Privacy policy

What this policy has to cover

Most privacy policies describe a site that collects an email address. This one has to describe something heavier: you upload a laboratory report, and a laboratory report is health data. Under the GDPR that is a special category, processed only on narrow grounds and with more care than ordinary data.

So this page is longer than we would like, and specific where it would be easier to be vague. If a passage is unclear, write to us and we will rewrite it.

Data controller

Smart Medical Care SAS, registered office in Nice, France, SIRET 932 924 194 00016. Contact for anything on this page, including exercising your rights: contact@blood-interpretation.com.

The waiting list, now closed

Before the reader opened, the upload buttons led to a form that asked for one thing: an email address, so that we could write when the reader opened, along with the language you were reading in and the page you were on. That form has been removed, and no address is collected this way any more.

The legal basis for the addresses already on the list is the consent given by submitting the form. We use them for that one message and nothing else, we do not pass them to anyone, and you can ask us to delete yours at any time at the address above. The list is erased once everyone on it has been written to.

What we process when you upload a report

The report you upload, as a file and as the values read from it. Your name is removed from the document before the analysis: the engine works on your values and the context you give, not on your identity.

The context you provide: age, sex, and the answers to the questions asked before the reading, because a value is read differently at twenty-five and at seventy.

Your account: the email address used to create it, and the reports kept in it so that one can be read against the next. A trend carries information a single snapshot does not.

Payment, if you buy a full report: handled by our payment provider. We never see or store your card details.

Technical data: server logs needed to run the service and to keep it secure.

Purposes and legal bases

Producing your full report: your explicit consent to the processing of health data, given when you upload the report. You can withdraw it at any time by deleting the report or your account, which stops the processing for the future.

Keeping your reports so they can be compared over time: the same explicit consent. If you would rather not keep them, delete them and nothing remains.

Taking payment: performance of the contract between you and us.

Running and securing the service, and measuring audience: our legitimate interest in a site that works and that we can improve, balanced against your rights. Audience measurement is covered below, because it needs your consent rather than our interest alone.

Who else sees the data

The interpretation engine. Reading a report and writing the explanations calls an artificial intelligence provider established outside the European Union, acting as our processor under contract. Your report is sent for that single purpose. It is not used to train the provider’s models, and it is never sold or shared for any other purpose.

Our hosting provider, Outscale, a French company certified as a health data host (HDS), which stores the data in France and runs the service.

Our payment provider, for purchases only, which receives what a payment requires and nothing about your results.

Nobody else. Your report is not shared with insurers, employers, advertisers or any other service, and it is not a source of data for anything sold elsewhere.

Transfers outside the European Union

One of the providers above is established in the United States: the artificial intelligence provider. Your data is hosted in France by Outscale, but the health data you upload leaves the European Union to be read.

These transfers rest on the safeguards the GDPR provides for them, standard contractual clauses and the adequacy framework that applies to certified United States organizations. We state this plainly rather than burying it, because it is the part of this policy a reader is most entitled to know.

How long we keep it

Your reports and your account are kept for as long as your account exists, because keeping them is what allows a reading to be compared with the previous one. There is no automatic expiry that would delete a history you chose to build.

You can delete a single report, or your entire account, at any time from your account. Deleting the account removes the reports with it.

Technical logs are kept for the limited period needed for security and troubleshooting. Records connected to a purchase are kept for the period French accounting and tax law requires.

Cookies and audience measurement

This site uses Google Analytics 4 to measure audience. That tool sets cookies and involves a transfer to the United States, so it runs only if you accept it. Refusing changes nothing about the service: the reading, the report and your account work identically.

Your choice is kept for six months, after which we ask again. You can change your mind at any time with the “Manage cookies” link at the bottom of every page; withdrawing your agreement stops the measurement and deletes its cookies.

Cookies strictly necessary to run the service, such as keeping you signed in, are set without consent because the service cannot work without them. We use no advertising cookie and no social network cookie.

Your rights

You can ask for access to the data held about you, for its correction, for its deletion, for the processing to be restricted, and for your data to be handed to you in a portable form. You can withdraw your consent at any time, and you can object to processing based on our legitimate interest.

Write to contact@blood-interpretation.com. We answer within one month, and we say so if a request needs longer.

If our answer does not satisfy you, you can lodge a complaint with the CNIL, the French supervisory authority, at cnil.fr.

Changes to this policy

This policy changes when the service changes, and the date of the last revision appears at the foot of the page. A change that affects what we do with your report will be announced rather than slipped in.