Probably legit, but most likely just an antibody test which isn't that expensive.
Imagine this scenario. You provide a donation along with personally-identifiable information such as your name and address. You submit this sample, of whatever, and you send it it. You have just shared with the world some very personal medical information. There is no such thing as information 'held in the strictist confidence'.