Legal
Last updated: Mar 3, 2026
This Privacy Policy ("Policy") explains how Bloodwork.app ("Bloodwork.app," "we," "our," or "us") collects, uses, discloses, and protects your personal information when you use our website, platform, mobile applications, and any related services (collectively, the "Services").
This Policy applies to all users located anywhere in the world, with a primary focus on compliance with U.S. privacy requirements and general global privacy expectations. This Policy works alongside our Health Data Privacy Notice, which governs our handling of health-related data specifically.
By using the Services, you agree to the collection and use of information as described in this Policy.
If you do not agree, you must stop using the Services.
We may collect the following categories of information:
With your authorization, we may receive data from:
All such data is processed according to your permissions.
We may create aggregated, anonymized, or de-identified datasets that cannot identify you. We may use or share these for analytics, research, or improvement.
We use personal information to:
We may also use aggregated or de-identified data for research, analytics, and product development.
Service communications and recommendations: As part of the Bloodwork service experience, and where you have agreed to receive communications, we send personalized health insights, results-based recommendations, and service updates by email. These communications are integral to how Bloodwork delivers value and may include health-affiliated product suggestions relevant to your health profile (for example, supplements that may address a biomarker you are tracking). We do not share your health data or personal information with third parties for their own marketing purposes. You may unsubscribe from these communications at any time by clicking "Unsubscribe" in any email or by contacting privacy@bloodwork.app. Unsubscribing will not affect your access to the core Services.
Depending on your jurisdiction, you may have rights such as:
Right to object to direct marketing (absolute right): You may opt out of marketing emails at any time, without providing a reason, by clicking "Unsubscribe" in any marketing email or by contacting us at privacy@bloodwork.app. We will action this request immediately and without charge.
California — Limit Use of Sensitive Personal Information (CPRA): Under the California Privacy Rights Act, California residents may request that we limit the use of sensitive personal information — which includes health data — to uses necessary to provide the Services. To exercise this right, email privacy@bloodwork.app with the subject line "Limit Sensitive PI."
California — Shine the Light (Civil Code § 1798.83): Bloodwork does not share personal information with third parties for their own direct marketing purposes. California residents who wish to confirm this, or who have additional questions, may contact us at privacy@bloodwork.app.
Response timelines: We will respond to rights requests within 30 days of receipt. For complex or high-volume requests, we may extend this period by up to an additional 60 days, with prior written notice. For users exercising rights under the California Consumer Privacy Act (CCPA) or similar U.S. state laws, we will respond within 45 days, with a possible 45-day extension where reasonably necessary.
To exercise any of the above rights, email: privacy@bloodwork.app
We may require identity verification before processing your request.
We retain personal information:
When data is no longer required, we delete or anonymize it.
We use industry-standard security measures, including:
No method of transmission or storage is 100% secure. We cannot guarantee absolute security.
Bloodwork.app is operated from the United States. If you access the Services from outside the U.S., your personal data will be transferred to and processed in the United States, where data protection laws may differ from those in your country.
For users in the European Economic Area (EEA), United Kingdom, or Switzerland, we use legal mechanisms — including standard contractual clauses and other contractual safeguards — to help ensure your rights and protections travel with your data. We do not rely solely on consent as the basis for international data transfers.
By using the Services from outside the U.S., you acknowledge that your data will be processed in the United States in accordance with this Policy and applicable transfer safeguards.
For users in the European Economic Area, United Kingdom, or Switzerland, we process personal data under the following lawful bases:
Automated processing (GDPR Article 22): Bloodwork uses AI models to process your health data and generate personalized health outputs including scores, insights, and action plans. To the extent GDPR Article 22 applies to such processing, you have the right to request human review of any AI-generated output, to express your view, and to contest any output you believe is inaccurate. To exercise this right, email privacy@bloodwork.app with the subject line "AI Output Review Request," the date of the output, and a description of your concern. We will respond within 45 days. For full details on how AI processing works, see our Health Data Privacy Notice (Section 3H).
The Services are not intended for children under 18 without parental consent. We do not knowingly collect personal data from children under 13 in compliance with the Children's Online Privacy Protection Act (COPPA), or under 16 where required by applicable law (including the GDPR).
If we discover that we have inadvertently collected data from a child under 13, we will delete it promptly. Parents or guardians who believe we have collected their child's data may contact us at privacy@bloodwork.app.
The Services may contain links to third-party sites or services that we do not control. This Policy does not apply to those third-party sites.
You are responsible for reviewing their privacy policies.
We may use aggregated, de-identified data derived from user activity for research, product development, publication of health insights, and training and improving our AI models. This data cannot be linked back to any individual user.
If you do not wish for your anonymized, de-identified data to be included in research, published analyses, or AI model training, you may opt out at any time by contacting us at privacy@bloodwork.app with the subject line "Research Opt-Out" (this covers both research and AI training opt-out). Opting out does not affect your access to the Services.
We may update this Policy from time to time.
Material changes may be communicated via email or in-app notices.
Continued use of the Services constitutes acceptance of the updated Policy.
For privacy questions, rights requests, or complaints:
Bloodwork – Privacy Department
privacy@bloodwork.appGDPR / EEA / UK inquiries: For data protection queries from users in the European Economic Area, United Kingdom, or Switzerland, please contact us at privacy@bloodwork.app. You also have the right to lodge a complaint with your local data protection supervisory authority.
California residents — Do Not Sell or Share: To opt out of the sale or sharing of your personal information under the CCPA, or to exercise any other California privacy rights, contact us at privacy@bloodwork.app with the subject line "CCPA Privacy Request."