Privacy: what happens to your lab report

• Your file is processed in memory and deleted after conversion.
• Pages that need a second look may be sent to Google's Gemini API. Under Google's terms, that data may be retained for up to 55 days.
• Uploads are not used for training.
• Only your initials and birth year come back to your browser. Full names, full dates of birth and ID numbers do not.
• The merged series of your results lives only in your browser, on this device.
• BioPanel is not a HIPAA covered entity, and it is not for clinical record-keeping.

When you choose a file, your browser sends it to a function that runs on Cloudflare. That function passes it to a conversion service that runs on Modal. The file is processed in memory and deleted after conversion.

A page that needs a second look, such as a faint scan or a table the first pass could not read, may be sent to Google's Gemini API as a vision check. Under Google's terms, data sent to the Gemini API may be retained for up to 55 days. Only the pages that need the check are sent.

BioPanel does not use uploads for training any model.

The text of the report passes through the function in memory so that the table can be built. Only the table comes back: the report date, the lab name, and each result with its unit, printed range and flags.

The patient's name is reduced to initials and the date of birth to a birth year before anything is returned. Full names, full dates of birth and ID or accession numbers are not returned, so they are not in your browser, not in a CSV you download and not stored by BioPanel.

BioPanel keeps four things in your browser's local storage. None of them is sent anywhere except the two noted.

• A random device identifier (bp.device). It is sent with each upload so the free allowance can be counted without an account.
• Your merged series (bp.reports.v1): the rows you converted, each report's date and lab, and the initials and birth year. It is never uploaded.
• Your display choices (bp.prefs.v1), such as the unit you picked for a marker and the person you were viewing.
• A page code (labresulttoexcel_code), only if you enter one. It is sent with each upload, so a file the free allowance cannot cover can use the pages on your code.

The button Remove all reports from this browser deletes the merged series and your display choices. The device identifier and any page code stay until you remove the code with its Remove link or clear this site's data in your browser settings, which removes everything BioPanel has stored on the device.

Because there is no account and BioPanel does not keep your files, there is no profile of you to delete on our side. Download the CSV before removing anything you want to keep.

With each upload the server receives the file, the device identifier and, through Cloudflare, your network address. The identifier and the address are used to count the free allowance per device and to stop one address from using up the allowance for everyone. If you have entered a page code, it is sent too, and the pages of a file that the free allowance cannot cover are counted against the code.

The function that receives uploads writes nothing to a database or to storage. Hosting providers keep their usual technical logs.

These services handle data on BioPanel's behalf.

BioPanel is a tool for organising a document you already have. It is not a HIPAA covered entity or a business associate, and it does not sign business associate agreements. It is not a medical record and is not for clinical record-keeping: the original report stays the record.

If you work in a clinic, check what your own obligations allow before you upload anyone else's results, and upload only what you have the right to upload.

BioPanel's own pages set no cookies and show no advertising. Their text font, DM Sans, is loaded from Google Fonts, which means your browser requests it from Google when a page opens.

BioPanel runs no analytics script of its own.

If this page changes in a way that matters, the date at the top changes. Questions about it can go to [email protected].