Privacy policy
Last updated: 8 November 2026
Biomarka keeps your lab results in one place and shows how they change over time. Lab results are health data, so this policy says exactly what we collect, who receives it and what you can do about it.
1. Who is responsible for your data
The data controller is Mykola Syniuha, Vidkryta 1, 79026 Lviv, Ukraine. Biomarka is run by this private person, not by a company.
Contact for all privacy requests: biomarkasupport@gmail.com
2. What we collect
| Data | Details | Why |
|---|---|---|
| Account | Email address, password (stored only as a hash), and your Google account identity if you sign in with Google | To give you an account and sign you in |
| Consent records | What you accepted, which version and when | To prove your consent |
| About you | Birth year, birth month and sex, if you give them | To pick the lab range printed for your age or sex |
| Family profiles | Name, birth year, birth month and sex of each person you add, up to 5 people per account | To keep each person's results apart |
| Lab reports | The original file, its file name, a fingerprint of the file (to find duplicates), page count, lab name, collection date and language | To read the report and show you the original |
| Lab results | Marker names, values, units, printed ranges, lab flags and your corrections | To show your history and trends |
| Usage | Report pages used, processing cost and time | To apply plan limits and control costs |
| Payments | Plan, billing period, subscription status, and the customer and subscription numbers from Stripe. Stripe itself holds your name, email, billing address and payment details. We do not receive your full card number | To take payments, provide Plus and keep tax records |
| Activity records | Actions such as accepting consent, deleting a report or adding a profile | Security and proof of what happened |
| Technical data | IP address and request details | To deliver pages and keep the service secure |
Your original file is stored and processed whole. We do not remove anything from it. A lab report often shows your name, address, national ID number or doctor's name. If you do not want us to hold these, cover them before you upload the file.
From the file we save only the lab results and the report details listed above. We do not copy your name, address, national ID number or doctor's name into your results.
3. Why we may use your data
| Purpose | Legal basis (GDPR) |
|---|---|
| Storing and reading your lab results and other health data | Your explicit consent, Art. 9(2)(a) and Art. 6(1)(a) |
| Providing your account and the service | Contract, Art. 6(1)(b) |
| Taking payments and managing your subscription | Contract, Art. 6(1)(b) |
| Keeping payment and tax records | Legal obligation, Art. 6(1)(c) |
| Keeping the service secure, preventing abuse and recording actions | Legitimate interests, Art. 6(1)(f) |
You can withdraw your consent to health data processing at any time under Account. Withdrawal does not affect processing that happened before it. We cannot keep lab data without this consent, so withdrawing it removes your reports, values and family profiles. Your account stays, and you can consent again later.
4. How the AI reading works
When you upload a report, we send the whole file to Anthropic's Claude AI. Claude reads the values, units and ranges and returns them to us. You then check the values before they are saved.
The AI does not diagnose or advise, and nobody takes a decision about you based on it. There is no automated decision-making under Art. 22 GDPR.
We do not use your data to train AI models.
5. Who receives your data
We do not sell your data. We do not share it for advertising. These providers process it on our behalf:
| Provider | What it does | Where the data is |
|---|---|---|
| Supabase | Database and sign-in | Frankfurt, Germany |
| Cloudflare (R2) | Stores your original files | EU only |
| VMHeaven | Runs our application servers | Netherlands |
| Anthropic | Reads your reports with AI | United States or other countries outside the EU |
| Sign-in, only if you choose it | See Google's privacy policy | |
| Stripe | Takes payments, calculates tax and sends receipts, only if you buy Plus | EU and United States |
We may also disclose data when the law requires it.
6. Transfers outside the EU
Your stored data stays in the EU. Your report leaves the EU only while Anthropic reads it, because Anthropic offers no EU processing location. Your data is then processed in the United States or another country outside the EU.
This transfer is protected by the European Commission's Standard Contractual Clauses (Art. 46 GDPR). You can ask us for a copy at the contact address in section 1. Anthropic keeps your file only for the limited period set in its agreement with us.
Stripe may process your payment details in the United States. This transfer is also protected by the Standard Contractual Clauses. We send Stripe your email address and a random account number. We never send it your lab data.
7. How long we keep your data
| Data | How long |
|---|---|
| Lab reports and results | Until you delete them or your account |
| A report you delete | We remove the file and its values immediately |
| A family profile you delete | We remove the profile and its reports and values |
| Account and all its data | Until you delete the account. We then remove it immediately |
| Usage records | Until your account is deleted. For a deleted report, we keep the cost record without any link to the report |
| Activity records | 12 months. They contain no lab values and stay after account deletion, linked only to a random account number |
| Payment and tax records | 5 years from the end of the year of the payment, as tax law requires. They stay after account deletion |
| Backups | Deleted data may stay in our providers' backups for a limited time |
8. Your rights
You have the right to:
- See a copy of your data.
- Correct your data. You can edit values and profile details in the app.
- Delete your data, and receive your data in a portable format.
- Restrict or object to processing, and withdraw your consent.
- Complain to a data protection authority. You can complain in the EU country where you live or work. In Poland this is the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw.
Under Account, you can download your data, withdraw your consent and delete your account. The download is a file with your details, family profiles, reports and values. You download each original report file under Reports. You can also delete single reports and family profiles in the app. For any other request, write to the contact address in section 1. We reply within one month.
9. Other people's data
If you add a family member, you confirm that you are their parent or guardian, or that they agreed that you keep their results here. Tell them about this policy. They can use the rights in section 8 by writing to us.
Biomarka accounts are for adults aged 18 or over. A child's results may be added only by a parent or guardian.
10. Cookies
We use only the cookies the service needs. We use no advertising or tracking cookies, so we do not ask for cookie consent.
| Cookie | Purpose | How long |
|---|---|---|
| sb-... | Keeps you signed in | Up to 400 days, or until you sign out |
| NEXT_LOCALE | Remembers your language | Until you close the browser |
| biomarka_profile | Remembers which family profile you are viewing | 1 year |
11. Security
Data is encrypted in transit and at rest. Access to your account needs your password, an email link or your Google sign-in. Your data is not end-to-end encrypted, so the service must be able to read it in order to work. Only the operator named in section 1 has administrator access.
12. Changes to this policy
If we change this policy in a way that affects you, we tell you before the change takes effect. If a change needs new consent, we ask for it in the app.