2.1 Service contract: The contract relates to the COVID 19 testing service provided by Randox to you the customer, in exchange for the price paid by you.

2.2 Testing kit: The service contract includes the provision of a testing kit as part of the testing service, known as a ‘Randox PCR Home Sample Collection Kit’, (‘PCR’) or ‘Randox CertiFly Antigen test kit’ (‘Antigen’).

2.3 Timeframes

2.3.1 Randox will ensure your testing kit is delivered within 6 working days of the date of order. If you have chosen ‘click and collect’, the testing kit can be picked up immediately.

2.3.2 In the case of a PCR test, Randox will notify you of your test result within 48 hours of receiving of your sample at our testing laboratory.

2.3.3 In the case of an Antigen test, Randox will notify you of your test result within 24 hours of sample testing.

3.1 Randox will provide you with instructions in your Testing Kit.

3.2 You should endeavour to use the testing kit in accordance with this set of instructions. If you do not follow these instructions, this may result in Randox being unable to test your sample or report your result.

3.3 Randox will use reasonable care and skill when testing the sample, and will perform all other aspects of the service to the same standard, including our dispatch, reporting and after-sales customer support.

3.4 You will be required to provide the following information to Randox:

• the unique registration number (URN) on your test kit;
• your name as per passport;
• your date of birth;
• your gender identification;
• your email address (it is very important that this is recorded correctly so that your results are sent to the right email address);
• your country of residence
• your nationality;
• your telephone number;
• the date your sample was collected;
• your current address (including postcode);
• your national insurance number (optional);
• your NHS/employee number (if applicable);
• your vaccination status;
• your confirmation that 14 days have passed since your last vaccination date (if applicable);
• your date of arrival;
• your ethnicity;
• confirmation of your form of transport for arrival into the UK;
• your flight/train/boat number for arrival into the UK.

3.5 Where required by law, the result and any personal data will be reported to the Health Security Agency (UKHSA) or other required governing bodies as per the Public Health (Control of Disease) Act 1984 and the Health Protection (Notification) Regulations 2010 or any other relevant or equivalent law.

3.6 This information will only be used for the purposes of providing the service to which you have consented, in line with data protection law. Please see our Privacy Policy for more details.

3.7 Please note that we are required to report all Day 2 and Day 8 testing orders made and cancelled to the Department of Health and Social Care, pursuant to paragraph 18A(1) of the Health Protection (Coronavirus, International Travel and Operator Liability) (England) Regulations 2021.

3.8 For the return of PCR tests Randox recommends the use of our Drop Boxes, if available to you. Please do not leave samples unattended in the vicinity of a drop box if the drop box is full.

3.9 Randox is not a travel agent and cannot provide travel advice.

3.10 There is a very small chance the test result could be returned as inconclusive and in such cases you may be required to retest. Where Randox is at fault for the inconclusive result, it will provide a replacement test free of charge.

4.1.1 You have a right to cancel the contract within 14 days of the date of order to receive a refund. Where Randox has begun to supply the service, the amount of the refund may be reduced to account for the value of services already supplied to you up to the point of cancellation. This amount is calculated by comparing the value of the services already supplied to you to the total paid for the service contract. The process for requesting a refund is detailed at 4.2.

4.1.2 You are also entitled to a refund under consumer law where Randox does not perform the contract with reasonable care and skill or within the required time period (e.g. delivering the testing kit within 6 working days of order, providing results within 48 hours of laboratory receipt for PCR tests, or confirming results within 24 hours of testing for Antigen tests). The process for requesting a refund is detailed at 4.2.

4.1.3 The rights set out in 4.1.1 and 4.1.2 do not affect your statutory rights or other rights under common law. These include the right to seek damages for reasonably foreseeable losses resulting from negligence or breach of contract by Randox.

4.2.1 4.2.1 If you wish to obtain a refund, you should send the following contact form by email to covidcustomersupport@randox.com.
To Randox Health London Ltd. 143-149 Great Portland Street, London, W1W 6QN, I/We* hereby give notice that I/We* cancel my/our* contract for the supply of the following service:
Order number:
Ordered on: [DD/MM/YYYY]
Name:
Address:
Date: [DD/MM/YYYY]
[*] – Delete as appropriate

4.2.2 If you are cancelling an order for a Day 2 or Day 8 testing kit, please note that we are required to report this cancellation to Department of Health and Social Care.

As updated November 2021.

5.1 As a customer of Randox, we will collect what is known as personal data about you. Personal data is information from which you, as an individual, can be identified. This policy outlines how the relevant Randox company you interact with will use, store and protect any personal data that you provide or that we otherwise hold about you.

5.2 Where you are an NHS worker, or have otherwise obtained your COVID 19 test through the NHS, the relevant Randox company collecting your personal data and providing the testing is Randox Labs. Randox Labs acts as what is called a processor of personal data on behalf of the UK Department of Health and Social Care (the DOH). This means that the DOH is the organisation that decides the purposes for which your personal data is used and the way in which it is processed, and Randox Labs acts on its behalf, and in accordance with its instructions, as a service provider. The relevant DOH privacy policy is available here: https://www.gov.uk/government/organisations/department-of-health-andsocial- care/about/personalinformation-charter. Where you have obtained your COVID 19 test privately, then the relevant controller of personal data (i.e. the organisation that decides the purposes for which and the way in which your personal data is dealt with) will be Randox Health.

5.3 Unless indicated otherwise, this policy sets out how Randox will use, store and protect any personal data we collect or generate about you for both private tests and public tests.

5.4 The personal data we collect or hold about you

We will collect personal data as part of our online testing kit registration process. Registration is essential for all testing and reporting of results to proceed, and it is essential that you complete these details, and confirm your acceptance of this policy, personally.

The information we collect during registration includes:

• the unique registration number (URN) on your test kit (it is very important that this is recorded correctly to ensure that your sample is correctly matched to your online registration);
• your name;
• your date of birth;
• your gender identification;
• your email address (it is very important that this is recorded correctly so that your results are sent to the right email address);
• your country / nationality; Your telephone number;
• the date your sample was collected;
• your full home address (including postcode);
• your national insurance number (optional);
• your NHS / employee number (if applicable); and
• your Vaccination Status.

5.5 We will not collect any information which we, or relevant third parties, do not need.

5.6 Once your swab sample has been returned to us, and it has been tested for COVID 19, our systems will automatically generate a report which shows our findings (the Report). This Report will include some of the personal details that you have provided to us about yourself. We will also hold this information in a centralised database. Please note that there are limitations inherent in the sample collection and testing process, detailed in the test instructions that were provided to you when you received your test kit. It is important that the personal data we hold about you is accurate and current, and we cannot be held responsible for incorrect data that is provided by you. Please keep us informed if your personal data changes during your relationship with us. If you fail to properly provide all requested data or provide incorrect data we may be unable to provide testing or notify you of your results. There is also a risk that third parties could be inadvertently provided with your data if, for example, you have not correctly entered your email address, or your email servers are compromised.

How Do We Use That Information?

5.8 We will only use your personal data when the law allows us to. Most commonly, we will use your personal data on one or more of the following grounds:

1. Where we need to perform the contract that we have entered into with you (in the case of Randox Health in respect of private tests).
2. Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
3. Where we need to comply with a legal obligation (including the terms of our contract with the DOH, in the case of Randox Labs in respect of NHS tests).

5.9 We do not rely on consent as a basis for processing your personal data, unless you have requested a private COVID-19 test from Randox Health, in which case you may withdraw your consent to processing at any time by contacting us at dpo@randox.com.

5.10 Where we are using your personal data that identifies your health data, we are doing that either on the basis of your explicit consent, your vital interests, for public interest, medical diagnostic reasons or preventative or occupational health reasons. Generally, Randox will use the data you provide to test your swab samples for COVID-19 and notify the results to you as the registered user of the kit via the Report. A copy of the Report will be sent by email to the email address you provided to us when you signed up through our registration portal.

5.11 After your sample has been sent to us, please make sure to regularly check your emails (including any junk or spam folder) for any email attaching the Report. Please note that we are not responsible for the security of any domains in respect of email addresses you have given us. If you believe you have received a Report in error, please contact us at COVID19@randoxhealth.com immediately. Additional information, including home address, is necessary for notifying the relevant public health or other Government authorities of the results of your test, if we are requested to do so.

5.12 Personal data required for COVID-19 testing (including test results) is held on controlled computer systems. Currently, our registration portal is securely maintained on Microsoft Azure via Microsoft’s UK-based servers in accordance with their standard terms and privacy policy, which are available at: https://www.microsoft.com/enie/trust-center/ product-overview.

5.13 As a controller or processor of personal data, Randox and its affiliated companies must process your information fairly and lawfully. We will also process your data in accordance with the instructions of the relevant authority and the terms of our contract.

5.14 We also collect, use, and share Aggregated Data for any purpose. Aggregated Data could be derived from your data but is not considered personal data as this it will not directly or indirectly reveal your identity.

5.15 We will not use any personal data that we collect for marketing purposes unless you have separately signed up to receive marketing communications from us.

This version three of this policy was last updated on 9 August 2021. Historic versions of this policy can be obtained by contacting us.