Legal
Last updated: Mar 3, 2026
This Health Data Privacy Notice ("Notice") explains how Bloodwork.app and its affiliates ("Bloodwork.app," "we," "us," or "our") collect, use, disclose, and protect Health Data and other personal data in connection with our website, platform, mobile applications, and any related products or services (collectively, the "Services").
This Notice is designed to meet or exceed requirements under applicable U.S. state consumer health data privacy laws and other global privacy regulations to the extent they apply to Bloodwork.app and its users. This Notice supplements, and should be read together with, the Bloodwork.app Privacy Policy.
By using the Services, you acknowledge this Notice. If you do not agree, please discontinue use of the Services.
Note on HIPAA: Bloodwork is not a HIPAA Covered Entity or Business Associate and does not provide clinical care, medical billing, or insurance-related services regulated under HIPAA. Your health data is governed by this Notice, our Privacy Policy, and applicable state and international consumer privacy laws — not by HIPAA.
Health Data includes any past, present, or future physical or mental health status, including but not limited to:
Any data that identifies, relates to, describes, or can reasonably be linked to an individual, such as name, email, device identifiers, IP address, payment information, or account data.
Any operation performed on data, including collection, storage, retrieval, use, disclosure, sharing, analysis, deletion, or other handling.
We may generate insights based on your data, such as:
Because Bloodwork.app offers one-time purchases and auto-renewing subscriptions, we collect:
We may create aggregated or de-identified datasets for:
Aggregated or de-identified data does not identify any individual.
We use your Health Data and Personal Data to:
As part of the Bloodwork service, and where you have agreed to receive communications during onboarding, we use your email address and health profile to send:
We do not sell, share, or disclose your Health Data or Personal Data to third parties for their own marketing or advertising purposes.
Health profile information used to personalize recommendations remains internal to Bloodwork. It is never passed to advertising networks or used to build third-party advertising profiles. You may unsubscribe from these communications at any time without affecting your access to the Services.
(never identifying individual users unless explicitly consented)
Bloodwork uses proprietary AI models to analyze your uploaded lab results, quiz responses, and health profile (collectively, your "Health Inputs") and generate personalized health insights, scores, and action plans ("AI Outputs").
AI Outputs are produced by comparing your biomarker values against clinically established reference thresholds from the sources listed in our Editorial Standards. No personally identifiable outputs are shared externally as part of this analysis.
AI Outputs are educational and informational only. They do not constitute a clinical assessment, diagnosis, or medical recommendation. They are based on population-level reference data and do not incorporate your full medical history, symptoms, medications, or the clinical context that a licensed physician would consider.
You consented to this AI-based processing during onboarding. You may withdraw this consent at any time by deleting your account or contacting privacy@bloodwork.app. Withdrawal does not affect the lawfulness of processing prior to withdrawal, but will prevent further AI analysis of your data.
You may have the following rights depending on your jurisdiction:
Right to object to marketing (absolute right): You may opt out of marketing communications at any time — without providing a reason — by clicking "Unsubscribe" in any email or contacting us. This will not affect your access to the Services.
California (CCPA/CPRA): California residents have the additional right to limit the use and disclosure of sensitive personal information (which includes health data) under the California Privacy Rights Act (CPRA). We use your health data solely to provide the Services and as described in this Notice — we do not use it for purposes beyond those you have consented to. To exercise this right, contact us with the subject line "Limit Sensitive PI."
U.S. State-Specific Rights: Users in Washington (My Health MY Data Act), Colorado (CPA), Connecticut (CTDPA), Virginia (VCDPA), California (CCPA/CPRA), and other states with consumer health data laws may have additional rights with respect to their Sensitive Health Data, including the right to consent to or opt out of certain processing. We honor all such rights upon verified request.
Response timeline: We will respond to rights requests within 30 days (extendable to 90 days for complex requests, with prior notice). CCPA requests will be addressed within 45 days (extendable to 90 days).
To exercise your rights:
Email: privacy@bloodwork.app
We retain your data:
On account deletion:
We apply industry-standard security measures such as:
No system is 100% secure, but we follow best practices to protect your data.
Bloodwork.app operates from the United States. If you use the Services from outside the U.S., your Health Data and Personal Data will be transferred to and processed in the United States, where data protection laws may differ from those in your country.
For users in the European Economic Area (EEA), United Kingdom, or Switzerland, transfers are conducted under Standard Contractual Clauses (SCCs) or other lawful transfer mechanisms under applicable data protection law. We do not rely solely on consent as the legal basis for international data transfers.
For users in the European Economic Area, United Kingdom, or Switzerland, we process personal data under the following lawful bases under the GDPR:
You may withdraw consent at any time by deleting your account or emailing us. Withdrawal does not affect the lawfulness of processing prior to withdrawal.
Automated processing (GDPR Article 22): Bloodwork uses AI models to process your health data and generate personalized outputs as described in Section 3H above. To the extent GDPR Article 22 applies to such processing, you have the right to request human review of any AI-generated output, to express your view, and to contest any output you believe is inaccurate or misleading. To exercise this right, email privacy@bloodwork.app with the subject line "AI Output Review Request," the date of the output, and a description of your concern. We will respond within 45 days.
Bloodwork.app is not intended for individuals under 18 without parental consent. We do not knowingly collect personal data or health data from children under 13 in compliance with the Children's Online Privacy Protection Act (COPPA), or under 16 where required by applicable law.
If we discover that we have inadvertently collected data from a child under 13, we will delete it promptly. Parents or guardians who believe we have collected their child's data may contact us at privacy@bloodwork.app.
We may update this Notice periodically.
We will notify users of material changes via:
Continued use constitutes acceptance.
We may use aggregated, de-identified Health Data for research, product development, publication of population-level health insights, and to develop, train, evaluate, and improve our AI models and analytical systems. Such data will not contain any information that could reasonably identify you. We do not use individually identifiable health data to train AI models.
You may opt out of having your anonymized data included in research, published analyses, or AI model training at any time by contacting us at privacy@bloodwork.app with the subject line "Research Opt-Out" (this covers both research and AI training opt-out). This does not affect your access to the Services.
Bloodwork – Privacy Department
privacy@bloodwork.appGDPR / EEA / UK inquiries: privacy@bloodwork.app
Washington / Nevada consumer health data rights: Contact us at privacy@bloodwork.app with the subject line "State Health Data Rights Request."