LabTestly
Privacy Policy
Last updated: May 24, 2026
This Privacy Policy explains how LabTestly (“LabTestly”, “we”, “us”, or “our”) collects, uses, stores, shares, and protects information when you use labtestly.com and related services (the “Service”). The Service helps you understand laboratory test results in plain English using automated tools, including artificial intelligence. This Policy is provided to help you understand our privacy practices. Your use of the Service is also governed by our Terms of Service.
1. Scope and applicability
This Policy applies to information processed through the Service. It does not cover third-party websites, applications, or services that may be linked from the Service, even where we identify them as sub-processors. The Service may be accessed from different countries, but it is operated as an informational and educational tool; it is not a medical device, a healthcare provider, a covered entity, or a business associate under the U.S. Health Insurance Portability and Accountability Act (“HIPAA”).
2. Information we collect
We collect the following categories of information:
- Account information. When you create an account we collect your email address and, optionally, a display name. If you sign in through a third-party identity provider we receive the identifiers and basic profile fields that provider returns.
- Lab report content. When you upload a laboratory report (PDF or image) we receive the file and process it to extract text, biomarker values, reference ranges, units, and collection dates. We store the structured data we extract and a machine-readable representation of the report.
- Assistant conversations. Questions you send to the in-app assistant and the responses it returns are stored in your account so you can revisit them. For anonymous or trial use, report data and assistant interactions may be associated with a temporary report or session identifier rather than a registered account.
- Consent records. We may store records of privacy, terms, and data-processing consents, including consent type, consent version, locale, timestamp, and related metadata.
- Billing information. If you purchase a paid plan or a one-off product, our payments processor collects your payment details directly. We receive only a customer identifier, the email used at checkout, the plan or product selected, and the subscription status (active, cancelled, past due).
- Technical information. We log timestamps, IP address and request metadata for security, abuse prevention, rate limiting, diagnostics, and service operation, plus user-agent string. We use a small number of strictly necessary cookies to maintain your session.
- Communications. If you contact us by email we retain the message and our reply so we can follow up.
3. How we use information
We use information to:
- provide the Service, including parsing uploaded reports and generating explanations;
- authenticate you and keep your account secure;
- process payments, enforce plan limits, and prevent abuse;
- send transactional messages such as account, billing, and service notices;
- diagnose errors, monitor reliability, and improve quality, using sampled or aggregated logs wherever practical;
- comply with legal obligations and enforce our Terms of Service.
We do not sell personal information. We do not use your lab report content or your assistant conversations to serve advertising and we do not allow third parties to use that content to train their general-purpose models.
4. Artificial intelligence processing
Generating an explanation requires sending the extracted contents of your report, and the messages you send to the assistant, to one or more third-party AI providers acting as our processors. The provider returns a response, which we display to you and retain in your account history. Outputs from AI systems may be inaccurate, incomplete, or out of date. AI explanations are for general informational purposes only and are not medical advice, diagnosis, or treatment. Always consult a qualified healthcare professional about your results.
5. Legal bases for processing
Where the European Union General Data Protection Regulation, the United Kingdom GDPR, or a similar framework applies, we rely on the following legal bases:
- Performance of a contract — to operate the Service you have requested.
- Consent — for processing health-related data you upload and for optional features you opt into. For health-related data that you upload, we rely on your explicit consent where required by applicable law. You may withdraw consent at any time; withdrawal does not affect the lawfulness of processing carried out before withdrawal.
- Legitimate interests — to keep the Service secure, prevent abuse, and improve quality, balanced against your rights.
- Legal obligation — to retain billing records and respond to lawful requests.
6. How we share information
We share information only with sub-processors that help us operate the Service, and only to the extent needed for the purpose described:
- our cloud platform provider, which hosts authentication, database, and file storage on our behalf;
- our AI providers, which generate explanations and answer assistant questions from the content you submit;
- our payments processor, which handles checkout and subscription billing as merchant of record;
- our transactional email provider, which delivers account, billing, and support messages;
- our hosting and edge infrastructure provider, which serves the application;
- our rate-limiting and abuse-prevention provider, which stores short-lived counters keyed to your account or IP.
We may also disclose information when we believe in good faith that disclosure is required by law, legal process, or a binding request from a public authority; to enforce our Terms of Service or other agreements; or to protect the rights, safety, or property of LabTestly, our users, or others. If LabTestly is involved in a merger, acquisition, financing, or sale of assets, information may be transferred to the successor entity subject to this Policy.
7. Data storage, retention, and security
- Transit and at-rest encryption. Traffic to and from the Service uses HTTPS/TLS. Files and database rows are encrypted at rest by our cloud platform provider using industry-standard ciphers.
- Row-level isolation. Our database is configured so an authenticated user can only access their own rows.
- Private storage. Uploaded files are stored in a private bucket. Access in-app uses short-lived signed URLs scoped to your session.
- Original-file lifecycle. Once we have successfully extracted the structured data from an uploaded report, the original file is removed from storage. If extraction fails, the original is retained until extraction succeeds or you delete the report. Extracted text and structured biomarker data remain so the assistant can answer questions about them.
- Retention. We retain account data, reports, and conversation history for as long as your account is active. Billing records are retained for the period required by applicable tax and accounting law. Diagnostic logs are retained for a limited period and then deleted or aggregated.
No system is perfectly secure. While we take reasonable measures to protect information, we cannot guarantee absolute security.
8. Your rights and choices
Depending on where you live, you may have the right to:
- Access the personal information we hold about you;
- Correct inaccurate information through your account settings or by contacting us;
- Delete individual reports from your dashboard, or your entire account by contacting us;
- Export a copy of your data in a machine-readable format on request;
- Object to or restrict certain processing;
- Withdraw consent at any time where processing is based on consent;
- Lodge a complaint with the data protection authority in your jurisdiction.
To exercise any of these rights, email [email protected]. We aim to respond to verified requests within the period required by applicable law. When you ask us to delete an account, we will remove or anonymise personal information as required by applicable law, subject to limited retention for legal, tax, accounting, security, backup, or operational reasons.
9. International data transfers
The Service is operated from, and information may be processed in, jurisdictions outside your country of residence, including the United States and the European Union. Where personal information is transferred outside the European Economic Area, the United Kingdom, or another jurisdiction with data-export rules, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses or equivalent mechanisms.
10. Children
The Service is intended for adults aged eighteen and over. We do not knowingly collect personal information from children. If you believe a child has provided information to us, contact us at [email protected] and we will delete it.
11. Health information and regulatory status
LabTestly is an educational tool. It is not a covered entity, a business associate, or a healthcare provider under HIPAA, and it does not offer diagnosis, prescription, or treatment. We do not enter into Business Associate Agreements. You should not upload another person’s laboratory results without their informed consent. If you need medical care, contact a qualified healthcare professional or, in an emergency, your local emergency service.
12. Cookies and similar technologies
We use a small number of strictly necessary cookies to keep you signed in, to remember your preferences, and to protect the Service against abuse. We do not run third-party advertising trackers and we do not build a cross-site profile of you.
13. Changes to this Policy
We may update this Policy from time to time to reflect changes in our practices, our service offerings, or applicable law. When we make material changes we will notify you in the Service or by email. The “Last updated” date at the top of this page always reflects the current version.