Privacy policy.

Who this notice is about

This notice covers the BloodPanel website and blood test guide. The legal name, address and privacy contact of the business responsible for your information will be added before public launch. It does not cover the independent providers linked from this website.

What you share

The guide receives the messages you send, including any test names, reasons for your search and location you choose to provide. Each new message is stored on the server, whether or not you have an account. The server retrieves earlier, unexpired messages to follow the conversation and find relevant listings.

A town is enough to start. You do not need to provide your name, date of birth, full address, payment details or medical records. Health information is sensitive, so share only what is needed for your search and avoid identifying information about yourself or someone else.

How the guide uses it

Your messages and location are used to understand your search, match published listings and generate a reply. Matching is automated; it does not diagnose you, determine your eligibility for care or make a booking. You choose whether to contact a provider.

The guide supports an optional AI reply service using Cloudflare AI Gateway and Workers AI. When enabled, Cloudflare receives the conversation and matching context, including location and test preferences, so the guide can generate and safety-check a reply. The processing regions and international-transfer arrangements still need to be confirmed before public launch.

Chat history, cookies and technical data

All chat messages, including anonymous chats, are stored in our private database. Each message expires 14 days after it is first stored. Replies have their own expiry. Reading, retrying or linking a chat to an account does not restart that period. Expired messages are excluded from your history and the guide’s context immediately, then removed by scheduled cleanup.

A first-party browser cookie protects access to anonymous conversations. Your browser remembers the last conversation for up to 12 days, using only an identifier and an expiry time. Message text is not stored in local storage. There is no unsaved private-chat mode. Starting over starts a new conversation; it does not delete the previous one.

WhatsApp verification can link your existing conversation to an account so you can return on another device. The pending link expires after 90 minutes; cancelling it cancels the link, not the conversation. You can delete chats from “My chats” or delete your account. The 14-day message limit also applies to signed-in accounts. Infrastructure logs and backups have separate arrangements that still need to be confirmed before launch.

We use Meta’s WhatsApp Business Platform to receive your unique phrase and browser approval. Meta processes those messages and your WhatsApp identity under its own terms. We use that identity to connect your account; the prepared and approval messages do not contain your blood test conversation. Authentication details are not sent to the guide’s AI service. First-party cookies identify your anonymous browser and keep you signed in, subject to expiry and your browser settings. Local storage contains only preferences and conversation identifiers, never conversation text or authentication credentials.

Signing out clears the remembered conversation identifier and the conversation displayed on the page. Clearing browser storage does not delete chats saved in your account. Use “My chats” to delete them.

BloodPanel has no advertising tracking. If you enable optional usage counts, the application stores only a daily total and event category for comparison completions and directory-link clicks. It does not store a visitor identifier, search text, selected tests, location, contact details or raw request body in these counters. Your choice is held in page memory and resets on refresh. You can disable it at any time; previously aggregated counts cannot identify or isolate your contribution. Daily counts older than 90 days are removed on the next count or operator report. Servers and hosting services may process technical request data, such as an IP address, browser information and request time. The production logging and retention arrangements have not yet been confirmed. The 14-day application message policy does not describe retention by those infrastructure providers.

When the AI reply service is enabled, we separately retain a private audit record of every complete request sent to the model and every response or error returned. This can include your messages, earlier conversation context, location, matched listing context, the guide’s instructions, generated replies and safety-filter outcomes. If a safety filter withholds a reply, the record contains the outcome and error information Cloudflare returns, not text that was withheld.

AI audit records do not use the 14-day chat-history expiry. They are retained until an authorised operator deletes them for safety, security and service investigation. Deleting a chat or account does not automatically delete its AI audit records. They are kept in private application storage and are not shown in ordinary chat history. The business must confirm the legal basis, access controls and process for handling data-rights requests before public launch.

Purchase demonstrations

If you choose to try a purchase demonstration through the BloodPanel connector, we ask for an email address and your acceptance before storing it with the selected test, clinic, sample time, catalogue amount and simulated payment result in our private database. You can use a test email. We do not verify ownership of the address, send an email, collect card details, contact Stripe or book an appointment.

The receipt masks the email address. These demo records do not create an account or memories and are retained until an authorised operator deletes them. They are not linked to your account, so deleting an account or chat does not automatically delete a demo purchase record.

When you visit a provider

BloodPanel does not send your conversation to a clinic to make a booking. Following a provider link opens a separate website. Any information you give there, including booking details, payment or test results, is handled under that provider’s own privacy notice.

The basis for processing

Sending a message asks the guide to process and store it as described in this notice. Linking a conversation to an account changes how you return to it; it does not create a separate copy or change the 14-day chat-history period. Sending a message does not give permission for wider use of your information.

Before public launch, the business must confirm and explain the legal basis for each purpose, including account verification, the guest guide and the additional condition required for health information. The arrangements for Meta’s WhatsApp Business Platform and Cloudflare, processing regions and any international-transfer safeguards must also be confirmed.

Your rights and questions

Depending on the circumstances, you can ask to access, correct or erase your personal data, restrict or object to its use, or receive a portable copy. Where processing relies on consent, you can withdraw it. The contact route for these requests will be added with the confirmed business details.

You can also raise a concern with Ireland’s Data Protection Commission. Read more about the information a privacy notice should provide in the DPC’s transparency guidance.

See our Terms of use for how the guide and provider links work.