Bloodwork AI processes sensitive health information. This policy explains what we collect, why, and your rights under South Africa's Protection of Personal Information Act (POPIA). Health data is “special personal information” under POPIA and is handled with heightened care.
What we collect
- Account details (email, password hash).
- Profile you provide (age, sex, height, weight, activity, medications, supplements, symptoms, goals).
- Bloodwork you upload (the PDF and the markers extracted from it).
- Questions you ask and reports you generate.
Why we process it (lawful basis)
We process your health data only with your explicit consent, given at sign-up, and solely to provide the Service to you — extracting and interpreting your results, personalising information, and answering your questions. We do not use it for any other purpose.
AI processing
To generate analyses and answers, relevant data is sent to our AI provider (Anthropic) strictly to produce your result. We do not sell your data, and we do not use your health data to train models.
Automated processing
Classifications and suggestions are generated automatically. They are educational only and are not decisions with legal or similarly significant effects. You can request human context by consulting your own clinician.
Security & retention
Data is encrypted in transit and at rest, access is restricted, and it is stored only as long as needed to provide the Service. You can delete any upload, your memory data, or your whole account at any time.
Cross-border transfer
Some processing (e.g. AI and hosting) may occur outside South Africa. Where it does, we rely on POPIA-permitted safeguards.
Your POPIA rights
- Access, correct, or delete your personal information.
- Withdraw consent (which ends processing and your use of the Service).
- Object to processing and lodge a complaint with the Information Regulator.
- Export your data (available in-app under “My data”).
Information Officer / contact
Privacy requests: legal@bloodworkai.com.