Last updated 1 October 2026.
Who we are
BioBloom Life is the trading name of BioBloom Life Ltd (registered in England and Wales as Biobloom Life Limited, company number 17021036). Our registered office is Silverstream House, 45 Fitzroy Street, London, W1T 6EB. We are registered with the Information Commission (formerly the Information Commissioner’s Office), registration number ZC103860.
Who is responsible for your data
BioBloom Life Ltd is the data controller for the personal data we process to provide our testing service: test orders, samples, laboratory results and reports, and the quality and regulatory records that go with them. The referring fertility clinic is a separate controller for its own clinical record of the patient. We do not establish a direct clinical relationship with patients and we do not return results to patients outside the referring clinic’s environment. BioBloom Life Ltd is also the data controller for this website, enquiries sent through our contact form, clinic-portal user accounts, our research questionnaire and follow-up, and the calibration run described below.
What we hold and where it comes from
What we hold depends on how you come into contact with us.
- Patients tested through a clinic. From your clinic: a clinic reference, your date of birth and, if the clinic chooses to add them, your initials or full name; the test ordered; clinical information the test needs, such as sex at birth, height, weight, ethnicity, smoking status, fertility and medical history, and diagnoses; collection details for your sample; and confirmation that consent was taken and, for genetic tests, that genetic counselling was offered. From the laboratories: sample tracking records, results and reports, which can include genetic or microbiome data.
- Patients recorded by a clinic in our portal. A clinic can use our portal to keep treatment records for its patients, whether or not a test is ordered: fertility and medical history, diagnoses, ovarian reserve and semen analysis results, IVF cycles, embryo transfers, and pregnancy and birth outcomes. These come from the clinic. We also use them, in totals and rates, to understand how our tests perform (see how we use it).
- Partners whose sample is tested. The same kinds of information about his sample, and, if he agreed to follow-up, his email address and, if given, his first name.
- People who agree to our research questionnaire. Your name, date of birth and email address, copied from your clinic’s record when you agreed; your answers; any earlier Test Unique ID you give us; and later answers about how your treatment went. See research questionnaire and follow-up.
- People taking part in the calibration run. A participant code, never your name. See the calibration run.
- Clinic and laboratory staff who use our portals. Your name, work email address, organisation and role; for clinicians, your professional body and registration number; sign-in and security records, including multi-factor authentication and a check for sign-ins from a new device or network (we keep the kind of browser and system you used, such as Chrome on macOS, and only a scrambled form of your network that cannot be turned back into an address); and a record of the actions you take in the portals. This comes from you, your organisation and our systems.
- Clinics as customers. Billing contacts and invoices. Invoice lines show order references and tests, not patient details.
- Everyone we email. A record of each email we send (the address, the kind of email and whether it was delivered) and, if you unsubscribe or an email to you bounces, your address on our do-not-email list. This comes from our email systems.
- People who contact us, and website visitors. See contacting us through this website and website visitors, cookies and storage.
Laboratories work from codes: we do not send them your name or contact details.
How we use it, and our lawful basis
Data protection law requires a lawful basis for each use (Article 6 of the UK GDPR) and, for health and genetic data, an additional condition (Article 9).
| Purpose | Lawful basis | For health or genetic data |
|---|---|---|
| Providing and reporting the tests your clinic orders, including quality control and the records laboratories must keep | Our contract with your clinic to provide the service, and our legal obligations (Article 6(1)(b) and (c)) | Health care under the responsibility of a health professional (Article 9(2)(h); Data Protection Act 2018, Schedule 1, paragraph 2) |
| The calibration run | Our legitimate interest in checking that our tests perform as they should before patients rely on them (Article 6(1)(f)) | Public health: ensuring high standards of quality and safety of medical devices (Article 9(2)(i); Schedule 1, paragraph 3) |
| Analysing treatment outcomes that clinics record, across clinics and including patients who had no test, to understand how our tests perform. This produces totals and rates, not figures about any one person | Our legitimate interest in checking how our tests perform (Article 6(1)(f)) | Public health: ensuring high standards of quality and safety of medical devices (Article 9(2)(i); Schedule 1, paragraph 3) |
| Research questionnaire and follow-up | Your consent (Article 6(1)(a)) | Your explicit consent (Article 9(2)(a)) |
| Portal accounts, sign-in security and audit records | Our contract with your organisation, and our legitimate interest in keeping patient data secure (Article 6(1)(b) and (f)) | Not applicable |
| Answering enquiries | Our legitimate interest in replying to you (Article 6(1)(f)) | Not applicable; please do not send health details |
| Website analytics | Our legitimate interest in understanding how the site is used, which you can switch off (Article 6(1)(f)) | Not applicable |
| Invoicing clinics | Our contract with the clinic, and our legal obligations (Article 6(1)(b) and (c)) | Not applicable |
| Answering data protection requests and handling incidents | Our legal obligations (Article 6(1)(c)) | Where health data is involved, the condition that applies to the record concerned |
We make no decisions about anyone by automated means. We do not send patient data to any artificial intelligence service.
The calibration run
Before we offer a test to patients, we check how it performs on samples given by volunteers at partner clinics. This is the calibration run. If you take part:
- Your clinic gives you a participant code. The list that links your code to your name stays locked at your clinic. We and the laboratories never receive it, and samples, forms and records carry the code only.
- We process your code, your samples and the laboratory data from them (including microbiome sequencing data), the collection details, and your answers to a few questions asked at collection, such as recent antibiotics, vaginal products, intercourse, bleeding and contraception.
- No result about you is produced for you or your clinic. Results are used only in batch reports that check how the test performs.
- Leftover samples and extracts are destroyed 12 months after the batch report, unless you agreed to their storage for research.
- To withdraw, tell your clinic. The laboratory then destroys your samples and deletes your data, identified by code, on the clinic’s written instruction.
Taking part is voluntary and separate from your care. Our lawful basis is set out in how we use it.
Research questionnaire and follow-up
Taking part is optional and has no effect on your test, your results or your care.
- How you agree. When your test is ordered, your clinic asks you to complete our research consent form. Each choice on it is separate: research use of your pseudonymised answers and results, to improve our tests and services; email contact for the questionnaire and follow-up; a phone call; storage of your leftover sample for research; and sharing your pseudonymised data with research partners. When a test uses a male partner’s sample, he makes his own choices, and everyone whose sample is tested makes the storage and data-sharing choices.
- Email. If you agree, we email you a personal questionnaire link once your sample reaches the laboratory, and a separate email with your Test Unique ID. About 12 months after your test we may email you up to three short questions about how your treatment went (whether there was a pregnancy and a live birth, and the date of birth if there was), with one reminder a month later.
- Phone. Our emails say that a member of our team may phone you once, about 14 months after your test, if we have not heard back. We do not hold phone numbers on our platform, and we will not phone you unless you have given us a number for that purpose. You can say no at any time.
- The questions cover lifestyle and background (for example height, weight, ethnicity, the first part of your postcode, smoking, alcohol, diet, exercise and stress), medicines, reproductive and medical history, family history and, depending on the test, sexual and gynaecological health, infections and antibiotics. Every optional question can be skipped.
- How answers are kept. Under a research reference, separately from your clinical record. Your clinic never sees your answers, only that you have finished. We may publish aggregated, anonymised findings, which cannot identify anyone.
- Withdrawing. Email research@biobloomlife.com at any time. We then delete your answers, links and follow-up, and send you nothing more. Findings already published in anonymised form cannot be withdrawn.
Your personal questionnaire link
- The link we email you is personal: anyone who has it can open your questions, so please do not forward it.
- It shows the questions for your test and how many are needed. It does not show your name, your results or anything else from your clinic record.
- It works for 90 days, then expires. It stops working once you have finished.
- Answers in progress stay on your device, without your name, until you finish, so you can stop and come back. They are deleted from it when you finish. After 14 days they are no longer used, and they are deleted the next time a page of this website is opened on that device. You can clear them yourself at any time.
- When the link is opened or answers are sent, our server uses your device’s IP address to stop repeated requests. It is kept apart from your answers and deleted after 30 days.
- No analytics run on these pages, and their address is never sent to an analytics service.
Who receives your data
Your clinic. Results and reports go to the clinician who ordered the test, in our clinic portal, once we have released them.
Laboratories. They receive samples and the details the test needs, under codes, and return results to us:
| Laboratory | What it does | Where |
|---|---|---|
| Cambridge Genomic Services | Receives samples, extraction, bioinformatics and the raw data archive | University of Cambridge, UK |
| SMCL | Laboratory work and sequencing, on behalf of Cambridge Genomic Services | University of Cambridge, UK |
| Nuuma Genetics | Performs genetic tests | Alicante, Spain |
| Couriers | Move samples, labelled with codes only | UK and, for genetic tests, to Spain |
Research partners. Only if you chose data sharing on our research consent form, we may share your pseudonymised data with research partners.
Service providers. We use these providers, as our processors, to run this website and service. Each processes data only on our instructions and under a written agreement:
- Supabase: the database, sign-in, file storage and server functions behind the clinic, laboratory and BioBloom portals.
- Lovable: hosting of this website and the portals, and the connector gateway that passes contact-form leads on to HubSpot and billing requests on to Stripe.
- Cloudflare: network delivery and security in front of this website.
- Lovable’s email service: delivery of our account, portal, research and contact-form emails. It sees each recipient’s address and the email, including the text of an enquiry sent through our contact form.
- Our email provider: hosts our mailboxes, including enquiries@biobloomlife.com and research@biobloomlife.com, where contact-form enquiries and emails you send us arrive.
- HubSpot: our customer relationship system. It receives the name, email address, organisation and enquiry type from our contact form, never the message.
- Stripe: invoicing and payments for clinic billing.
- PostHog: privacy-preserving analytics for this website, hosted in the EU.
We also disclose data where the law requires it, for example to a regulator or a court.
Transfers outside the UK
- Spain. Genetic tests are performed by Nuuma Genetics in Alicante. Data sent to Spain relies on the UK’s adequacy regulations for the European Economic Area, and data coming back relies on the European Commission’s adequacy decision for the UK. If either lapses, we will put the UK International Data Transfer Agreement or standard contractual clauses in place.
- Microbiome tests are sequenced and analysed at University of Cambridge laboratories in the UK.
- United States. Some of our service providers are based in the United States or use staff or sub-processors there (for example Cloudflare, HubSpot, Stripe, Supabase and PostHog). Where personal data goes to the United States, we rely on the safeguard in that provider’s data processing terms: the UK Extension to the EU-US Data Privacy Framework where the provider is certified under it, or the UK International Data Transfer Addendum to the European Commission’s standard contractual clauses.
How long we keep it
We keep each kind of record for the period below, then delete or anonymise it. A record under a legal hold (for example a statutory retention duty or a legal claim) is kept until the hold ends.
| Record | How long we keep it |
|---|---|
| Test reports and the records behind them | At least 10 years, or longer if your clinic's licence requires it |
| Laboratory records: sample tracking, run records, controls, results and sign-off | At least 10 years |
| Raw sequencing data | 5 years |
| Sample chain-of-custody log | 8 years |
| Leftover microbiome samples and extracts | Destroyed 12 months after the results (for the calibration run, after the batch report), unless you agreed to research storage |
| Leftover samples for genetic tests, and products of conception | 3 months after the report, then destroyed or returned |
| Genetic results held by Nuuma Genetics in Spain | At least 5 years, as Spanish law requires |
| Embryo testing records | As long as the clinic's HFEA licence requires |
| Research answers and follow-up | Up to 10 years from collection, unless you withdraw sooner |
| Questionnaire links | Work for 90 days, then expire |
| Answers in progress on your device | Until you finish. After 14 days they are no longer used, and they are deleted the next time a page of this website is opened on that device |
| Contact-form enquiries | 2 years after our last contact with you |
| IP addresses used to limit repeated contact-form and questionnaire requests | 30 days |
| Do-not-email list | As long as we need it to make sure we do not email that address again |
| Portal accounts and access logs | 2 years after the account closes |
| Records of the kinds of browser and the networks (scrambled) you signed in from | 13 months after the last sign-in from each |
| Clinic staff and onboarding records | 6 years after the relationship ends |
| Kit orders and logistics | 6 years after the order |
| Invoices | 6 years after the end of the financial year |
| Data protection requests | 3 years after they are resolved |
| Records of personal data incidents | 3 years |
When we must delete data, we do so within 30 days, and from our backups within 6 months.
Website visitors, cookies and storage
Our hosting keeps standard, short-lived server logs, including IP addresses, for security and abuse prevention. We host our typefaces ourselves, so our pages do not call Google Fonts.
Analytics. We use PostHog, hosted in the EU, to count page views, and which tests are viewed, on our public pages. It runs without cookies or any stored identifier, with session recording, heatmaps and automatic click capture switched off. It never runs on the sign-in pages, the clinic, laboratory or BioBloom portals, or the patient questionnaire pages, and page addresses are sent without any query string or fragment. PostHog receives your browser’s IP address when it records a page view. It honours your browser’s Do Not Track setting, and you can switch it off here:
Analytics on this device
Checking the setting for this browser.
Cookies and browser storage. We set no advertising or tracking cookies. This is everything this website stores on your device:
| Name | Type and who sets it | Purpose | How long |
|---|---|---|---|
| __cf_bm | Cookie, Cloudflare | Tells people from automated traffic, to protect the site | 30 minutes |
| __dpl | Cookie, Lovable (our host) | Keeps your browser on one version of the site while we publish an update | About 7 days |
| sb-…-auth-token | Local storage, our portals | Keeps a clinic, laboratory or BioBloom user signed in | Until you sign out. While a portal page is open, you are signed out after 30 minutes without activity; if you close the page without signing out, the sign-in can stay on this device until you sign out, so sign out on a shared device |
| bb-portal-last-activity | Local storage, our portals | The time of your last activity, for the automatic sign-out; it holds only a time | Until you clear your browser's storage; it is not removed when you sign out |
| bb-journey-p-… | Local storage, the patient questionnaire | Answers in progress, without your name, so you can stop and come back | Until you finish. After 14 days they are no longer used, and they are deleted the next time a page of this website is opened on this device |
| bb-analytics-opt-out | Local storage, this page | Remembers that you switched analytics off | Until you switch analytics back on or clear your browser's storage |
The two cookies are set by our hosting to deliver and protect the site, and portal and questionnaire storage only does what you ask of those pages, so none of them needs your consent. You can clear any of them in your browser’s settings.
Contacting us through this website
If you use the contact form we collect the name, email address, organisation, enquiry type and message you provide. We store the enquiry and send it, through Lovable’s email service, to our enquiries inbox so we can reply, and we add your name, email address, organisation and enquiry type, never your message, to HubSpot. The lawful basis is our legitimate interest in responding to enquiries. Please do not include health details; if you do, we use them only to answer you. Your IP address is used for a short time to stop repeated submissions and is not kept with your enquiry. Enquiries are kept for 2 years after our last contact with you.
Your rights
Under UK GDPR you have rights of access, rectification, erasure, restriction and portability with respect to personal data held about you, the right to object to uses based on our legitimate interests, and the right to withdraw your consent at any time (this does not affect what we did before). You can send a request about the data we hold as controller to BioBloom Life Ltd directly, using the details below. We reply within one month; if a request is complex we may extend this by up to two further months, and we will tell you within the first month. We may ask you to confirm your identity first. Your referring clinic holds its own record and can also pass a request on to us. Research participants can write to research@biobloomlife.com.
If you are unhappy with how we have handled your data, please tell us first. You also have the right to lodge a complaint with the Information Commission (ico.org.uk).
Contacting us
For data-protection enquiries, write to BioBloom Life Ltd by email at enquiries@biobloomlife.com or by post to Silverstream House, 45 Fitzroy Street, London, W1T 6EB. About the research questionnaire, write to research@biobloomlife.com.
We update this page when the way we handle data changes. The date at the top shows the latest change.
See also our terms of service and accessibility statement.