the order and provides consent on the child's behalf, in accordance with current clinical guidance.

Changes to this notice

Material changes will be posted at this URL and (where the change affects an existing customer's data) notified by email. The "Last updated" date at the top of this page is the authoritative version stamp.

Contact us

Ultrasound Link Ltd, 36 Spital Square, London, E1 6DY.
Email: my@jeen.health
Phone: +44 20 3870 9099