What happens to your lab report when you upload it

Exactly where your data goes

1. 1

   Upload

   Your file arrives over an encrypted (TLS) connection into private storage. It is not public and is not shared.

2. 2

   Reading — this depends on what you uploaded

   If you upload a PDF, its text is read on our own server, with no outside reading service. The document itself, with the name and contact details printed on it, is never sent to anyone. If you upload a photo, a PDF has no text layer to read, so the image is sent to Google's Gemini to read the numbers off the page. It goes under a business API whose terms prohibit training on the content, it is used only to transcribe the values, and the identifying details on it are removed before any of your results are explained.

3. 3

   Deletion of the original

   The original file — a PDF or a photo — is deleted within seconds of being read, unless you have explicitly opted into the encrypted vault to keep it.

4. 4

   De-identification

   Before anything reaches the AI, an allowlist builder constructs the payload from scratch: an age band, sex, any conditions you typed, and the numeric values with their ranges. Names, addresses, phone numbers, doctor names, hospital IDs and dates are never included — there is no code path that copies raw report text into the AI request.

5. 5

   Analysis

   Those anonymous numbers are sent to Google Gemini under a paid business API, whose terms prohibit using the content to train models.

6. 6

   Storage

   If you have consented to keep history, values are stored encrypted at rest and encrypted again at the field level. If you have not, nothing is kept.

7. 7

   Deletion, on your terms

   One click removes everything, permanently.

Why not just paste it into ChatGPT or Gemini?

A fair, factual comparison — framed as differences in design, not an attack.

What we will never say

• —We won't tell you your report stays only on your device — its anonymous numbers are sent to Google Gemini to be explained, and that is exactly what makes the analysis possible.
• —We won't claim we cannot see your data — our servers process it to produce your results.
• —We won't claim certifications we do not hold; the certified infrastructure belongs to our providers, not to us.
• —We won't promise security that no online service can honestly guarantee — no online service can promise perfect security.

Being straight about this is the point — transparency is what makes the rest of these promises credible.

What we promise instead

• Your name and identifying details never reach the AI — only an age band, sex, and the numeric values are sent.
• Your original file is deleted within seconds unless you opt into the encrypted vault.
• The AI providers operate under business API terms that prohibit training on your data.
• Stored values are encrypted in transit, at rest, and again at the field level.
• Your data is never sold, and never shared with advertisers or data brokers.
• You can delete everything permanently, anytime.
• The infrastructure our providers run on is SOC 2 Type II / ISO 27001-certified — that describes them, not a certification we claim for ourselves.
• No online service can promise perfect security, and we won't pretend otherwise.

Frequently asked questions

Does my report go to the internet?

It depends on what you upload. A PDF is read on our own server, so the document itself is never sent to a third party. A photo has no text layer, so the image is sent to Google Gemini to read the numbers off it, then deleted. In both cases, only an age band, sex and the values with their ranges are used for the explanation — your name and contact details are never part of the analysis.

What happens if I photograph my report instead of uploading a PDF?

A photo has no text to read on our own server, so the image is sent to Google Gemini under a business API that prohibits training on it, solely to transcribe the numbers. That photo is deleted immediately afterwards, and your name and other identifying details are removed before any of your results are explained. It is a strong position — but it is a different path from a PDF, and we would rather tell you than hide it.

Can your staff read my results?

Our servers process your report to produce your results, and access is restricted and audited. We do not sell or share your data, and identifying details are removed before analysis.

Is my name sent to the AI?

No. The payload sent to the AI is built from an allowlist — an age band, sex, any conditions you typed, and the numeric values with their ranges. Your name, address, phone number, doctor and hospital IDs are never included.

Is the AI trained on my report?

No. The analysis runs on paid business APIs whose terms prohibit using your content to train models.

What if I want nothing stored?

Storage is opt-in. If you do not consent to keep history, your values are not stored, and the original file is deleted within seconds after it is read.

How do I delete everything?

One click removes your data permanently, at any time.

Is this HIPAA compliant?

HIPAA is a United States healthcare-privacy framework; this service is built for India and operates under the Digital Personal Data Protection (DPDP) framework. We do not claim a HIPAA certification. What we can point to is concrete: de-identification before analysis, deletion by default, field-level encryption, and business API terms that prohibit training on your data.