Plain-English summary: We only collect what we need to deliver the report. Your lab files are processed in encrypted memory and deleted after delivery unless you opt in to trend tracking. We never sell your data and we never train AI models on your uploads. You can delete everything we have on you at any time.
1. Who we are
This privacy policy applies to blood-test.life and is issued by Blood Test Life Inc, a Delaware corporation registered at 1007 N Orange Street, 4th Floor, Wilmington, DE 19801, United States. For data-protection questions, contact our Data Protection Officer at [email protected].
2. Data we collect
- Lab report content: the PDF, photo, scan, or text you upload, and the parsed biomarker values.
- Account data (paid plans): email, password hash, plan, billing identifier (Stripe customer ID — we never store full card numbers).
- Technical data: IP address, browser type, language preference, anonymized usage analytics.
- Voluntary data: support correspondence, feedback you send us.
3. Why we collect it
- To deliver the AI blood test analysis you requested.
- To remember your settings and previous reports (if you opt in to trend tracking).
- To process payment and prevent fraud (paid plans).
- To improve the analyzer in aggregate, anonymized form — never by training on individual uploads.
- To respond to support questions you initiate.
- To comply with legal obligations.
4. How long we keep it
- Lab report files: deleted within minutes of report delivery, unless trend tracking is enabled (in which case parsed values — never the original file — are retained until you delete them).
- Account data: kept while your account is active; deleted within 30 days of account closure (longer retention only where legally required).
- Server logs: 90 days, with no personal health information included.
5. Your rights
Under GDPR, CCPA, and equivalent laws, you have the right to:
- Access the data we hold on you.
- Correct inaccurate data.
- Delete your data (\"right to be forgotten\").
- Export your data in a portable format.
- Object to processing or restrict it.
- Withdraw consent at any time.
- Lodge a complaint with your local supervisory authority.
Exercise any of these by emailing [email protected]. We will respond within 30 days, usually faster.
6. Sharing
We do not sell your data — to anyone, ever. We share data only with the minimum set of subprocessors required to run the service:
- Cloud infrastructure (US-based, encrypted at rest).
- Payment processor (Stripe — we never see your full card number).
- Transactional email provider (no health data included in emails).
- Error-monitoring (no PHI; redacted in transit).
The current subprocessor list is available on request.
7. International transfers
Our infrastructure is based in the United States. Where data transfers to the US from the EU, UK, or other jurisdictions occur, we rely on Standard Contractual Clauses and supplementary safeguards as required by GDPR.
8. Children
blood-test.life is intended for adults uploading their own or their immediate dependents' lab reports. We do not knowingly collect data directly from anyone under 13. If you believe a child has used the service without an adult, contact us at [email protected] and we will delete the relevant data.
9. AI and training
We do not train AI models on your uploaded lab reports. The narrative model is fine-tuned on curated, de-identified medical writing reviewed by our medical board.
10. Cookies
We use a minimal set of strictly necessary cookies (session, CSRF, language preference). We do not use third-party advertising or tracking cookies on the editorial site. A small set of privacy-friendly analytics cookies are used to count page views in aggregate.
11. Changes
If we materially change this policy we will notify active account holders by email and post the changes here at least 30 days before they take effect.
Questions? [email protected]