Vantage API - Required Consents & Disclosures (United Kingdom)

Version 1.0 · Effective 5 August 2026 · Published by Terra Enabling Developers, Inc.

This document is incorporated into your agreement with Terra (through the consent provision of your Order or Schedule or, for customers on Terra's standard clinical agreement, the Clinical Services Schedule) and specifies every consent and disclosure your application must present to, and capture from, UK end users before they receive clinical services through the Vantage API — including text required by the laboratories and clinical providers in Terra's fulfilment chain. Terra may update this document from time to time and will give you reasonable notice of material changes; implement updates promptly.

How text is marked

Every block carries one of three tiers:

•

VERBATIM— mandated by an upstream provider or by law. Deploy exactly as printed; populate only bracketed slots where instructed. Deviation is a breach of your agreement with Terra, and Terra cannot agree variations.

•

REQUIRED CONTENT— the substance and every named entity are mandatory; you may adapt the wording to your application's style.

•

TERRA REQUIRED— mandated by Terra (not by an upstream provider or by law). Deploy as printed; Terra may agree a variation in writing.

1. Which sections apply to youAnswer from facts about your own business.

Question	If yes
Do you have UK end users?	All of §2, §3, §4, §5, §6
Does your menu include genetic testing?	Genetic testing is not currently offered for UK clinical services — contact Terra before enabling any genetic flow; additional consent modules will be supplied

All UK clinical services operate under the clinical oversight of the laboratory provider's registered clinicians, regardless of your own regulatory status — there is no B2B/DTC split in this document; the same blocks apply to every UK flow.

2. Privacy notice content — what your End User Agreement and privacy notice must contain

2(a) Laboratory sub-processor and direct-contact disclosuresREQUIRED CONTENT

Your privacy notice must clearly disclose, naming Thriva, that:

Your personal data will be shared with Thriva Limited as a sub-processor for the purpose of laboratory testing. In certain urgent or critical result scenarios, Thriva may contact you directly as an independent controller, and you may receive direct communications from Thriva regarding urgent results independently of [your application]'s platform or instructions.

2(b) Recipient chainREQUIRED CONTENT

The privacy notice must identify everyone who receives the end user's information, by name:

To provide your testing service, your personal data is shared among: [Customer application] (the service you use, and the data controller of your personal data); Thriva Limited, its doctors, and its laboratories (which perform the testing and clinical review); and Terra Enabling Developers, Inc., the technology platform that routes your orders and results between them as a processor.

2(c) International transfersREQUIRED CONTENT

Your information is processed in the United Kingdom. Where a laboratory or provider processes it outside the United Kingdom, that transfer is made under appropriate safeguards.

These §2 disclosures also appear on Terra's hosted end-user clinical disclosures page; your privacy notice must carry them directly (a link alone does not satisfy the laboratory provider's requirement that your notices disclose these facts).

3. The Consent — at checkout, before any order is placed or any personal data is shared with the laboratoryPresent the following consent wording as a distinct, affirmative capture — tick-boxes ticked by the end user — at the point of purchase, and in any event before any order is submitted or any personal data is shared with Thriva. Do not bundle it into your terms-of-service acceptance or any other acceptance. Log every acceptance (§5).

3(a) Laboratory consent wordingVERBATIM

[COMPANY NAME, COMPANY NUMBER, COMPANY ADDRESS AS APPLICABLE] collaborates with Thriva Limited, 3rd Floor, white collar factory, 1 Old Street Yard, London EC1Y 8AF – thriva.co, to provide you with your health services and test results. [COMPANY NAME] and Thriva are independent data controllers that share your personal data to [description of services - e.g. perform the blood test and provide you with the blood test results and associated services]. Thriva relies on your consent to process your confidential patient information, to manage their health system and services and to share confidential patient information with [COMPANY]. Thriva takes the protection of your information seriously. For more information about how Thriva processes and discloses your personal data, please see https://public-documents.thriva.io/legal/clarity/Privacy+Notice.pdf. Please provide your consent below by way of a ticking the relevant box:

I confirm that I am 18 years or older
I confirm that I am placing this test order for myself and not for any third party
[Company consents if applicable]
I agree that Thriva, its doctors and labs may process and disclose my confidential health information in order to manage its systems and services and to provide me with test results, escalations (making contact about abnormal results), health insights and doctor-written results reports. I understand my personal data will be managed in accordance with Thriva’s privacy notice and I agree that Thriva may disclose my confidential patient information to [Company]

If you do not provide your consent above, [COMPANY] and Thriva will be unable to proceed with the blood test, as they require that consent to be able to undertake the service. Should you wish to withdraw your consent at any time please contact [COMPANY DPO contact details]. This will however prevent you from making continued use of the services and may prevent you from obtaining your blood test results. Further details of our processing and your rights can be found at [COMPANY PRIVACY POLICY] and https://public-documents.thriva.io/legal/clarity/Privacy+Notice.pdf.

Slot population (populate only these; change nothing else):

Slot	Populate with
[COMPANY NAME, COMPANY NUMBER, COMPANY ADDRESS AS APPLICABLE] / [COMPANY NAME] / [COMPANY]	Your legal entity (name; company number and registered address where the slot calls for them)
[description of services - e.g. …]	A plain description of your service
[Company consents if applicable]	Your own consent items, if any — as separate tick-boxes; do not intermix them with the Thriva wording
[COMPANY DPO contact details]	Your DPO or privacy contact
[COMPANY PRIVACY POLICY]	An active link to your privacy notice

Capture rules: each tick-box is an affirmative act by the end user — a passive link is not capture; a pre-ticked box is not capture. The consent must be capturable separately from your terms-of-service acceptance. Re-present on any material text change (Terra will notify you of Thriva-agreed changes; you may not make changes yourself).

3(b) Terra-required acknowledgmentsTERRA REQUIRED

Present the following with the §3(a) consent — inserted via the "[Company consents if applicable]" slot (the wording's own insertion point for additional items) or as adjacent tick-boxes within the same capture instrument. Do not alter the §3(a) text itself.

I understand that test results may include false positive or false negative results and may not provide definitive conclusions.
I understand that it is my responsibility to act on my results, and to seek advice from my GP or another healthcare professional if I have questions or concerns or if my condition worsens.
I understand that the results and any insights provided through the application do not replace medical advice from my GP or another healthcare professional.

End User Agreement clause (your ToS/EULA must contain this)TERRA REQUIRED

You agree that the laboratory provider, its clinicians, and the technology platform that routed your order (the "Platform Provider") are intended third-party beneficiaries of, and may enforce, the disclaimers, acknowledgments, and consents you provide under this Agreement and in connection with the services.

4. At results

Display the following Thriva-supplied text to the end user with their results — VERBATIM

Your results and explanations have been reviewed by Thriva clinicians and are delivered to you via this platform, which is responsible for displaying them and notifying you. Thriva does not provide ongoing medical care or follow-up. Your GP remains responsible for your overall care. If you have questions or concerns, please contact your GP or another healthcare professional.

Acknowledgment gate — TERRA REQUIRED Before results are shown, the end user acknowledges readiness by an affirmative action — a checkbox (or equivalent) that un-gates the results view. On that action, call Terra's results-acknowledgment endpoint and promptly display the results in full. Never trigger the acknowledgment from webhook receipt, result retrieval, or any other backend event — it must evidence the end user's own action. If results remain unacknowledged, the laboratory provider's clinicians may contact the end user directly (see §2(a)).

Escalation messages — VERBATIM Display the escalation message for each result exactly as supplied, keyed to the escalation level Terra delivers:

Escalation level	Required copy (verbatim — do not paraphrase)
Very High	Please speak to a medical professional about this result as soon as possible. We recommend you do this today.
High	Please contact your GP within 24 hours to discuss the result.
Medium	Please contact your GP within 7 days to discuss your result.
Low	Please contact your GP for a routine appointment to discuss this result.
Very Low	We advise monitoring this result. If you experience any symptoms it is recommended that you speak to your GP.

Faithful rendering — REQUIRED CONTENT Display biomarker values, units, and reference ranges exactly as delivered, and display any doctor-written results report in full and unaltered.

Display results in accordance with Terra's Results Display and Clinical Escalation Requirements — in full, unaltered, with escalation messages reproduced verbatim.

(There is no direct-access or results-timing election in UK flows — that is a US-only block; do not import it.)

5. Evidence, records, withdrawals, and attestationThese record-keeping duties are laboratory-mandated — REQUIRED CONTENT

•

For every consent captured under §3, keep a record clearly setting out: who consented (name/identifier); when they consented (timestamp); what they were told (a confirmation of the consent wording version shown); and how consent was obtained (digitally or in person). Keep these records secured and in a machine-readable format.

•

Provide the records to Terra on reasonable request connected to a provider requirement, audit, or regulatory inquiry, and in the format and at the intervals reasonably requested.

•

Withdrawals: where an end user withdraws consent, inform Terra without delay so the withdrawal can be passed to the laboratory provider; if consent is withdrawn before the service is performed, the service cannot be performed.

•

Your consent-capture flow will be reviewed as part of your go-live demonstration, and these checks may be renewed at regular intervals.

•

Annually, and on Terra's reasonable request, attest in writing that your consent and disclosure flow conforms to this document and your agreement with Terra.

•

Keep your links (your privacy notice; the Thriva privacy notice URL inside the §3 wording; Terra's end-user disclosures page) pointing at the current versions.

Operational requirements — you must implement each of theseThese operational controls are mandatory. Terra may agree a variation in writing.

•

Eligibility (18+). Enforce an age gate at checkout confirming the end user is at least eighteen (18) years of age, and do not offer testing to, or collect samples from, anyone under eighteen (18). The 18+ tick-box inside the §3 wording complements this gate; it does not replace it.

•

Capacity and identity. Implement appropriate systems and controls to ensure the services are not purchased or accessed by any individual who lacks capacity to consent, and not used or accessed by anyone other than the individual who provided the consent (self-order only — the §3 wording's self-order confirmation complements these controls).

•

Safeguarding contact. Where you are required to have a named Safeguarding Lead, share that person's contact details with Terra for provision to the laboratory provider, and cooperate promptly with any safeguarding check, investigation, or referral.

•

End-user details. Capture accurate end-user contact details, sex, and date of birth at order, and keep them current — they feed the provider's clinical-escalation and safeguarding processes.

•

Result-minimal notifications. Notifications sent outside the authenticated application (push, SMS, or email) must not contain result values, panel names, or health conditions; limit them to a readiness message and a secure login link. Result content is shown only after login and the §4 acknowledgment.

•

Rights-request routing. Route data-subject requests (including subject access requests) affecting the laboratory provider's processing to Terra promptly on receipt.

6. The do-not list — each of these invalidates a capture or breaches your agreement

•

Do not edit, paraphrase, truncate, or restyle any [VERBATIM] block — the §3 wording may not be amended without the laboratory provider's prior written agreement, obtained via Terra.

•

Do not drop a named entity from a [REQUIRED CONTENT] block.

•

Do not bundle the §3 consent into your terms of service or any other acceptance, and do not satisfy any capture with a passive link, pre-ticked box, or inferred acceptance.

•

Do not fire the results acknowledgment from your backend.

•

Do not offer testing to, or collect samples from, anyone under eighteen (18), anyone whose capacity to consent is in doubt, or anyone ordering for a third party.

•

Do not import US-style liability releases, claims waivers, or results-timing elections into UK end-user flows — they are omitted from this document by design.

Appendix — legal anchors (for your counsel)

Requirement	Source
§3 consent wording (mandatory verbatim)	Laboratory provider's Data Protection, Consent and Safeguarding Policy, Annex "Precedent Wording" (contractually incorporated; "should not be amended without our prior written agreement")
§2(a) privacy-notice disclosures	Laboratory provider contract conditions (downstream privacy notices must clearly disclose sub-processor sharing and independent-controller direct contact, naming the provider)
Lawful basis architecture	Testing consent: UK GDPR Art. 9(2)(a) (explicit consent — the §3 wording) + common-law confidentiality consent. Provider's urgent-contact basis (asserted by the provider as independent controller): Art. 9(2)(h) + DPA 2018 Sch 1 Pt 1 ¶2 — your flow owes disclosure (§2(a)), not a further consent
§4 results display copy	Provider-supplied patient-facing Disclosure Text (contract display-text mechanism) + Client Display Requirements (escalation copy, faithful rendering)
§5 records / withdrawals / go-live review	Provider's Data Protection, Consent and Safeguarding Policy (consent capture, records, withdrawals, evidence of compliance)
Why no release or claims waiver	Consumer Rights Act 2015 (incl. ss. 62, 65): consumer exclusions for negligence-caused death or personal injury are void; unfair-terms risk contaminates adjacent blocks
Third-party enforcement of end-user acknowledgments	Contracts (Rights of Third Parties) Act 1999 (the End User Agreement clause above); scope deliberately excludes releases (none exist in UK flows) and arbitration/class terms
Contractual carrier	The consent provision of your Order or Schedule (for customers on Terra's standard clinical agreement, Clinical Services Schedule §§C4 and C6A); Terra's Results Display and Clinical Escalation Requirements

ProductsIntegrations AI Interface Authentication Mobile Development Documentation GraphAPI

DocumentationAPI SDK Quickstart

CommunityBlog Research Community Podcast Github

CompanyAbout Careers Customers Become an Integration GDPR Privacy Policy Terms of Purchase

Become an integration Get started