Privacy policy

• The report you upload — the file itself, and the marker names, values and reference ranges read from it.
• Your account — the email address you sign in with.
• Optional details you enter — age, blood type, medications, existing conditions. These make the explanation more accurate and can be left blank.
• Payment records — which pack you bought and when. Razorpay handles the payment itself; we never see your card or UPI details.
• Basic technical data — error logs, and counts of reports analysed, which is how the free allowance and rate limits work.

• Your location.
• Your card, UPI or bank details.
• Advertising identifiers. There are no ad or analytics trackers.

We do not sell your data, and we do not share it with advertisers.

The report is sent to OpenAI, which performs the analysis and returns the explanation. That transfer is the product — without it there is nothing to show you. OpenAI processes it as a service provider and, under its API terms, does not use content submitted through the API to train its models.

Your report and its analysis are stored in Google Firebase so you can open them again. Payments go through Razorpay. Those three, plus our hosting provider, are the only third parties involved. OpenAI and Google process data outside India.

If you create a share link, anyone holding that link can view that report without signing in. That is the point of the feature, but it means the link is the only thing protecting it — treat it like the report itself.

Reports are kept until you delete them, so your history stays available. Delete a report and it is removed. Ask us to delete your account and everything tied to it goes — uploaded files and analyses included — within 30 days of your request.

• Leave the optional health details blank.
• Delete any report at any time.
• Ask for your account and all associated data to be deleted.
• Ask for a copy of what we hold about you.

Email dudelynft@gmail.com for any of these.

Blood Lab is not intended for anyone under 18 and we do not knowingly collect data from children. Contact us if you believe a child has used it and we will delete the account.

Traffic is encrypted in transit. Reports are readable only by the account that created them, enforced by database rules rather than by the website alone. No system is perfect, and we will tell affected users promptly if we ever discover a breach involving health data.

If this policy changes we will update the date at the top, and we will tell you before any change that materially affects how your health data is handled.