Privacy Policy

LabLens Interpreter is operated as an independent educational health tool. For the purposes of data protection law, the data controller is:

We collect only the data necessary to provide the service. Here is a complete list of what we collect and why:

We do not collect your full name, phone number, address, payment card details (payments are processed by Stripe), or any biometric data beyond what you voluntarily enter.

We use your data only for the following purposes:

• To provide and operate the LabLens Interpreter service
• To classify your lab results against clinical reference ranges
• To generate plain-language explanations of your results
• To send critical value alert emails when dangerous values are detected
• To send periodic health reminders if you have enabled them
• To maintain your analysis history and symptom journal
• To improve the accuracy and quality of the service

We do not use your data for advertising, profiling, or selling to third parties under any circumstances.

Our legal basis for processing under GDPR:

• Consent (Article 6(1)(a)) — you give consent when creating your account and accepting the GDPR consent gate
• Explicit consent for health data (Article 9(2)(a)) — you explicitly consent to the processing of your laboratory results (health data) and generated explanations via the consent gate before accessing the application
• Legitimate interest (Article 6(1)(f)) — for rate limiting and service protection only

Your data is stored using a secure database platform hosted in the EU West (Ireland) region. Our serverless functions run in Frankfurt, Germany. This means your data is stored and primarily processed within the European Union.

Security measures in place:

• Encryption at rest — all data is encrypted on disk
• Encryption in transit — all connections use HTTPS/TLS
• Row Level Security (RLS) — you can only access your own data
• Hashed passwords — we never store plain text passwords
• No API keys in frontend — sensitive operations happen server-side only
• JWT authentication — all API calls require a valid login session
• Rate limiting — protects against abuse (10 requests per minute per user)
• CORS restriction — API endpoints only accept requests from our domain
• Content Security Policy — protects against script injection and clickjacking
• Input sanitisation — all lab values are validated and cleaned before processing

We retain your personal data only for as long as necessary to fulfil the purposes described in this policy:

Inactive account data deletion:

If your account has been inactive for 24 months (no new analysis created), we will:

1. Send you a warning email notifying you that your data will be deleted in 30 days.
2. If you log in within 30 days, your data is preserved and the inactivity timer resets.
3. If you do not log in within 30 days, your analysis history, symptom journal, family profiles, and email preferences are permanently deleted. Your account remains active — you can log in at any time to start fresh.

You can also delete individual analyses at any time from the History view, or request full account deletion by contacting us at privacy@lablensinterpreter.com.

Under the GDPR, you have the following rights regarding your personal data:

To exercise any of these rights, contact us at privacy@lablensinterpreter.com. We will respond within 30 days as required by GDPR.

LabLens Interpreter uses only essential cookies required for the app to function:

• Authentication cookies — to keep you logged in (set by Supabase)
• Language preference — stored in localStorage to remember your language choice

We do not use advertising cookies, tracking pixels, analytics cookies, or any third-party marketing cookies.

LabLens Interpreter is intended for users aged 18 and over. We do not knowingly collect personal data from children under 18.

If you are a parent or guardian and believe your child has provided us with personal data, please contact us at privacy@lablensinterpreter.com and we will delete it promptly.

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page and notify registered users by email for significant changes.

Continued use of LabLens Interpreter after changes constitutes your acceptance of the updated policy.

For any privacy-related questions, data requests, or concerns, please contact us: