privacy policy

last updated: October 10, 2026

Bloodwork reads your lab reports so you can see your results over time. this page says what it keeps, who else sees what, and how to delete it.

what Bloodwork keeps

your account: the email Apple gives us when you sign in, and your name if you let Apple share it
the reports you add (the PDF files) and the values read from them
About you: your date of birth and sex, so each result is held against the ranges for your age and sex
the Apple Health kinds you choose to keep in your account (below)
your credit purchases: Apple's transaction number, so each pack is added once

trying it without an account

an iPhone can read one report without signing in. that report is deleted 48 hours later, unless you sign in, and then it moves to your account
to keep it to one per iPhone, Apple's DeviceCheck holds a single yes or no for the device. it says nothing about you
the site can read one report without an account too. a cookie in your browser holds the key to that report for 48 hours; the report is deleted then, unless you sign in, and then it moves to your account
Cloudflare Turnstile checks that the site's visitor is a person before that report is read

Apple Health

Bloodwork only reads from Apple Health. it never writes to it
you choose per kind: off, on this iPhone, or on this iPhone and in your account. only the last is sent to Bloodwork
turning a kind down deletes its copy from your account at once. stopping sync deletes all of it
your date of birth and sex from Apple Health can fill About you
Apple Health data is never used for advertising and never sold

who else sees what

Anthropic (Claude) reads each PDF to find the values. the copy sent to Anthropic is deleted as soon as the reading is done
Cloudflare Workers AI runs the model that matches each printed test name to the catalog. it sees the test name, its unit and the heading above it, never your name, a date or the report
Cloudflare runs the service and stores the PDFs, in the EU. PlanetScale holds the database, in the EU (Dublin)
tinysend sends the email with your sign-in code. it is made by system operator, the company behind Bloodwork
Apple signs you in, handles purchases, and shows the progress card while a report is read. the code for that card is kept for three hours
the App Store version sends Apple's crash, freeze and speed reports to diagnostics.jarkeeper.com, also run by system operator. they hold no health data and are not linked to your account
you can connect your account to an AI assistant such as Claude, at mcp.bloodwork.md. after you approve it on Bloodwork's own page, the assistant can read your results when you ask it, and never change them; what it reads is then held under that assistant's own privacy policy
the site counts four steps at jarkeeper.com: the add page opened, a report added, a visitor turned away, and a report kept by signing in, each with the name of the site the visit came from (google.com, chatgpt.com) and the country. the counts hold no name, email, IP address, cookie or health data and are not linked to your account
no one else. no ads, no trackers, nothing sold. your reports and Apple Health data are not used to train any model

how long

everything stays until you delete a report or your account
deleting a report deletes its PDF, its values and everything made while reading it
deleting your account deletes all of it at once, every file included
when you accept the terms on the site, the time, IP address and browser are noted as the record of that. it stays after you delete your account, no longer linked to it
the servers keep short logs, for about a week, to fix problems

your choices

download everything Bloodwork holds about you as one file: Account › Download My Data, on the site
change About you at any time
delete a report on the site, or your account on the site or in the app

changes

if this page changes in a way that matters, we'll tell you by email first.

contact

questions about privacy: hi@bloodwork.md.

operated by System Operator LLC, Delaware, USA.