Privacy policy

Last updated: July 2026

Omega-3 Index Test ("we", "our", "us") is committed to protecting your privacy and the security of the personal and health information you share with us. This Privacy Policy explains what information we collect, why, how we use and store it, who we share it with, and your rights under UK and EU data-protection law.

We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. If you are located in the European Union, we also process your data in accordance with the EU GDPR (Regulation (EU) 2016/679).

Our test kit is registered as an in vitro diagnostic (IVD) medical device in the European Union under Regulation (EU) 2017/746. Sample analysis is performed by Masdiag at its accredited laboratory in Poland.

Who is the data controller

Omega-3 Index Test is the controller of your personal data.

  • UK customers — our address: 27 Old Gloucester Street, London WC1N 3AX, United Kingdom 
  • EU customers — sample analysis and data processing by Masdiag, Żeromskiego 33, 01-882 Warsaw, Poland

What information we collect

Personal information you provide directly

  • Identity information: your full name, date of birth, and (where you choose to provide it) sex assigned at birth — used to interpret your result against the appropriate reference ranges
  • Contact information: email address, postal address, phone number (optional)
  • Order information: purchase history, products ordered, payment confirmation (we do not store full card numbers — payment is processed by Shopify Payments or your chosen provider)
  • Account credentials: if you create an account, your password is stored in hashed form
  • Communications: any correspondence you send us (email, contact forms)

Health information (special category data)

Because we provide a clinical testing service, we collect, process, and store health information about you. Under the UK and EU GDPR this is "special category data" and is subject to stronger protections.

  • Sample collection details: date and time of collection, kit barcode, the identity of the individual whose sample is being tested (if different from the purchaser)
  • Test results: your measured omega-3 and fatty acid values, and our laboratory's interpretation against reference ranges
  • Historical results: retained to enable trend tracking across repeat tests
  • Self-reported health information: anything you provide voluntarily when requesting interpretation or support (e.g. medications, symptoms, conditions)

Information we collect automatically

  • Website usage: pages visited, time spent, referring URLs, browser type, IP address, device type — collected via cookies and analytics tools
  • Cookies: first-party cookies for session management and cart persistence; third-party cookies (Shopify, Google Analytics) for performance and marketing analytics, used only with your consent (see "Cookies" below)

Our lawful basis for processing

We rely on the following lawful bases under Article 6 of the UK/EU GDPR:

  • Performance of a contract (Art. 6(1)(b)) — to process your order, deliver your kit, analyse your sample, and return your result
  • Consent (Art. 6(1)(a)) — for marketing communications and non-essential cookies, which you may withdraw at any time
  • Legal obligation (Art. 6(1)(c)) — to meet tax, consumer-protection, and medical-device record-keeping requirements
  • Legitimate interests (Art. 6(1)(f)) — to improve and secure our service, where not overridden by your rights

For health data (special category data), we rely on your explicit consent (Art. 9(2)(a)), which you give when you purchase a test, register your sample at the laboratory portal, and accept this policy at checkout. You may withdraw this consent, though doing so may mean we cannot complete or continue the Service.

Why we collect it

  • To process your order, fulfil shipping, and deliver your kit
  • To analyse your sample and return your result
  • To provide trend tracking across multiple tests over time
  • To respond to enquiries and provide customer support
  • To send transactional emails (order confirmations, shipping updates, result notifications)
  • To send marketing communications, but only with your consent, which you can withdraw at any time
  • To improve our service, website, and customer experience
  • To meet our legal obligations

Who we share your information with

We share your information only with the parties below, and only as necessary.

  • Masdiag (analytical partner, Poland): we share your sample, sample identifier, and identity information (name, DOB, sex) for laboratory analysis at its Warsaw facility
  • Shopify: our e-commerce platform, payment processor, and email provider, processing order, payment, and customer data on our behalf
  • Royal Mail and other carriers: for kit shipping and pre-paid returns — we share your postal address and order reference
  • Email service providers: for transactional and marketing emails (marketing only where you have consented)
  • Cloud storage providers: we store your test history and account information using secure cloud infrastructure

As required by law. We may disclose your information if compelled by law, court order, or a lawful government or regulatory request — including legal process, public-health reporting obligations, tax-authority requests, and IVD post-market surveillance/vigilance requirements for our registered medical device. We will not disclose your health information for any other purpose without your consent, unless required by law or to prevent serious harm to you or another person.

International data transfers

Your data is processed in the UK and the European Union (Poland). Transfers between the UK and the EEA are covered by the UK's adequacy regulations, and transfers within the EEA require no additional safeguards. Where such transfers occur, we put appropriate safeguards in place and a copy is available on request.

How we protect your information

  • All website traffic is encrypted using TLS/SSL
  • Payment data is handled by PCI-DSS compliant processors — we never see or store your full card details
  • Sample identifiers use barcodes rather than your name, so laboratory personnel do not see identifiable personal information without authentication
  • Access to your health information is restricted to authorised personnel on a need-to-know basis
  • Our infrastructure uses encrypted storage and authentication controls
  • We maintain a data-breach response plan and will notify the ICO (and, for EU customers, the relevant EU supervisory authority) within 72 hours of becoming aware of a notifiable breach, and will notify affected individuals where required

How long we keep your information

  • Order and account information: while your account is active, and for 6 years after your last order to meet tax and consumer-protection record-keeping requirements
  • Health information and test results: retained from the date of the test
  • Marketing data: until you withdraw consent or unsubscribe
  • Website analytics: typically 24 months in aggregated form

After these periods we securely delete or de-identify your information.

Your rights

Under the UK and EU GDPR you have the right to:

  • Access — request a copy of the personal and health information we hold (we respond within one month)
  • Rectification — have inaccurate or incomplete information corrected
  • Erasure — request deletion of your data ("right to be forgotten"), subject to our legal retention obligations
  • Restriction — ask us to limit processing in certain circumstances
  • Data portability — receive your data in a structured, commonly used, machine-readable format
  • Object — object to processing based on legitimate interests, and to direct marketing at any time
  • Withdraw consent — at any time, without affecting processing carried out before withdrawal
  • Not be subject to solely automated decision-making with legal or similarly significant effects

To exercise any right, contact us using the details below. You also have the right to complain to a regulator: in the UK, the Information Commissioner's Office (ICO) at ico.org.uk or 0303 123 1113; in the EU, your local data-protection authority. We ask that you contact us first so we can try to resolve your concern.

Marketing and direct communications

We only send marketing communications if you have given consent (typically by subscribing to our newsletter or ticking a consent box at checkout). Every marketing email includes a clear unsubscribe link. Transactional communications (order confirmations, shipping updates, your results) are a necessary part of the service and are sent regardless of marketing preferences.

Cookies

We use essential cookies to provide core functionality (such as your shopping cart), which do not require consent. We use non-essential cookies (analytics and marketing) only with your consent, which you can give or decline via our cookie banner and change at any time through your browser or our cookie settings. Blocking some cookies may affect site functionality.

Children and minors

Our service is intended for adults (18+). We do not knowingly collect personal information from anyone under 18 without the consent of a parent or guardian. A parent or guardian purchasing a test for a person under 18 provides health information about, and consent on behalf of, that minor, and acts as the contact point for results and account management.

Changes to this policy

We may update this policy from time to time. When we make material changes we will notify you by email (if you have an account) or by prominent notice on the Site. The "Last updated" date will always reflect the most recent revision.

Contact us

Omega-3 Index Test
Email: hello@omega3index.co.uk
UK: Masdiag, 27 Old Gloucester Street, London WC1N 3AX, United Kingdom 
EU: Masdiag, Żeromskiego 33, 01-882 Warsaw, Poland

If you have an EU-specific query, you may also contact our EU processing location above.