Privacy policy

Last updated 8 August 2026

This policy covers everything we do with your information on this website and in the services we provide. We collect what we need to get your test done and nothing else, and we do not sell your data to anyone, ever.

1. What we collect

Information you give us

• Your name, date of birth, sex assigned at birth, email address, telephone number, and postal address. A laboratory cannot process a specimen without these, and the physician authorizing your order cannot do so without them either.
• Any health information you choose to tell us, such as current medications, symptoms, or a reason for testing.
• Your account password, which we store only as a cryptographic hash and which nobody here can read.

Information we receive about you

• Your laboratory results, sent to us by the laboratory that performed your tests.
• Confirmation from our payment processor that a payment succeeded, together with the brand and last four digits of the card. We never receive or store your full card number.

Information collected automatically

• Standard server logs, holding your IP address, browser type, the pages you requested, and the time of the request. We keep these for security and troubleshooting.
• A session cookie that keeps you signed in. It is strictly necessary for the site to function. We do not use advertising cookies, and we do not track you across other websites.

2. Why we hold it

We use your information to authorize and place your laboratory order, to issue your requisition, to deliver your results, to take payment, to answer you when you contact us, to defend a payment dispute if one is raised against us, and to meet our obligations under the law. That is the complete list.

We do not use your information to build an advertising profile, and we do not use your health information for marketing of any kind.

3. Who we share it with

We share the minimum necessary with the following, and with nobody else.

• The clinical laboratory that performs your tests, and the physician who authorizes your order. They cannot do their work without your identifying details.
• Our payment processor, Stripe, which handles your card payment. Stripe's own privacy policy governs what it does with that data.
• Our hosting and email providers, which process data on our instructions and are contractually barred from using it for their own purposes.
• A court or regulator, where we are legally compelled. If we are permitted to tell you this has happened, we will.

We never sell your personal information, and we never share your health information with a data broker, an advertiser, or an insurer.

4. How long we keep it

Laboratory results and the records that go with them are retained for seven years, which is the period record-keeping rules for clinical laboratory work generally require. Order and payment records are retained for seven years for tax and dispute purposes. Server logs are deleted after ninety days.

If you close your account we delete your profile and stop contacting you, but we may retain the specific records above for the periods stated, because we are required to.

5. Your rights

Wherever you live, you can ask us to do any of the following, and we will respond within thirty days at no charge.

• Give you a copy of the information we hold about you.
• Correct anything that is wrong.
• Delete your account and the information we are not legally required to keep.
• Tell you who we have shared your information with.
• Stop sending you any message that is not directly about an order you placed.

Residents of California, Colorado, Connecticut, Virginia, and other states with comprehensive privacy laws have these rights by statute, including the right not to be treated differently for exercising them. We extend the same rights to everyone. We do not sell or share personal information as those laws define the terms, so there is nothing for you to opt out of.

To exercise any of these, email support@labsandconsulting.com from the address on your account, or write to us at the postal address below. We may ask you to confirm your identity before we release health information, for your protection.

6. Security

Every page of this site is served over HTTPS. Your data is encrypted in transit and at rest. Documents containing health information are served only over expiring links or to a signed-in account. Access to production systems is limited to the people who need it, and passwords are stored as salted hashes rather than as text anyone could read.

No system is perfectly secure. If we ever discover a breach affecting your information, we will tell you and the relevant authorities as the law requires, and we will tell you what was exposed rather than issuing a vague notice.

7. Children

Our services are for adults aged 18 and over. We do not knowingly collect information from anyone under 18. If you believe a child has given us their information, contact us and we will delete it.

8. Changes to this policy

If we change this policy we will update the date at the top of this page. Where a change materially affects your rights, we will email account holders before it takes effect.

9. How to reach us