Compound Testing Services Privacy Notice

Who does this apply to?

This Testing Services Privacy Notice (Privacy Notice) applies to anyone who uses the Testing Services and to anyone who provides information, or begins to provide information, for the purpose of accessing or enquiring about those services.

Relationship with Compound Privacy Notice 

This Privacy Notice supplements Compound’s general Privacy Notice (Compound Notice), which also continues to apply to all information collected by Compound, including in relation to the Testing Services.  Words defined in the Compound Notice or the Compound Terms and Conditions have the same meaning in this Privacy Notice.  To the extent there is any inconsistency between this Notice and the Compound Notice in relation to information handled in relation to the Testing Services, this Privacy Notice will prevail.

Relationship with Pathology Provider 

The Pathology Provider is Randox Laboratories Ltd, with whom we partner to provide the Testing Services.  All users acknowledge that when using the Testing Services, they enter into a separate agreement with the Pathology Provider.  You acknowledge that your information will also be handled by the Pathology Provider separately, according to the Pathology Provider’s Privacy Notice, which they will also communicate to you.

How do we collect personal data

Within the Testing Services, we collect personal information in multiple ways: when you provide it directly to us (eg by filling in our questionnaires), when it is shared by a third-party to whom you have provided it (eg, the Pathology Provider), or when we collect it automatically (eg when you connect a wearable device to the App).  For more information on how Compound collects your information, please see the Compound Notice.

What personal data do we collect?

In addition to the personal information collected elsewhere in your Compound experience (as set out in the Compound Notice), within the Testing Services we collect some or all of:

Identity: First and last name, date of birth, gender
Contact: Address, email address, phone number
Health: Your blood sample and all the information which may be ascertained or derived from it, according to the suite of tests or analysis that you order
Other: Any other information that you provide to us at any time, as well as the full range of information outlined in the Compound Notice
‍

Why do we collect this information?

1. To offer and provide the Testing Services to you, including to receive your test results from the Pathology Provider, to analyse and structure those results (including via third-party software providers leveraging artificial intelligence), to provide you with your report (including sharing your results to Partner Prescribers and healthcare practitioners for analysis.
   
   Legal basis for this data usage:  Contract (where an inability to use such data will mean we may not be able to provide the Testing Services). Consent (for use, and sharing, of your health data)

2. To communicate with you.  Including to communicate with you about our services, to provide customer support and/or to answer any questions you have asked us.
   
   Legal basis for this data usage: Contract, Legitimate interests (to administer our business) 

3. To send you marketing that you have asked us to or we think you will like:
 To send you marketing, promotional information, or reminders about services or products that you have expressed an interest in. Where you consent, we may tailor this to what suits you based on the information we collect about you.
   
   Legal basis for this data usage: Consent

4. To improve Compound and your experience with Compound:  To improve Compound or any of Compound's brand group companies’ products and services, including analytics, research and development, or to otherwise manage our business, including our website.
To improve and personalise the services we do or may in the future provide to you (for example, your results may be used in your consultations with Partner Prescribers to inform their treatment choices, or to ensure other Compound features are suitable for you).
   
   Legal basis for this data usage:  Legitimate interests (to improve our business); Consent (to process your health information)
   ‍

5. To enable us to comply with the law: 
To comply with any legal or regulatory obligations or requirements that apply to us.
   
   Legal basis for this data usage: Legal obligation
   ‍

6. To manage our business relationships:  To manage the contract or business relationship we either have with you.
   
   Legal basis for this data usage: Legitimate interests (to manage our contracts and business relationships); Contract
   ‍

7. To enforce our rights where needed:
 To seek professional advice, to enforce or protect our rights, to establish and defend legal claims; to conduct investigations or take action in relation to crime and fraud prevention, risk management, and violation of our terms and conditions for services.

   
   Legal basis for this data usage: Legitimate interests (enforcing or protecting our legal rights)
   ‍

For more information on what these legal bases mean, see the Compound Notice.

‍

Who do we share your data with?

Sometimes it is necessary for us to share your personal data with third parties. Your personal data is shared only when we consider it to be necessary and according to the safeguards, and for the purposes, detailed in this privacy notice. We will never disclose your data unless we have a lawful basis to do so.

Partner Prescribers or other clinicians

We need to share your personal data with the Partner Prescribers (as defined in our Terms and Conditions), as well as other suitably qualified clinicians engaged by us, so they can carry out the analysis of your data needed to provide the services to you.  To ensure continuous care across the platform, your data will be available to both those clinicians providing diagnostic services, as well as clinicians involved in your Compound treatment more broadly, such as those who may prescribe you medication. This includes sharing some or all of the health data you provide.

Your GP

Where you have provided consent for us to do so and/or in accordance with legal and regulatory obligations & standards, we share your personal data with your GP for the purposes of providing them with information about your treatment.

Third party service providers

We share your personal data with various third-parties that we rely upon to perform a variety of services on our behalf, and to help grow and improve the Compound business.  This includes third-party pathology providers, software providers involved in the transformation and presentation of your data and insights, IT service and cloud network providers, payment system operators, companies who provide marketing software that we use (eg, email and social media platforms), third parties who carry out identity checks on our behalf, our professional advisors, and any other organisations that provide us with technical and support services.

Our group companies

We will share personal data in certain circumstances with other companies across the group of companies that we and the Compound brand is part of.

Regulators or other authorities

We will share your personal data where we are legally required to do so or where we think this is required and we are permitted to do so, for example to respond to a request for cooperation from a relevant authority.

Other third parties to protect us

We may share your personal data as required in order to help prevent fraud or to protect or enforce our rights or the rights of any of our group companies.

Other parties as part of a corporate transaction

If it is proposed that we are to merge with or be acquired by another business in the future, we may share your personal information with potential purchasers, where this is necessary, or the new owners of the business or company.
‍

Overseas transfers of personal data

From time to time, we may transfer your personal data to parties outside of the UK, e.g. to our group companies in Australia or to third party service providers with servers located in the United States, Europe or Asia.

Where we do so, we ensure a similar degree of protection is afforded to your personal data as in the UK. We do this by sending your data to countries that the UK has deemed to provide essentially equivalent protection or by entering into UK approved standard contractual clauses (including the European Union standard contractual clauses alongside the UK addendum) with the relevant party.

‍

Other

As a service within your use of Compound more broadly, other relevant terms from the Compound Notice continue to apply.  For example for the following, please see the Compound Notice: 

• How do we protect your data?
• How long do we keep your personal data?
• Cookies
• Your rights

‍

‍Contact us

‍Your experience with Compound is important to us.  If you have any questions, concerns or complaints about this Privacy Notice, or how we handle your personal data, please contact our Privacy Team at privacy@eucalyptus.vc. We always try to respond within a reasonable period.

For customer service related queries, including cancelling your treatment or unsubscribing, please contact our Patient Experience team at hello@Compound.co

‍

‍Changes

‍We reserve the right to change the terms of this privacy notice from time to time, and will notify you of any material changes. We also encourage you to check the website periodically to make sure you are aware of our current privacy notice.

‍Last updated: October 2025

‍