Privacy Policy

1. Data we collect

Account data: name, work email, organisation, billing details and API usage metadata. This is controller-level data we hold about you as a customer.

Order data (PHI): identifiers you submit to place an order (for example an external patient id, name, date of birth, sex), specimen and collection details, and the resulting laboratory values.

Technical data: IP address, user agent, request logs and audit events. Logs record which key accessed which order and when; they never contain full result values.

2. How we use it

To route orders to the appropriate laboratory, deliver results to you, provide support, detect abuse, meet legal obligations, and produce aggregate operational metrics that contain no identifiers.

We do not sell personal data, do not use PHI to train machine-learning models, and do not use order data for advertising. Advertising slots on this marketing website are separate from the product and are not personalised for logged-in users.

3. Who we share it with

The partner laboratory that performs the test, and the licensed clinician who reviews the result. Both are bound by contract and, where applicable, by a BAA.

Sub-processors that provide hosting, payments, email delivery and error monitoring. The current list is available on request and updated before any new sub-processor receives PHI.

Authorities where required by law or to protect against serious harm, limited to what is legally required.

4. Retention

Laboratory records are retained for the period required by the regulations applicable to the performing laboratory — typically 2 to 10 years depending on jurisdiction — because medical records must remain available for clinical and legal purposes.

API request logs are retained for 90 days. Account data is deleted or anonymised within 30 days of account closure, except where retention is legally required.

5. Your rights

Individuals should contact the organisation that ordered their test, which is the controller. We support that organisation in fulfilling access, rectification, erasure and portability requests within the timeframes required by GDPR and applicable US state privacy laws.

You can reach our privacy team at [email protected]. EU and UK individuals may also lodge a complaint with their local supervisory authority.

6. International transfers and security

Data is stored in the region selected for your account. Transfers outside that region rely on Standard Contractual Clauses plus a transfer impact assessment.

PHI is encrypted in transit with TLS 1.2+ and at rest with AES-256. Access requires role-based authorisation and is logged in an append-only audit trail.