Privacy Notice

1.  Magna Laboratories – Who we are 

Magna Laboratories Limited (we, us, our) is a provider of haematology and toxicology services for testing of human blood samples and as such is the central testing laboratory for some Patient Monitoring Services for clozapine and provides analysis of a selection of therapeutic drugs outside of such schemes. As a consequence of these activities, we obtain personal information about the patients or subjects from whom the samples are obtained (hereinafter referred to as Patients) and the professional and contact details of the health care providers or customers who request the analysis to be performed by us, hereinafter referred to as HCPs). Magna Laboratories collects and processes information, as received from HCPs and Patient Monitoring Services using a Laboratory Information Management System (LIMS). The information we collect about Patients concerns personal data (identifying information, e.g. name, date of birth and NHS or other identification number). The information we collect about HCPs concerns personal data (identifying information, e.g. name, professional registration number and workplace contact details) In accordance with applicable data protection legislation, Magna Laboratories is a data controller for the personal information collected as part of our contract with HCPs and special category personal data (i.e. health and treatment information) resulting from analysis of Patient samples. This special category personal data relating to Patient’s health is shared with the requesting HCPs according to the contract (e.g. Patient Monitoring Service, consultant, pharmacist). Magna Laboratories is a data processor for the personal information collected as part of our contract with the Patient Monitoring Service, for the sole purpose of performing services for them.

1.1 Contact Details 

Magna Laboratories Limited
Unit 5 Chase Industrial Estate
Alton Road,
Ross-on-Wye,
Herefordshire,
HR9 5WA
United Kingdom

Telephone: 01989 763333 (UK)
Email: info@magnalabs.co.uk or magnalabs.info@nhs.net

Please contact us by email, if you have any questions about our privacy policy or the information we hold about you or your patient(s). 

1.2 Data Protection Officer and Legal Representative 

The Data Protection Officer is Patricia Collins, Quality Manager who can be contacted via the address above or email to: DPO@magnalabs.co.uk.

The legal representative is Willem van Rijn, Commercial Director who can be contacted via the address above.

1.3 Legal Entity Address 

Magna Laboratories Limited
Unit 5 Chase Industrial Estate
Alton Road,
Ross-on-Wye,
Herefordshire,
HR9 5WA
United Kingdom 

2. ZTAS Central Testing Laboratory and Leyden Delta BV 

The necessity for Magna Laboratories to collect and process information is based on our need to ensure the results we report for the blood samples we analyse are allocated to the correct Patient and reported to the correct HCPs. The lawful basis under applicable data protection legislation for Magna Laboratories to request healthcare providers to provide personal data of their patients or themselves is that the processing is necessary:

• for compliance with Magna Laboratories legitimate interests (i.e. our contractual obligations with the Patient Monitoring Services and HCPs who request us to perform analyses on the blood samples they send to us);

For the processing of special category data (i.e. health data of patients) the processing is necessary:

• for the purposes of the provision of healthcare / treatment.

3. What information do we collect and how will it be used?

The following personal and special category data of Patients is collected and / or processed by Magna Laboratories:

• Name, date of birth, gender, NHS (or other unique identification) number, blood samples received, blood test results, and, where applicable, monitoring service details (patient identification number (PIN), treatment status, registration date) and the HCP information associated with them (details of their consultant, treatment location, sampling location, and dispensing pharmacy).

Additionally, from HCPs responsible for the care of the patient, we collect or hold:

• Name, business address and contact details (telephone and email).
• Registration number in the relevant professional register (e.g., GMC, GPC or PSNI).

All of this information is necessary to ensure the results of analyses performed at Magna Laboratories are reported for the correct Patient (person from whom the blood sample was collected) to the correct HCP to support treatment decisions. The data are collected from the HCPs responsible for sending samples to us or provided to us by the Patient Monitoring Service.

3.1 Patient Data

• sufficient patient details are required to enable a Patient’s correct identification
• the Patient’s blood test result history is used to aid the interpretation of blood results, due to potential individual variations in result values and is held for future reference by HCPs as an aid to their treatment making decisions.

3.2 Healthcare professional data

• a professional registration number is used to aid in identification.
• the contact details of the healthcare professional are required to enable Magna Laboratories to send the analysis report to them and contact them when required (e.g. to alert them of rejected samples or out of range analytical results, invoicing and service information).

3.3 Anonymous and Pseudo-anonymised data use

• The data collected in LIMS and / or Patient blood samples may be used for Magna Laboratories, the Patient Monitoring Service (or sponsors whether or not associated with the Patient Monitoring Service) to undertake research. The use of data for research purposes may or may not be related to a specific monitoring service and/or services connected to it. In any situation where Magna Laboratories uses data and / or blood samples for research purposes, appropriate safeguards will be applied to ensure that the rights and freedom of the data subjects are adequately protected. This will mean amongst other, that no direct identifiable information will be used. The outcome of research may be published. Patients or HCPs cannot be identified in any publications resulting from research.
• Whenever possible, samples / data will be anonymised so the patient or HCP cannot be identified, in most cases the sample / data will be assigned a unique investigation number (pseudonym),
• Anonymised or pseudonymised data and / or blood samples may also be used for internal process optimisation within Magna Laboratories (e.g. using samples and results for QC or calibration or for internal research on stability of samples).

The lawful bases for Magna Laboratories to process the personal data of HCP and patients represent legitimate interest and serves the public interest as such research is aimed at improving analytical quality or gaining a better understanding of conditions treated, the safety and efficacy of services and to improve treatment or analytical services for other HCPs and patients.

3.4 How data are collected

• Where the analysis arises from Magna Laboratories’ contract with the Patient Monitoring Service, the details of Patients treated with clozapine and the details of their associated HCPs (i.e. the Patient Monitoring Service patient and HCP details) are provided by the Patient Monitoring Service.
• Where sample analysis is requested directly to Magna Laboratories by the HCP, the HCP is responsible for informing us of the Patient details and relevant HCP details and any changes to these, as required. This information is taken from the sample tube, examination request form and other additional sources (e.g. email).

3.5 How data are processed

• Blood analysis results, Patient and HCP information are compiled and stored in the Laboratory Information Management System (LIMS) in support of our processes (sample registration, including linking to patient and HCP details, analysis, linking results to sample and to patient, evaluation of results and reporting, etc.). We have safeguards in place to ensure compliance with relevant data protection legislation.

4. How we keep records confidential and access to them restricted

4.1 Systems

All the information Magna Laboratories collects about health care professionals and their patients is processed in accordance with applicable data protection legislation. Magna Laboratories has the appropriate technical and organisation measures in place to secure the personal information we collect and to protect it against unauthorised or unlawful use and accidental loss or destruction. Please note in particular that:

• Magna Laboratories has registered with the United Kingdom Information Commissioner’s Office [under registration reference Z2802679].
• Magna Laboratories trains its staff in respect of working with personal
• Magna Laboratories staff members who undertake data processing owe Patients a duty of confidentiality equivalent to that of a health professional.
• The processing of personal and special category information takes place in accordance with documented internal procedures that ensure consistency, accuracy and confidentiality of the
• We will only share and provide access to personal data to the minimum extent necessary, subject to confidentiality restrictions where appropriate and on an anonymised basis wherever
• We use a secure database system (LIMS) to store personal information, which is password protected, makes use of strong encryption technology and back-up This is an internal system within Magna Laboratories and is not accessible externally.
• All information collected from the Patient Monitoring Service, and vice versa, is encrypted upon transfer over internet using a https:// connection. This means that even if information is intercepted upon transfer, the information cannot be related back to personal information and will appear as meaningless code.
• Where Magna Laboratories uses external parties for any of our services related to blood sample analyses that requires access to personal information for which Magna Laboratories holds responsibility as the data controller, Magna Laboratories requires that this party has adequate technical and organisational security measures in place to safeguard the confidentiality of data whilst they perform such activities.

4.2 Access

Magna Laboratories operates a ‘need to know’ policy with respect to access-rights to their database systems containing personal information of Patients and HCPs. In particular:

• The information held on the LIMS database system is only accessible to Magna Laboratories staff via unique, password protected logins.
• Access to the reporting portal is restricted to authorised employees and healthcare providers registered with the Patient Monitoring Service in specified roles (e.g. Consultant or Clozapine Pharmacist).
• As far as practicable, communications sent by Magna Laboratories over email are pseudonymised, using only the Patient’s initials, date of birth and/or monitoring system number as the patient
• Analysis reports are only sent to recognised HCPs responsible for the care of that
• Requests for analytical results over the telephone are only given to identified HCPs. The Patient identity information is always provided by the HCP making the request and not given by Magna Laboratories staff.
• If a Patient or HCP makes a subject access request for their personal data this will be
• Analytical results are not given to members of the Patient’s family, friends or members of the general public.

4.3 Record retention and disposal

• Any electronic information collected as part of Magna Laboratories analytical services is kept for a minimum of 30 years.
• The hard copy analysis request forms [which contain Patient and HCP data] are held for at least one month for full blood count examinations and toxicology
• Hard copy request forms for pre-printed sticky labels which contain Patient information are held for at least 3 months.
• All hard copy documents that contain any personal information are destroyed in a secure manner by a registered waste contractor.
• The blood sample tubes [which contain Patient identification data] are held for up to one month and are then disposed of securely, as clinical waste, by a registered contractor.

5. Who do we share information with?

5.1 Healthcare providers

Information is shared with healthcare providers responsible for the patient, via the reporting portal or via communications [standardised or in response to a request by the HCP] (see Section 4).

5.2 Patient Monitoring Service

Exchange of electronic Patient registration information and blood result records between the Patient Monitoring Service and Magna Laboratories takes place over secure connections.

5.3 Service providers used in support of the Magna Laboratories business activities

Magna Laboratories makes use of service providers for the support and maintenance of IT database systems in which personal information is held.

Information pertaining to Patients whose blood samples have been analysed by Magna Laboratories is held in a reporting portal. The database is hosted on secure servers located within secure premises. The support of the system is provided by an external company.

5.4 Referral Laboratories

Magna Laboratories uses referral laboratories to provide a back up for FBC and analytical services in case of emergency when we cannot provide our normal service. Samples are sent to each of these laboratories regularly to ensure they are providing an acceptable service. Patient samples sent to referral laboratories are identified only by a unique laboratory number, which cannot be readily connected to the patient by the referral laboratory but can be by Magna Laboratories. Therefore, these are classified as pseudonymised data.

6 Data protection rights of individuals and access to patient information

6.1 Data protection rights of individuals

Individuals from whom data are controlled by Magna Laboratories (including Patients and healthcare providers) have certain rights under applicable data protection legislation, including a right to:

• request access to the information we hold about them
• ask us to make any changes to their information to make sure that it is accurate and up to date
• ask us to stop or limit our use of or to delete their information
• receive their information in a format that suits them

These rights do not have to be made in writing and can be made free of charge, unless they are excessive or manifestly unfounded, in which case we may charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested. Sufficient evidence must be provided to enable Magna Laboratories to verify the identity of the person making the request and that they have a right to receive it.

We want to make sure that the personal information held by Magna Laboratories is accurate and up to date. If you consider that the information we have about you is inaccurate or incomplete, please let us know and we can correct or complete such details.

Note that it may not be possible for Magna Laboratories to comply with any request made to exercise the above rights. For example, as the processing of personal information of HCPs and Patients is necessary to provide the contracted service, Magna Laboratories would not be able to erase personal records of active Patients if so requested. Patients or HCPs who do not wish to share their personal information with Magna Laboratories, or third parties supporting us, shall not be able to request analytical services from us.

Individuals about whom data are controlled by a Patient Monitoring Service and processed by Magna Laboratories will be referred to the relevant Patient Monitoring Service regarding any requests for access, changes, etc. to their data.

6.2 Access to Patient information

Individuals from whom data are controlled or processed by Magna Laboratories expect their records to be kept confidential. We may therefore be limited in what information we can disclose if an individual health care professional requests access to Patient records that we keep. However, we will disclose information from the records we hold when requested, provided that the following conditions are met:

The request has been:

• made by someone who can demonstrate a legitimate reason for accessing requested information; the reason and the legitimacy for access to information should be justified in the request
• Requests for personal data about Patients or for a significant amount of health-related information (e.g. more than 5 clozapine assay results) should be made in writing and include relevant contact details so that Magna Laboratories can ascertain that information can be returned adequately to the correct person.

[We reserve the right to charge a reasonable fee to cover our administrative costs in respect of any assistance that we provide that is not part of a subject access request.]

7. Right to complain

Individuals have the right to lodge a complaint with a data protection supervisory authority should they have a concern on how Magna Laboratories handle their personal information. For the UK, the supervisory authority is the Information Commissioner’s Office (ICO), and can be contacted at:

Information Commissioner’s Office,

Wycliffe House, Water Lane,

Wilmslow,

Cheshire

SK9 5AF

Telephone: 03031 231113

8. Changes to our privacy policy

We keep our privacy policy under regular review and we will place any updates on our web page: www.magnalabs.co.uk

This privacy policy was last updated on the date indicated in the footer. Changes since the last version are in italics.