Privacy policy
Tota Privacy Policy
Version 2. Updated 16th October 2026.
Who we are
Tota is a trading name of The Metagenomic Testing Company Ltd, registered in England and Wales with company number 16729944. Our registered office and our laboratory are at Units 5 & 7, 127 Olympic Avenue, Milton Park, Abingdon, OX14 4SA.
We are the data controller for the information described in this policy.
If you have a question about your information, or you want to exercise any of the rights set out below, email hello@tota.bio or write to us at the address above.
The information we hold about you
We have split this into health information and everything else, because health information is treated differently in law.
Health information
This is the sensitive part, and the law calls it special category data. It covers:
-
your sample, and the fact that you have taken a test at all;
-
the sequencing data we generate from your sample, and the micro-organisms we identify in it;
-
your report and your results history; and
-
your answers to the questions we ask you when you order, which include questions about your health.
What we do not hold. Our laboratory testing process actively destroys human cells that are found in the sample you provide to us. However, low levels of your genetic material may be sequenced alongside the microbial DNA we are looking for. Our processes recognise any human sequences and ignores it. We do not assemble or analyse any fragment of your genome. We are not a genetic testing company and we do not hold your DNA.
Everything else
Contact details including your name, address, billing address, shipping address, phone number, and email address.
Payment information. We do not see or store your full card number. Our payment provider handles that and gives us confirmation that a payment succeeded, together with the last few digits of the card.
Account information including your username, password, preferences and settings.
Your order history, including tests bought, subscriptions, returns and refunds.
Communications with us including the information you include in communications with us, for example, when sending a customer support inquiry.
Basic technical information when you use our website, such as your IP address, browser and how you moved through the site.
Why we are allowed to use your information
For ordinary information we need a lawful basis. For health information we need a lawful basis and, separately, a specific condition that allows us to handle health data at all. Here is what we rely on and why.
|
What we do |
Why we are allowed to process ordinary personal information |
For health information |
|---|---|---|
|
Test your sample and give you your results |
Performing our contract with you |
Your explicit consent and performing our contract with you |
|
Take payment, arrange delivery, run your account |
Performing our contract with you |
Not applicable |
|
Answer your questions and handle complaints |
Performing our contract with you, and our legitimate interests as a business |
Performing our contract with you |
|
Contact you if we see something we think you should know about |
Our legitimate interests in acting responsibly and in your interests |
Performing our contract with you and our legitimate interests in acting responsibly |
|
Improve our test, our reports and our reference database |
Our legitimate interests as a business |
Your explicit consent and performing our contract with you |
|
Wider research, publication and work with third party partners |
Your consent, which is optional and separate |
Your explicit consent, which is optional and separate |
|
Send you marketing, if you have asked for it |
Your consent |
We do not use health information for marketing |
|
Keep records, meet legal obligations, deal with disputes |
Legal obligation, and our legitimate interests as a business |
Legal obligation, and our legitimate interests |
|
Use data analytics to improve the website and customer experience |
Legitimate interests as a business |
Not applicable |
Research and improving our test
We do two different things here and we want to be clear about which is which.
The first is part of running our service. We look at results across our customers to improve how we sequence, how we interpret what we find, how we present reports, and to build the reference database our analysis depends on. Without this the test would not improve. We rely on our legitimate interests for this rather than on your consent, because it is part of providing and improving what you have bought. The people doing this work see data stripped of anything that identifies you. If you object, email us and we will consider it properly and tell you the outcome.
The second is optional. We would like to use your de-identified results in wider research: publishing findings, sharing de-identified (pseudonymised) data with academic and clinical researchers, and commercial research arrangements with third parties including pharmaceutical partners. This only happens if you have opted in, and you can withdraw at any time. You get exactly the same test either way. Our Consent Policy explains this in full.
Who we share your information with
We do not sell your information, and we do not use it for personalised or interest-based advertising. We do not share your health information with advertisers, social media platforms or data brokers, and we do not use the fact that you are a Tota customer to target advertising at you.
We do use other companies to help us run the business. They only get what they need, they act on our instructions, and they are not allowed to use your information for their own purposes. The categories are:
-
our website and online shop platform;
-
payment processing;
-
delivery of kits and return of samples;
-
email and customer service tools;
-
IT hosting, backup and security; and
-
professional advisers such as accountants and lawyers, where needed.
We keep an internal record of exactly who these companies are and what they do.
Once arrived at the lab, your sample and your sequencing data do not leave us. All sequencing and analysis is done by us, in our own laboratory in Oxfordshire. We do not send samples to a third party laboratory.
In certain circumstances, we may disclose your personal information to third parties where we are required to by law, for example in response to a court order or a valid request from a regulator.
If our business is sold or transferred, your information may transfer with it. If that happens we will tell you beforehand.
Where your information is held
Your sample is processed in the UK. Your sequencing data and your results are held in the UK.
Some of the general business tools we use, such as email and website hosting, may hold information outside the UK. Where that happens we make sure the transfer is covered by an approved safeguard, such as the UK addendum to the standard contractual clauses or a country the UK has recognised as providing adequate protection.
How long we keep things
We do not keep things longer than we need to. Specifically:
|
What |
How long |
Why |
|---|---|---|
|
Your physical sample |
Up to two weeks from receipt, and destroyed once your results are published |
So we can repeat the test if something goes wrong in the laboratory |
|
Your sequencing data and results |
While your account is active. Deleted after ten years of inactivity |
So you can see your results and track changes over time |
|
Your account and contact details |
While your account is active, then deleted with it |
To run your account |
|
Order and payment records |
Ten years from the end of the tax year in which you ordered |
Tax and accounting requirements |
|
De-identified research data |
Retained after your account closes |
Research already under way cannot be unpicked |
We will email you before we delete an inactive account, so you have the chance to download your results first. You can also ask us to delete your account at any time.
Keeping your information safe
Access to your information inside Tota is limited to the people who need it for their job. Only a small number of administrators are technically able to connect your results to you as a named person, and they are only permitted to do so for specific operational reasons, such as answering a query from you.
Your results are held securely and you reach them by signing in to your account. Please keep your password to yourself. If you think someone else has access to your account, tell us straight away.
No system is completely secure, and if something ever went wrong we would tell you and the Information Commissioner’s Office where we are required to.
Your rights
You have the following rights over your information. They are free to exercise, and we will respond within one month.
-
See what we hold about you, and get a copy.
-
Have anything inaccurate corrected.
-
Have your information deleted. There are some things we have to keep, such as order records for tax purposes, and we will tell you if that applies.
-
Get your data in a portable format, or ask us to send it to someone else.
-
Object to us using your information, or ask us to restrict how we use it.
-
Withdraw your consent at any time.
On withdrawing consent: if you withdraw your consent to us testing your sample before we have analysed it, we will stop and refund you in line with our Refunds and Cancellation Policy. If you withdraw after your sample has reached the lab, we cannot un-analyse the sample, but we will delete your results if you ask.
To exercise any of these, email hello@tota.bio. We may need to check who you are first.
If you are unhappy
Please tell us first. Email hello@tota.bio. We will acknowledge receipt of your complaint within 30 days, investigate your concerns and inform you of the outcome. If you are not satisfied, ask for it to be reviewed and we will arrange that. You have the right to complain to the Information Commissioner’s Office should you wish to.
Age
Our tests are for adults. You must be 18 or over to buy a test or take a sample. We do not knowingly collect information about anyone under 18. If you believe we hold information about a child, contact us and we will delete it.
Our website platform
Our online shop runs on Shopify, which handles orders and payments on our behalf. Your health information and your results are not held in our shop system. If you have a question about your information, contact us.
Our website may from time to time include links to third party websites. We have no responsibility for those websites. Clicking such links may enable third parties to collect or share your data. We are not responsible for this privacy statement of these third party websites. Please read the privacy policies if you access any third party websites.
Cookies
Cookies are small files a website stores on your device. We use three kinds.
Essential cookies keep the site working: your basket, staying signed in, and security. The site cannot run without them, so they are always on.
Analytics cookies tell us how people find and use the site, so we can improve it.
Marketing cookies let us measure how well our advertising works. At the moment we only use Google Ads cookies for this.
When you first visit, a banner asks whether you want to accept or decline the optional cookies. Essential cookies stay on either way. You can change your mind at any time in our cookie settings, or by clearing cookies in your browser.
We do not use cookies to collect or infer anything about your health, and we do not share your results or any health information with advertisers.
Changes to this policy
We may update this policy from time to time, including to reflect changes to our practices or for other operational, legal, or regulatory reasons. We will post the revised policy on this website, update the "Last updated" date and provide notice as required by applicable law.
If a change materially affects how we use your health information, we will email you and, where the change relies on your consent, we will ask you again rather than assume it.
