Skip to content
Blood Test Tracker

Privacy policy and consumer health data notice

Last updated October 4, 2026

The short version

  • We never sell or share your health data, and we never use it for advertising.
  • There are no ad trackers, social pixels or session recordings on this site.
  • We never use your data to train AI models.
  • You can download everything or delete everything at any time from your account page, with or without a plan.
  • If you make a share link, anyone who has that link can see a read-only copy of the results you chose to show (and your timeline notes only if you include them, never your files) until it ends or you turn it off. Each time it’s opened is logged, and you can see that log.
  • If you connect an AI app such as Claude or ChatGPT, it can read your record until you disconnect it. Each read is logged on your account page. What that app does with what it reads is covered by its own privacy terms.

What we collect

  • Account details: your email address and, if you set one, a password (stored hashed by our authentication provider).
  • Health data you give us: lab reports and other files you upload (kept privately so you can open them later), results you type or confirm, timeline notes, and optional profile answers (sex, year of birth, medications, notes).
  • Billing details, handled by Stripe. We never see your full card number.
  • Basic technical logs needed to keep the service secure and working.

How we use it

Only to provide the service to you: reading your reports, showing your results, ranges and trends, and answering your questions in the app. To read a report, we send page images and text to an AI model provider through OpenRouter, using only providers that commit to zero data retention, so they process the data and do not keep it. When you ask the in-app assistant a question, the question and the parts of your record it needs go the same way (to Anthropic’s Claude, served by Amazon or Google with zero retention), and we don’t store the question or the answer; we only count how much the assistant was used, to keep within your monthly allowance.

If you connect an AI app to your record (our MCP connector), you sign in on bloodtesttracker.com and choose to allow it. It gets a read-only key that works only for your record, only reads, and stops working when you disconnect it on your account page. We log each read (which app, what it read, when) so you can see it.

Who processes it for us

Supabase (database, file storage and sign-in, hosted in the United States), Netlify (website hosting), OpenRouter and its zero-retention AI providers (reading reports and the assistant), Stripe (payments) and our email provider (sign-in codes). Each one processes data only on our instructions.

How long we keep it

Until you delete it or your account. Deleting your account permanently removes your results and files right away. Backups roll off within a few weeks.

Your choices and rights

You can see, export, correct and delete your data yourself in the app. Depending on where you live (for example California, Washington, Nevada and Connecticut, and other places with consumer health data laws), you have rights to know, access, delete and withdraw consent. Washington residents: this page is our Consumer Health Data Privacy Policy. To exercise any right or ask a question, email privacy@bloodtesttracker.com.

Outside the United States

Your data is stored in the United States. Blood Test Tracker is not designed to meet the EU or UK GDPR’s requirements for health data. If that matters to you, please don’t use it.

Security

Data is encrypted in transit and at rest. Access is restricted per account at the database level. We log every time the app’s assistant or a connected AI tool reads your data, and you can see that log. If a breach ever affects your data, we’ll tell you as the law requires.

Children

Blood Test Tracker is for adults 18 and older. We don’t knowingly collect data from children.