This policy explains what personal information we collect, why, who we share it with and your rights. Last updated 6 November 2026.
Who we are
UK Food Intolerance is a trading name for P.I.C International LTD, PO Box 1431, Lincoln, LN5 5AP. We are the controller of your personal information.
Questions about your information: email [email protected].
What we collect
- Your order: name, email address, phone number, billing address, the tests you bought and how you paid.
- Payment: card, Apple Pay, Google Pay, Klarna and PayPal payments are handled by Stripe or PayPal. We never see or store your full card details.
- Your test: your Test ID, hair sample and results (see below).
- Messages: anything you send us by email or through a form, such as the practitioner enquiry form.
- Unfinished orders: if you type your email address at checkout but don’t finish, we save it with your basket so we can remind you.
- How you use the site: pages visited, device and browser, and how you found us. Analytics and advertising cookies are only used if you agree. See our cookie policy.
- Referrals: if you use a friend’s link or code, we record that, so we can apply your discount and credit your friend.
Your hair sample and results
Intolerance results can be health information, which the law treats as especially sensitive. We only process it with your explicit consent, which you give when you register your Test ID on our results portal. You can withdraw it at any time by emailing us. If you do, we’ll stop processing your sample and delete your results.
- Your sample is tested and your results are produced by our testing laboratory, which works for us under a written contract and only on our instructions.
- We use your results only to send you your report and to answer your questions about it.
- We never sell your results or use them for advertising. We never share them with anyone else unless you ask us to, for example to send them to your practitioner.
- Pet test results are about your animal and are not health information about you.
Why we use your information
| What we do | Our lawful basis |
|---|---|
| Take your order and payment, send your instructions and report, answer your questions, handle refunds | To carry out our contract with you |
| Test your sample and produce your results | Your explicit consent |
| Keep order and tax records | Legal obligation |
| Remind you about an unfinished order (up to two emails) | Legitimate interests, and the “soft opt-in” rules for emails about something you started to buy. Every email lets you stop them. |
| Send retest reminders, tips and offers | Your consent, given by ticking the box at checkout. Unsubscribe at any time. |
| Run our refer-a-friend scheme | Legitimate interests (to apply discounts you’re owed) |
| Prevent fraud and keep the site secure | Legitimate interests |
| Analytics and advertising cookies | Your consent, given through our cookie banner |
| Reply to practitioner and business enquiries | Legitimate interests |
Emails we send
Order emails (confirmation, instructions, your report and anything about your order) are always sent, because they’re part of the service. Marketing emails, such as retest reminders and offers, are only sent if you said yes. Every marketing email has a one-click unsubscribe link, or just reply and ask. We keep a record that you unsubscribed so we don’t email you again by mistake.
Who we share it with
We only share what each company needs to do its job for us. They act on our instructions and must keep your information safe.
- 20i hosts our website in the UK.
- Stripe and PayPal take payments, including Apple Pay, Google Pay and Klarna. They use your details to prevent fraud too.
- SendGrid (Twilio) sends our emails.
- Our testing laboratory tests your sample and runs the results portal.
- Google (Analytics and Ads) and Microsoft (Advertising and Clarity), only if you accept those cookies.
- Our accountants and professional advisers, and the police or other authorities if the law requires it.
We never sell your information.
Information sent outside the UK
Some of these companies (Stripe, PayPal, SendGrid, Google and Microsoft) may process information in the USA or elsewhere. When they do, it’s protected by the UK’s data bridge with the USA or by the ICO’s approved contract clauses.
How long we keep it
- Orders and payment records: 6 years after the end of the tax year, as UK tax law requires.
- Test results: 12 months from your report, or until you ask us to delete them.
- Unfinished baskets: deleted after 90 days.
- Practitioner and business enquiries: deleted after 2 years.
- Emails you send us: as long as needed to help you, then no more than 3 years.
- Analytics data: 14 months in Google Analytics.
Your rights
You can ask us to:
- send you a copy of your information
- correct anything that’s wrong
- delete your information (we may need to keep order records for tax)
- stop or limit how we use it, including any marketing
- send your information to you or another company in a common format
- withdraw any consent you’ve given
Email [email protected]. We’ll reply within one month, free of charge. If you’re unhappy with how we’ve handled your information, you can complain to the ICO at ico.org.uk or on 0303 123 1113. We’d appreciate the chance to sort it out first.
Keeping it safe
Our site uses HTTPS, payments are handled by Stripe and PayPal, staff accounts are protected with two-step login, and only the people who need your information can see it.
Changes to this policy
We’ll update this page if anything changes and change the date at the top. If a change affects you significantly, we’ll tell you by email.