← Back to the fee note tool

1. Who We Are

NIVHA Laboratory Services Ltd (“NIVHA”, “we”, “our”) is a specialist drug and alcohol testing company. We collect samples, arrange for them to be analysed by ISO 17025 accredited laboratories, provide the reports and attend court where required. Our registered address is Unit 1B, Concourse 1, Catalyst, Queen’s Road, Belfast BT3 9DT.

For any data protection queries, please contact Andy McDonald, Technology Manager, at dataprotection@nivha.net. Andy McDonald acts as NIVHA’s data protection lead; NIVHA has not appointed, and is not required to appoint, a statutory Data Protection Officer.

NIVHA acts as a data controller in respect of the personal data processed for the medico-legal testing services described in this notice.

2. Scope of This Notice

This privacy notice applies to personal data processed by NIVHA in connection with medico-legal drug and alcohol testing — that is, testing instructed for use in family and care proceedings or other legal matters, and private testing commissioned by individuals for personal reassurance. It covers three routes of instruction:

• Health and Social Care Trust instructions — a Trust instructs testing in connection with care proceedings or its statutory duties towards children and families.
• Solicitor instructions — a solicitor instructs testing on behalf of a client, including legally aided instructions.
• Private instructions — an individual commissions and pays for testing directly, typically for personal reassurance or in anticipation of legal proceedings.

Samples are collected at our Belfast and Derry~Londonderry offices, or on site at professional premises by prior arrangement. This notice does not cover workplace testing, court-ordered statutory testing programmes, or general use of the NIVHA website — separate NIVHA privacy notices apply to each of those activities.

3. Who This Notice Covers

4. What Data We Collect

5. How We Collect Your Data

• Through the NIVHA fee note tool: the instructing party (or private client) enters instruction, contact, and donor details when raising a fee note and booking a collection appointment.
• From the instructing party: Trusts and solicitors provide donor details, case references, and instruction documents.
• Directly from the donor: at the point of sample collection we verify identity, take the biological sample, and record the donor declaration and any medication disclosures.
• From laboratory analysis: the accredited laboratories that analyse samples for us generate test results from the collected sample.

6. Why We Process Your Data — Lawful Basis

Processing personal data requires a lawful basis under data protection law. The basis differs by route of instruction.

6.1 Lawful Basis — Article 6 (General Processing)

6.2 Special Category Data — Article 9

Test results, medication disclosures, and related records constitute special category data (data concerning health) under both UK GDPR and EU GDPR. Additional conditions for processing:

Consent and the donor: in Trust and solicitor instructions, our lawful basis for processing is not the donor’s consent — it is the legal claims condition above. However, NIVHA will not take a sample without the donor’s agreement at collection: donors are always asked to confirm they understand and agree to sampling, and a donor declaration is completed as part of chain of custody. For donors under 18, a parent or guardian must consent and be present. Where a private instruction relies on explicit consent, you may withdraw consent at any time before analysis is complete; work already performed remains chargeable.

7. Who We Share Your Data With

We never sell personal data. We never disclose one client’s identity or instructions to another client.

A named list of the providers we use, with the safeguards in place for each, is available on request from dataprotection@nivha.net.

8. International Transfers

Some of our processors are located outside the United Kingdom and the European Economic Area. Where personal data is transferred internationally, we rely on the following safeguards:

Transfer risk assessments are maintained for each processor. You may request a copy of the named processor list and the relevant transfer safeguard documentation by contacting us at dataprotection@nivha.net.

9. Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, subject to applicable legal and regulatory requirements, and in line with our Appropriate Policy Document.

At the end of the applicable retention period, records are securely deleted or anonymised.

10. Your Rights

Under UK GDPR and EU GDPR, you have rights in relation to your personal data. These rights are subject to specific conditions and exemptions.

To exercise any of these rights, submit a written request to dataprotection@nivha.net. We respond within 30 calendar days in accordance with Article 12(3).

11. B Sample Rights

Where the sample collection protocol and sample format permit, a B sample (split or secondary sample) may be retained following collection. If your test result is positive, you may have the right to request that the B sample be analysed by an independent laboratory at your own expense.

The availability of B sample analysis depends on:

• whether the collection protocol for the relevant sample type includes B sample retention;
• whether the sample type and volume are sufficient to permit a split;
• whether the B sample has been stored in accordance with chain of custody requirements.

To enquire about B sample analysis, contact NIVHA at info@nivha.net, or raise it with the party who instructed your testing.

12. Automated Decision-Making

NIVHA does not make any decision about you based solely on automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you (Article 22). Screening results that exceed reporting thresholds are always reviewed and interpreted by a qualified Reporting Officer before any result is reported.

13. Right to Complain

If you are dissatisfied with how NIVHA has handled your personal data, you have the right to lodge a complaint with the relevant supervisory authority:

We would appreciate the opportunity to address your concerns before you approach a supervisory authority. Please contact us at dataprotection@nivha.net in the first instance.