Lab results privacy: what a report carries and what happens when you convert the PDF
A lab report carries more than results: a name, a date of birth, several ID numbers, the ordering clinician and dates. Converting the PDF to a spreadsheet means deciding which of these travel with the numbers. BioPanel returns only initials, a birth year, the report date, the lab name and the results, and keeps your merged series in your browser.
Not medical advice. This guide describes what the parts of a lab report are and how they are recorded. It does not say what any result means for a person, and it does not recommend treatment, supplements or targets. It is also not legal advice. Privacy rules differ by country and by who you are.
What a lab report carries
Identifiers sit in the header, in a barcode and often in a footer repeated on every page. Typical fields are the full name, date of birth, sex, address, patient or medical record number, accession and specimen numbers, an order number, insurance or member numbers, and the ordering clinician. The PDF file may also carry document properties such as an author or title, and its file name often holds the name.
A results spreadsheet needs far less: a date, a marker, a value, a unit and a range. How much of the rest to keep depends on who will see the sheet. For a log kept for yourself, initials and a birth year are usually enough to tell two people apart, such as two family members.
Masking is not anonymity. Initials, a birth year, a collection date and a lab name together can still point to a person. In the US, the HIPAA Safe Harbor method for de-identification lists dates other than the year among the identifiers to remove, so a table that keeps collection dates is not de-identified by that method.
Before you convert a report
Six steps.
List what the file carries
Open the PDF and look at every page, including headers, footers and barcodes. Check the file name and the document properties too.
Decide what the sheet needs
Date, marker, value, unit and range are the core. Add initials and a birth year only if you track more than one person.
Check you may upload it
Upload only reports you have the right to upload. A clinic or coach handling clients' results should check its own obligations first.
Convert and look at the output
Check that no names, ID numbers or contact lines appear in the result, including in the lab name and any notes column.
Name and store files with care
Name files by date and lab, not by person. Keep the original report in one place and the spreadsheet in another.
Clear what you no longer need
Delete converted files you have finished with, and clear stored data from the browser when you finish on a shared device.
Identifiers on a report, and what BioPanel returns
As described on the privacy page.
| Identifier | Where it usually appears | What BioPanel returns |
|---|---|---|
| Full name | Header, page footers | Initials only |
| Date of birth | Header | Birth year only |
| Patient or medical record number | Header, barcode | Not returned |
| Accession, specimen and order numbers | Header, footers, barcode | Not returned |
| Address, phone, e-mail, sex, age, insurance numbers | Header | Not returned |
| Ordering clinician | Header | Not returned as a field |
| Dates | Header | One date is kept, as YYYY-MM-DD: the collection date when the report labels one |
| Lab name | Header, footer | Kept |
| Results | Results table | Kept: marker, value, unit, printed range and flags |
What goes wrong
Most come from forgetting where an identifier hides.
- Leaving the name in the file name. A file called SmithJ_bloodwork.pdf carries the name even when its contents are masked.
- Reading masking as anonymity. A birth year, initials, a date and a lab can still point to one person. Share the sheet accordingly.
- Checking only page one. Headers and footers repeat identifiers on every page, and a photo can include a barcode or a label.
- Sharing the original with the sheet. If the sheet is what someone needs, send the sheet. The PDF carries everything.
- Leaving data on a shared device. Browser storage stays until it is cleared. Use the remove button or clear the site's data when you finish.
- Trusting any tool blindly. A layout the tool has not seen can leave an identifier in a notes field or a lab name. Read the output once.
How BioPanel helps
BioPanel processes the file in memory, deletes it after conversion and returns only the table: report date, lab name, and each result with its unit, printed range and flags. The name is cut to initials and the date of birth to a birth year before anything comes back; IDs and contact details are not returned. Pages that need a second look may be sent to Google's Gemini API, which can keep them for up to 55 days under Google's terms. The merged series stays in your browser, is never uploaded and has a remove button. The privacy page has the full list. Try it on a lab report PDF or photo. Free: 1 file per day, up to 10 pages, no account. Files over 10 pages are converted up to page 10 on the free allowance; a page code converts the whole file, up to 150 pages. See pricing.
Questions people ask
What personal details does a lab report contain?
Usually the full name, date of birth, sex, an address or phone number, patient and specimen IDs, an order number, the ordering clinician and the dates. Barcodes and page footers can repeat several of them.
Does BioPanel keep my lab report?
The file is processed in memory and deleted after conversion. The table comes back to your browser, and the merged series is stored only on your device. Pages that need a second look may go to Google's Gemini API.
What does BioPanel do with my name and date of birth?
It cuts the name to initials and the date of birth to a birth year before anything is returned. Full names, full birth dates and ID numbers are not passed back or stored.
Is a table with initials and a birth year anonymous?
No claim of anonymity is made. Initials, a birth year, a collection date and a lab name together can still point to a person, so treat the sheet as personal data.
Where is my merged history stored?
Only in your browser's local storage, on the device you used. It is not uploaded, and it stays until you use the remove button or clear the site's data.
Is BioPanel covered by HIPAA?
BioPanel is not a HIPAA covered entity or a tool for clinical record-keeping; the original report stays the record. This is not legal advice. Check your own obligations before uploading anyone else's results.