Privacy Policy — LabsFive for Doctors

1. Introduction

This Privacy Policy describes how LabsFive ("LabsFive," "we," "us," or "our") collects, uses, stores, and protects information in connection with the LabsFive for Doctors portal (the "Portal"), a subscription and credit-based service that allows licensed healthcare professionals ("you," "physician," or "médico") to generate AI-assisted, plain-language interpretations of clinical laboratory results for their own patients.

This is a separate document from the Privacy Policy that governs LabsFive's direct-to-consumer service at LabsFive.com. It exists separately because the Portal involves a materially different relationship: you are a professional account holder, and the data that flows through your account belongs, in significant part, to your patients — not to you personally and not to LabsFive. Read Section 3 before anything else in this document; it explains that distinction and why it matters.

By creating a Portal account or submitting any information through it, you acknowledge that you have read, understood, and agree to the practices described in this Privacy Policy.

2. Who We Are

LabsFive is a health technology company. The Portal is a professional tool that uses artificial intelligence to help licensed physicians generate educational, patient-facing explanations of laboratory results. LabsFive is not a medical provider, a diagnostic laboratory, or a healthcare institution, and using the Portal does not create a doctor-patient relationship between you and LabsFive.

Questions about this policy can be directed to privacy@labsfive.com at any time.

3. Two Kinds of Data This Policy Covers

Read this section carefully — it is the key to understanding everything else in this policy. The Portal handles two categories of data that are legally and practically different, and this policy treats them differently on purpose:

• Your account data — your name, email, password, subscription/credit history, and payment records. This is your data. LabsFive is the party responsible for deciding how it is used (what's called a "data controller" under most privacy frameworks).
• Your patients' data — the lab documents you upload and the patient information you enter (name, age, sex, and any clinical context) when generating a report. This is not LabsFive's data to make decisions about. When you submit a patient's information to generate a report, you are acting as the data controller for that patient's information, and LabsFive processes it on your behalf and under your instruction — the role generally referred to as a "data processor" or "business associate."

Practically, this means: you are responsible for having the appropriate legal basis (patient consent, or whatever your own professional and legal obligations require) before submitting a patient's information to generate a report through the Portal. LabsFive's responsibility is to handle that data securely and only for the purpose of producing the report you requested — never to reuse it, sell it, or apply it to anyone else's report.

4. Physician Account Data

When you create and use a Portal account, we collect:

• Full name and email address
• Password (stored as a one-way cryptographic hash — we never store or have access to your actual password)
• Subscription plan, credit balance, and credit transaction history
• Payment and billing information, processed exclusively by Stripe, Inc. — LabsFive never collects or stores your card number or other financial credentials directly
• Basic technical/usage data (IP address, browser type, pages visited) collected automatically for security and service reliability

5. Patient Data Submitted Through Reports

When you generate a report, you submit, on your patient's behalf:

• The lab document itself (which may include the patient's name, date of birth, and clinical values)
• Patient age, biological sex, and any additional clinical context you choose to provide (menopausal status, activity level, medications, notes)

This data is used exclusively to generate the specific report you requested. It is processed through our AI infrastructure and PDF rendering provider under the same processing terms described in Section 9, and it is never used to train any AI model, never shared with any other physician's account, and never used for any purpose beyond producing your report and making it available for you to download from your dashboard.

You are responsible for ensuring you have the appropriate authorization from your patient (or under your applicable professional/legal obligations) before submitting their information. LabsFive has no independent relationship with your patients and does not verify patient consent on your behalf.

6. Healthcare Data Compliance Status

Read this section before submitting any real patient information. We are stating our current compliance posture plainly, without overstating it:

The Portal is built with data protection as a design principle — access controls, encryption, and limiting which vendors ever see patient data — but as of the date at the top of this page, LabsFive has not executed Business Associate Agreements (BAAs) with every third-party vendor involved in the Portal's operation, and does not represent that the Portal is fully HIPAA-compliant in every respect a Covered Entity or Business Associate relationship may require.

If your use of the Portal is subject to HIPAA or an equivalent healthcare data protection law in your jurisdiction, you are responsible for independently determining whether your use of the Portal satisfies your own legal obligations, and for not submitting patient information through the Portal in a manner that would violate those obligations. If a signed Business Associate Agreement is a requirement for your use of the Portal, contact privacy@labsfive.com before submitting any patient data — do not assume one is already in place.

This section will be updated as LabsFive's compliance posture evolves. We would rather tell you exactly where things stand today than make a broad compliance claim we cannot yet fully stand behind.

7. How We Use Your Information

• To operate your account: authenticate you, track your subscription and credit balance, and maintain your report history.
• To generate reports: the patient data you submit for a specific report is used solely to produce that report.
• To process payments: your payment information is passed directly to Stripe; we receive only confirmation of payment, never card details.
• To communicate with you: account confirmations, password resets, email verification, receipts, and support responses.
• To comply with legal obligations: where required by applicable law, regulatory authority, or court order.

We do not use patient data submitted through reports for advertising, marketing, or AI model training, under any circumstances.

8. How We Store and Protect Information

Encryption in transit: all data transmitted between your device and our servers is encrypted using TLS 1.2 or higher.

Access controls: access to physician account data and patient report data is limited to the systems and personnel that require it to operate the Portal.

Generated reports: completed report PDFs are stored so you can access your report history from your dashboard, and are accessible only to your own account.

No method of electronic storage or transmission is 100% secure. In the event of a data breach affecting your account or patient data processed on your behalf, we will notify you in accordance with applicable law.

9. Data Retention

• Account data: retained for as long as your account remains active, and for a limited period afterward for legal, billing, and fraud-prevention purposes.
• Generated reports: retained so they remain available in your dashboard's report history. You may request deletion of specific reports or your entire account at any time.
• Payment records: retained as required by financial and tax regulations, maintained by Stripe.

To request deletion of your account or specific data, contact privacy@labsfive.com. We will process deletion requests within 30 days.

10. Sharing of Information

We do not sell, rent, or trade physician account data or patient data submitted through reports. We share data only in these limited circumstances:

• Stripe, Inc. — payment processing (account data only, never patient/report data).
• AI processing infrastructure — patient data from a submitted lab document is processed to generate your report, under terms that prohibit its use for model training or any purpose beyond that report.
• PDF rendering and file storage infrastructure — used to produce and store your generated report PDFs.
• Legal requirements — if required by law, subpoena, or court order.
• Business transfers — in the event of a merger or acquisition, subject to notice as described in Section 13.

11. Your Rights

You may request access to, correction of, or deletion of your account data at any time by contacting privacy@labsfive.com. Because report data concerns your patients and not you personally, requests to access or delete specific patient report data should be made by you as the physician responsible for that patient's care, consistent with your own professional and legal obligations.

12. Cookies and Tracking Technologies

The marketing pages of LabsFive for Doctors (including this page and the landing page) use the same cookies and analytics described in LabsFive's site-wide Cookie Policy — that policy is not duplicated here since the underlying technology doesn't change between the B2C and B2B sections of the site. The Portal application itself (app.labsfive.com) uses only a single essential session cookie required to keep you signed in; it is not used for advertising or tracking.

13. Third-Party Services

The Portal integrates with the following third-party providers, each operating under its own privacy policy:

• Stripe, Inc. — Payment processing. stripe.com/privacy
• Anthropic, PBC — AI language model used to generate report content. anthropic.com/privacy
• Netlify, Inc. — Infrastructure used to store generated report files.
• Resend — Email delivery for account verification and password reset.
• Supabase — Database infrastructure for account and subscription data.

LabsFive is not responsible for the independent privacy practices of these providers.

14. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices, technology, legal requirements, or compliance posture (see Section 6 in particular). When we make material changes, we will update the "Last Updated" date and, where the change materially affects your rights or obligations, notify accounts that have been active in the prior 90 days by email.

15. Contact Us

LabsFive Privacy Team
Email: privacy@labsfive.com
Website: LabsFive.com/for-doctors