Privacy notice

What this notice has to cover

Most privacy notices describe a site that collects an email address. This one has to describe something more sensitive: you upload your blood test results, and those results are data about your health. Under the UK GDPR, as under the EU GDPR, health data is “special category data” (Article 9), which may be processed only on narrow grounds and with more care than ordinary personal data. The Data Protection Act 2018 sits alongside the UK GDPR and completes it.

So this page is longer than we would like, and specific where it would be easier to be vague. If a passage is unclear, write to us and we will rewrite it.

Data controller

Smart Medical Care SAS, registered office in Nice, France, SIRET 932 924 194 00016. Contact for anything on this page, including exercising your rights: contact@blood-interpretation.com.

The waiting list, now closed

Before the service opened, the upload buttons led to a form that asked for one thing: an email address, so that we could tell you when it opened, along with the language you were reading in and the page you were on. That form has been removed, and no address is collected this way any more.

The legal basis for the addresses already on the list is the consent given by submitting the form. We use them for that one message and nothing else, we do not pass them to anyone, and you can ask us to delete yours at any time at the address above. The list is erased once everyone on it has been contacted.

What we process when you upload your results

The blood test results you upload, as a file and as the values read from it. Your name is removed from the document before the analysis: the engine works on your values and the context you give, not on your identity.

The context you provide: age, sex, and the answers to the questions asked before the reading, because a value is read differently at twenty-five and at seventy.

Your account: the email address used to create it, and the results kept in it so that one set can be read against the next. A trend carries information a single snapshot does not.

Payment, if you buy a full report: handled by our payment provider. We never see or store your card details.

Technical data: server logs needed to run the service and keep it secure.

Purposes and lawful bases

Producing your full report: your explicit consent to the processing of health data (UK GDPR, Article 9(2)(a)), given when you upload your results. You can withdraw it at any time by deleting your results or your account, which stops the processing from then on.

Keeping your results so they can be compared over time: the same explicit consent. If you would rather not keep them, delete them and nothing remains.

Taking payment: performance of the contract between you and us.

Running and securing the service, and measuring audience: our legitimate interest in a site that works and that we can improve, balanced against your rights. Audience measurement is covered below, because it needs your consent rather than our interest alone.

Who else sees the data

The interpretation engine. Reading your results and writing the explanations relies on an artificial intelligence provider established outside the UK and the European Union, acting as our processor under contract. Your results are sent for that single purpose. They are not used to train the provider’s models, and they are never sold or shared for any other purpose.

Our hosting provider, Outscale, a French company certified as a health data host (HDS, hébergeur de données de santé), which stores the data and runs the service.

Our payment provider, for purchases only, which receives what a payment requires and nothing about your results.

Nobody else. Your results are not shared with insurers, employers, advertisers or any other service, and they are not a source of data for anything sold elsewhere.

International transfers

If you live in the UK, your data leaves the UK twice. It is hosted in France by Outscale: UK law treats the countries of the European Economic Area, France included, as providing adequate protection, so that transfer needs no further safeguard. Then the health data you upload is sent to the artificial intelligence provider, which is established in the United States, to be read.

That transfer rests on the safeguards data protection law provides. Under the EU GDPR, these are standard contractual clauses and the adequacy framework for certified United States organisations. Under UK law, the equivalents are the UK Extension to the EU-US Data Privacy Framework (the “UK-US data bridge”, in force since 12 October 2023) for certified organisations, and the ICO’s International Data Transfer Agreement or its Addendum to the EU standard contractual clauses (in force since 21 March 2022). We state this plainly rather than burying it, because it is the part of this notice a reader is most entitled to know.

How long we keep it

Your results and your account are kept for as long as your account exists, because keeping them is what allows a reading to be compared with the previous one. There is no automatic expiry that would delete a history you chose to build.

You can delete a single set of results, or your entire account, at any time from your account. Deleting the account removes the results with it.

Technical logs are kept for the limited period needed for security and troubleshooting. Records connected to a purchase are kept for the period French accounting and tax law requires.

Cookies and audience measurement

This site uses Google Analytics 4 to measure audience. That tool sets cookies and involves a transfer to the United States, so it runs only if you accept it. In the UK, cookies are governed by the Privacy and Electronic Communications Regulations 2003 (PECR) as well as the UK GDPR. Refusing changes nothing about the service: the reading, the report and your account work in exactly the same way.

Your choice is kept for six months, after which we ask again. You can change your mind at any time with the “Manage cookies” link at the bottom of every page; withdrawing your agreement stops the measurement and deletes its cookies.

Cookies strictly necessary to run the service, such as keeping you signed in, are set without consent because the service cannot work without them. We use no advertising cookies and no social media cookies.

Your rights, and who to complain to

Under the UK GDPR you can ask for a copy of the data we hold about you (a subject access request), for its correction, for its erasure, for its processing to be restricted, and for your data to be handed to you in a portable form. You can withdraw your consent at any time, and you can object to processing based on our legitimate interest. In most cases, exercising these rights costs nothing.

Write to contact@blood-interpretation.com from the email address on your account, saying which right you want to exercise. We reply within one month. If a request is complex, that period can be extended by up to two further months, and we will tell you if it is.

If you are unhappy with how we have handled your data, tell us first: we acknowledge a complaint within 30 days and let you know the outcome. If our answer does not satisfy you and you live in the UK, you can complain to the Information Commissioner’s Office (ICO), the UK regulator, at ico.org.uk or on 0303 123 1113. Because Smart Medical Care SAS is based in France, you can also lodge a complaint with the CNIL, the French supervisory authority, at cnil.fr.

Changes to this notice

This notice changes when the service changes, and the date of the last revision appears at the foot of the page. A change that affects what we do with your results will be announced rather than slipped in.