Privacy policy

What this policy has to cover

Most privacy policies describe a site that collects an email address. This one has to describe something heavier: you upload a laboratory report, and a laboratory report is health data. Under the GDPR that is a special category, processed only on narrow grounds and with more care than ordinary data.

So this page is longer than we would like, and specific where it would be easier to be vague. If a passage is unclear, write to us and we will rewrite it.

Data controller

Smart Medical Care SAS, registered office in Nice, France, SIRET 932 924 194 00016. Contact for anything on this page, including exercising your rights: contact@blood-interpretation.com.

The waiting list, while the reader is being built

The upload buttons do not open the reader yet. They open a form that asks for one thing: an email address, so that we can write to you when the reader opens. We also record which language you were reading in and which page you were on, to know what people are looking for.

The legal basis is your consent, given by submitting that form. We use the address for that one message and nothing else, we do not pass it to anyone, and you can ask us to delete it at any time at the address above. The list is erased once everyone on it has been written to.

What we process once the reader opens

The report you upload, as a file and as the values read from it. Your name is removed from the document before the analysis: the engine works on your values and the context you give, not on your identity.

The context you provide: age, sex, and the answers to the questions asked before the reading, because a value is read differently at twenty-five and at seventy.

Your account: the email address used to create it, and the reports kept in it so that one can be read against the next. A trend carries information a single snapshot does not.

Payment, if you buy a full report: handled by our payment provider. We never see or store your card details.

Technical data: server logs needed to run the service and to keep it secure.

Purposes and legal bases

Producing your free first read and your full report: your explicit consent to the processing of health data, given when you upload the report. You can withdraw it at any time by deleting the report or your account, which stops the processing for the future.

Keeping your reports so they can be compared over time: the same explicit consent. If you would rather not keep them, delete them and nothing remains.

Taking payment: performance of the contract between you and us.

Running and securing the service, and measuring audience: our legitimate interest in a site that works and that we can improve, balanced against your rights. Audience measurement is covered below, because it needs your consent rather than our interest alone.

Who else sees the data

The interpretation engine. Reading a report and writing the explanations calls an artificial intelligence provider established outside the European Union, acting as our processor under contract. Your report is sent for that single purpose. It is not used to train the provider’s models, and it is never sold or shared for any other purpose.

Our hosting provider, Google Cloud Platform, operated by Google LLC, which stores the data and runs the service.

Our payment provider, for purchases only, which receives what a payment requires and nothing about your results.

Nobody else. Your report is not shared with insurers, employers, advertisers or the other sites of the group, and it is not a source of data for anything sold elsewhere.

Transfers outside the European Union

Two of the providers above are established in the United States. Health data you upload therefore leaves the European Union to be hosted and to be read.

These transfers rest on the safeguards the GDPR provides for them, standard contractual clauses and the adequacy framework that applies to certified United States organisations. We state this plainly rather than burying it, because it is the part of this policy a reader is most entitled to know.

How long we keep it

Your reports and your account are kept for as long as your account exists, because keeping them is what allows a reading to be compared with the previous one. There is no automatic expiry that would delete a history you chose to build.

You can delete a single report, or your entire account, at any time from your account. Deleting the account removes the reports with it.

Technical logs are kept for the limited period needed for security and troubleshooting. Records connected to a purchase are kept for the period French accounting and tax law requires.

Cookies and audience measurement

This site uses Google Analytics 4 to measure audience. That tool sets cookies and involves a transfer to the United States, so it runs only if you accept it. Refusing changes nothing about the service: the reading, the report and your account work identically.

Cookies strictly necessary to run the service, such as keeping you signed in, are set without consent because the service cannot work without them. We use no advertising cookie and no social network cookie.

Your rights

You can ask for access to the data held about you, for its correction, for its deletion, for the processing to be restricted, and for your data to be handed to you in a portable form. You can withdraw your consent at any time, and you can object to processing based on our legitimate interest.

Write to contact@blood-interpretation.com. We answer within one month, and we say so if a request needs longer.

If our answer does not satisfy you, you can lodge a complaint with the CNIL, the French supervisory authority, at cnil.fr.

Changes to this policy

This policy changes when the service changes, and the date of the last revision appears at the foot of the page. A change that affects what we do with your report will be announced rather than slipped in.