Privacy Policy

1. Introduction

This Privacy Policy describes how LabsFive ("LabsFive," "we," "us," or "our") collects, uses, stores, and protects the personal information you provide when using our website located at LabsFive.com and our lab result interpretation service (collectively, the "Service").

By accessing or using our Service, you acknowledge that you have read, understood, and agree to the practices described in this Privacy Policy. If you do not agree with this policy, please do not use our Service.

We take the privacy of health-related data with the utmost seriousness. This document is designed to be transparent, specific, and written in plain language — not to obscure what we do with your data, but to make it genuinely clear.

2. Who We Are

LabsFive is a health technology service that provides AI-powered educational interpretations of clinical laboratory results. We are not a medical provider, a diagnostic laboratory, or a healthcare institution. Our Service is intended for informational and educational purposes only.

For the purposes of applicable data protection laws, including the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), LabsFive acts as the data controller for the personal information you submit through our Service.

If you have any questions about our data practices, you may contact us at any time at privacy@labsfive.com.

3. Information We Collect

We collect only the information that is strictly necessary to provide you with our Service. We do not collect data for advertising, we do not build behavioral profiles, and we do not sell your information under any circumstances.

3.1 Information You Provide Directly

When you use our Service, you voluntarily provide us with the following:

• Full name
• Email address
• Age
• Biological sex (used exclusively to contextualize lab reference ranges)
• Clinical laboratory results, which may include blood panels, metabolic panels, lipid profiles, thyroid panels, hormone levels, and other biomarker data contained in the document you upload

3.2 Payment Information

Payment processing is handled exclusively by Stripe, Inc., a third-party payment processor. LabsFive does not collect, store, or have access to your credit card number, billing address, or any other financial credentials. All payment data is processed and stored by Stripe in accordance with their own Privacy Policy and PCI-DSS compliance standards.

3.3 Technical Information Collected Automatically

When you visit our website, we may automatically collect certain technical information, including:

• IP address
• Browser type and version
• Device type and operating system
• Pages visited and time spent on each page
• Referring URL

This information is collected through standard web server logs and, where applicable, analytics tools. It is used solely to maintain the security and performance of our website and to understand aggregate usage patterns. It is not linked to your personal identity or health data.

4. How We Use Your Information

We use the information you provide exclusively for the following purposes:

• To deliver the Service: Your name, email, age, biological sex, and uploaded lab document are used solely to generate and deliver your personalized lab interpretation report.
• To communicate with you: We use your email address to send your completed report, to confirm receipt of your submission, and to respond to any inquiries or support requests you initiate.
• To process your payment: Your payment information is passed directly to Stripe for processing. We receive only a payment confirmation from Stripe — never your card details.
• To improve our Service: We may use anonymized, de-identified aggregate data — meaning data from which all personal identifiers have been irreversibly removed — to evaluate and improve the quality of our AI interpretation model. This anonymized data cannot be traced back to any individual.
• To comply with legal obligations: We may process your data as required by applicable law, regulatory authority, or court order.

We will never use your health data for advertising, marketing profiling, or any purpose beyond those explicitly stated above.

5. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, we process your personal data under the following legal bases as defined by the General Data Protection Regulation (GDPR):

• Contractual necessity (Article 6(1)(b)): Processing your name, email, age, biological sex, and lab document is necessary to perform the Service you have contracted us to provide.
• Explicit consent (Article 9(2)(a)): Because your lab results constitute special category health data under GDPR Article 9, we require and rely on your explicit, informed consent before processing this data. This consent is obtained at the point of submission through a clear affirmative action.
• Legitimate interests (Article 6(1)(f)): We process technical and usage data to maintain the security and functionality of our platform, where such interests are not overridden by your fundamental rights.
• Legal obligation (Article 6(1)(c)): In limited circumstances, we may process data to comply with a legal obligation to which we are subject.

You have the right to withdraw your consent at any time by contacting us at privacy@labsfive.com. Withdrawal of consent does not affect the lawfulness of processing conducted prior to withdrawal.

6. How We Store and Protect Your Information

We implement industry-standard technical and organizational measures to protect your personal and health data from unauthorized access, disclosure, alteration, or destruction.

Encryption in transit: All data transmitted between your device and our servers is encrypted using TLS 1.2 or higher (HTTPS). Your uploaded lab documents are never transmitted over unencrypted connections.

Encryption at rest: Personal data and uploaded documents stored on our servers are encrypted at rest using AES-256 encryption.

Access controls: Access to personal data is strictly limited to personnel and automated systems that require it to perform the Service. No human employee reads your lab results except in exceptional circumstances where manual quality review is necessary, in which case access is logged and audited.

Secure infrastructure: Our Service is hosted on infrastructure that maintains SOC 2 Type II compliance and undergoes regular security audits.

Despite these measures, no method of electronic storage or transmission is 100% secure. While we strive to protect your data using commercially reasonable means, we cannot guarantee absolute security. In the event of a data breach that affects your personal information, we will notify you in accordance with applicable law.

7. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this Privacy Policy.

• Uploaded lab documents: Deleted from our systems within 24 hours of your report being delivered to your email address.
• Interpreted report content: Retained in anonymized form for service quality purposes. The version linked to your identity is deleted within 30 days of delivery unless you request earlier deletion.
• Your name and email address: Retained for 90 days following your transaction to allow for support inquiries, refund processing, and legal compliance, then permanently deleted.
• Payment records: Retained for 7 years as required by financial and tax regulations. These records are maintained by Stripe and contain no health data.
• Technical logs: Retained for a maximum of 90 days, then automatically purged.

You may request immediate deletion of your personal data at any time by contacting privacy@labsfive.com. We will process deletion requests within 30 days and confirm completion in writing.

8. Sharing of Information

We do not sell, rent, trade, or share your personal or health data with third parties for commercial purposes. Period.

We share your data only in the following limited and specific circumstances:

• Stripe, Inc.: To process your payment. Stripe receives your email and payment details only. Stripe does not receive your lab documents or health data.
• Email delivery provider: We use a third-party email service (such as Resend or SendGrid) to deliver your report to your inbox. This provider receives your email address and the report PDF. They are contractually prohibited from using this data for any other purpose.
• AI processing infrastructure: Your lab data is processed through an AI language model API to generate your interpretation. This processing is conducted under strict data processing agreements that prohibit the use of your data for model training or any other purpose.
• Legal requirements: We may disclose your information if required to do so by law, subpoena, court order, or governmental authority, or if we believe in good faith that such disclosure is necessary to protect our rights, protect your safety or the safety of others, or investigate fraud.
• Business transfers: In the event of a merger, acquisition, or sale of all or substantially all of our assets, your data may be transferred to the acquiring entity. You will be notified of any such transfer and any changes to this Privacy Policy before the transfer takes place.

All third-party service providers we engage are carefully selected and required to maintain confidentiality and security standards consistent with this Privacy Policy.

9. Your Rights

Depending on your location, you may have the following rights regarding your personal data. We honor all of these rights regardless of your jurisdiction — not because the law requires it in every case, but because we believe it is the right way to operate.

• Right to Access: You may request a copy of all personal data we hold about you.
• Right to Rectification: You may request correction of inaccurate or incomplete personal data.
• Right to Erasure ("Right to be Forgotten"): You may request that we delete all personal data associated with you, subject to legal retention obligations.
• Right to Restrict Processing: You may request that we limit the processing of your data in certain circumstances.
• Right to Data Portability: You may request your data in a structured, machine-readable format.
• Right to Object: You may object to processing based on legitimate interests.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time without affecting prior lawful processing.
• Right to Lodge a Complaint: If you are in the EEA, you have the right to lodge a complaint with your local data protection supervisory authority.

To exercise any of these rights, contact us at privacy@labsfive.com with the subject line "Data Rights Request." We will respond within 30 days. We may need to verify your identity before processing your request.

10. Children's Privacy

Our Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from minors. If you are a parent or guardian and believe that your child has submitted personal information to us, please contact us immediately at privacy@labsfive.com and we will take prompt steps to delete that information from our systems.

If you are under 18, please do not use our Service or submit any personal information to us.

11. International Data Transfers

LabsFive operates globally and your information may be transferred to and processed in countries other than your own, including the United States, where data protection laws may differ from those in your jurisdiction.

When we transfer personal data from the EEA, UK, or Switzerland to countries not recognized as providing an adequate level of data protection, we implement appropriate safeguards including Standard Contractual Clauses (SCCs) approved by the European Commission, or we rely on other legally recognized transfer mechanisms.

By using our Service, you acknowledge that your data may be transferred internationally in accordance with this Privacy Policy and applicable law.

12. Cookies and Tracking Technologies

Our website uses cookies and similar tracking technologies to operate and improve the Service.

Essential cookies: Required for the website to function. They enable core features such as page navigation and access to secure areas. These cannot be disabled.

Analytics cookies: We may use tools such as Google Analytics to understand aggregate usage patterns — how many people visit, which pages are most viewed, and how users navigate through the site. This data is anonymized and aggregated. You may opt out of analytics tracking by enabling Do Not Track in your browser or using the Google Analytics opt-out browser add-on.

Advertising cookies: We use Google Ads and the Meta (Facebook) Pixel to measure ad performance (for example, linking an ad click to a completed purchase) and to show LabsFive ads to prior visitors and customers on Google and Meta platforms. We do not allow any advertising network other than Google Ads and Meta to place cookies on our site, and no health information is ever included in the data sent to either platform. See our Cookie Policy for the full list of cookies and how to opt out.

You may control cookies through your browser settings. Disabling essential cookies may affect the functionality of our Service.

13. Third-Party Services

Our Service integrates with the following third-party providers. Each operates under its own privacy policy, which we encourage you to review:

• Stripe, Inc. — Payment processing. Privacy Policy: stripe.com/privacy
• Anthropic, PBC — AI language model used to generate lab interpretations. Privacy Policy: anthropic.com/privacy
• Resend / SendGrid — Email delivery. Subject to their respective privacy policies.
• Google Analytics & Google Ads — Website analytics and ad conversion measurement. Privacy Policy: policies.google.com/privacy
• Meta (Facebook), Inc. — Meta Pixel for ad measurement and remarketing. Privacy Policy: facebook.com/privacy/policy

LabsFive is not responsible for the privacy practices of these third parties. We select partners who maintain high standards of data protection and we have data processing agreements in place with each provider that handles personal data on our behalf.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page
• Post a notice on our website homepage for a minimum of 30 days
• Send an email notification to users who have transacted with us in the prior 90 days

Your continued use of the Service after the effective date of any changes constitutes your acceptance of the updated Privacy Policy. If you do not agree to the updated terms, you must discontinue use of the Service.

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

LabsFive Privacy Team
Email: privacy@labsfive.com
Website: LabsFive.com

We are committed to resolving privacy concerns promptly and transparently. All inquiries will receive a response within 5 business days.