Privacy Policy

Last updated: 6 August 2026

Pegasus Laboratory Services is committed to respecting the privacy and confidentiality of patients, clients, website visitors and other individuals whose personal data we process. This notice explains how personal data may be collected and used through our website and, where relevant, in connection with laboratory services.

Who is the controller?

For processing activities where Pegasus determines why and how personal data is used, the controller is:

Pegasus Laboratory Services
4 Falcon Street, Sannat
Gozo, Malta
Pegasus@labgozo.com
+356 9946 0705

Personal data we may process

Depending on how you interact with us, this may include:

• Identity and contact data, such as name, date of birth, identification details where necessary, address, telephone number and email address.
• Appointment and service information, including booking details, requested tests, referrer information and communications with us.
• Health and laboratory data, including clinical information supplied for testing, specimen details, test requests, laboratory results and related reports. Health data is a special category of personal data under the GDPR.
• Billing and transaction information, such as invoice, payment status and transaction references. Payment-card data is handled only to the extent required by the payment method or provider actually used.
• Website and technical data, such as IP address, browser/device information, security logs and cookie/consent information.
• Correspondence, enquiries, complaints and other information you choose to provide.
  
  

Why we use personal data and our legal bases

We process personal data only where there is an appropriate lawful basis. Depending on the activity, this may include performance of a contract or steps requested before entering into one; compliance with legal obligations; our legitimate interests in operating, securing and administering the service where those interests are not overridden by your rights; or your consent where consent is the appropriate basis.

Because laboratory information can reveal health status, additional GDPR conditions apply to health data. Where applicable to the service and professional context, such processing may be necessary for medical diagnosis, provision or management of health care, or another condition permitted by Article 9(2) GDPR, subject to applicable confidentiality and safeguards. We do not rely on consent by default when another lawful basis and Article 9 condition is more appropriate.

Typical purposes include arranging and providing laboratory services; identifying samples and producing reports; communicating results to authorised recipients; billing and administration; quality, security and service management; complying with professional, regulatory and legal obligations; handling complaints or legal claims; and, where you consent, operating optional website analytics or similar technologies.

Where we obtain information

We may receive personal data directly from you, from a person acting with your authority, or from an authorised healthcare professional/referrer. Where specialist testing is arranged through a reference laboratory, relevant information may also be exchanged with that laboratory as necessary for the requested service.

Who we may share personal data with

We limit disclosure to what is reasonably necessary and authorised. Depending on the service, recipients may include:

• You and recipients you authorise, including your treating healthcare professional or referrer where appropriate.
• Reference laboratories or specialist providers used to perform requested testing.
• Service providers supporting hosting, booking, communications, IT/security, payment processing or other operational functions, subject to appropriate data-protection arrangements where required.
• Regulators, public authorities, courts, law-enforcement bodies, insurers or professional advisers where disclosure is required or permitted by law or is necessary for legal claims.

We do not sell personal data.

International transfers

If personal data is transferred outside the European Economic Area, we will use a transfer mechanism and safeguards required by applicable data-protection law, where such safeguards are required. You may contact us for information about the safeguards relevant to a particular transfer.

How long we keep data

We retain personal data only for as long as necessary (maximum 10 years) for the purpose for which it was collected and to meet applicable legal, regulatory, professional, contractual, quality-management and legal-claims requirements. Retention periods vary by record type. When information is no longer required, it is securely deleted, anonymised or otherwise disposed of in accordance with our retention procedures.

Security and confidentiality

We apply appropriate technical and organisational measures designed to protect personal data against accidental or unlawful loss, alteration, unauthorised disclosure or access. Access to laboratory and health information is restricted according to role and need, and relevant professional confidentiality obligations apply.

Your data-protection rights

Subject to the GDPR and any lawful limitations or exemptions, you may have rights to access your personal data; rectify inaccurate data; request erasure; restrict processing; object to certain processing; receive certain data in a portable format; and withdraw consent where processing is based on consent. Some rights do not apply in every circumstance, particularly where information must be retained or processed under a legal or professional obligation.

To exercise a right, contact us using the privacy contact details above. We may need to verify your identity before acting on a request.

Complaints

If you believe your personal data has been handled improperly, please contact us first so we can address your concern. You also have the right to lodge a complaint with the Office of the Information and Data Protection Commissioner (IDPC), Malta. Website: https://idpc.org.mt/

Children and representatives

Where laboratory services concern a minor or a person represented by another individual, we will handle personal data and requests for access or disclosure in accordance with applicable law, authority/guardianship requirements and the circumstances of the service.

Changes to this notice

We may update this Privacy Policy when our services, website or legal obligations change. The current version and its last-updated date will be published on the website.