{"id":3,"date":"2025-09-20T06:13:49","date_gmt":"2025-09-20T06:13:49","guid":{"rendered":"https:\/\/bloodsense.ai\/?page_id=3"},"modified":"2026-07-11T15:18:31","modified_gmt":"2026-07-11T15:18:31","slug":"privacy-policy","status":"publish","type":"page","link":"https:\/\/bloodsense.ai\/ar\/privacy-policy\/","title":{"rendered":"\u0633\u064a\u0627\u0633\u0629 \u0627\u0644\u062e\u0635\u0648\u0635\u064a\u0629"},"content":{"rendered":"

Last updated: 8 July 2026<\/strong><\/p>\n

\u0645\u0642\u062f\u0645\u0629<\/h2>\n

Welcome to BloodSense. BloodSense is a service operated by Smart Medical Care SAS<\/strong> (“SMC”, “we”, “us”, “our”), which acts as the data controller for your personal data. This Privacy Policy explains how we collect, use, share, store and protect your personal data when you use our website bloodsense.ai (the “Site”) and our AI-powered lab result explanation services (the “Services”), and informs you of your data protection rights.<\/p>\n

The processing of your health data is based on your explicit consent, obtained separately. By using our Services, you acknowledge that you have reviewed this policy.<\/p>\n

\u062e\u062f\u0645\u0629 \u0625\u0639\u0644\u0627\u0645\u064a\u0629 \u0628\u062d\u062a\u0629.<\/strong> BloodSense is an informational and educational service that helps you understand your lab results. It is a complement to \u2014 and not a substitute for \u2014 professional medical care, and it does not provide a diagnosis. BloodSense is not a medical device: this position has been confirmed by the French National Agency for Medicines and Health Products Safety (ANSM — reference GIO 23593272, file 2500297) and, for the United States, by an external FDA consultant.<\/p>\n

1. Data Controller and Privacy Contact<\/h2>\n

The data controller responsible for your personal data is:<\/p>\n

    \n
  • \u0627\u0644\u0634\u0631\u0643\u0629:<\/strong> Smart Medical Care SAS (soci\u00e9t\u00e9 par actions simplifi\u00e9e under French law)<\/li>\n
  • Registration:<\/strong> RCS Nice 932 924 194<\/li>\n
  • \u0627\u0644\u0645\u0642\u0631 \u0627\u0644\u0631\u0626\u064a\u0633\u064a:<\/strong> 37 Avenue Mar\u00e9chal Foch, 06000 Nice, France<\/li>\n
  • \u0627\u0644\u0628\u0631\u064a\u062f \u0627\u0644\u0625\u0644\u0643\u062a\u0631\u0648\u0646\u064a \u0644\u0644\u062a\u0648\u0627\u0635\u0644:<\/strong> contact@bloodsense.ai<\/li>\n<\/ul>\n

    Smart Medical Care Ltd (registered in England and Wales, company number 15309552) is a related group entity; the data controller for the BloodSense service is Smart Medical Care SAS (France).<\/p>\n

    Your Privacy Contact.<\/strong> For any question relating to this policy, to your personal data, or to exercise your rights, please contact our Privacy Contact, Julien P., at contact@bloodsense.ai.<\/p>\n

    Data Protection Officer.<\/strong> SMC has not, at this stage, designated a Data Protection Officer (DPO) within the meaning of Articles 37 to 39 of the GDPR. Julien P. acts as our Privacy Contact and principal point of contact for all questions relating to the protection of your personal data.<\/p>\n

    Hosting of health data in France.<\/strong> All health data processed through BloodSense \u2014 for every user, whether located in the EEA, the United Kingdom, the United States or elsewhere \u2014 is hosted exclusively on Google Cloud<\/strong> servers located in France<\/strong>, benefiting from the French Health Data Hosting (HDS) certification. No health data is hosted outside the European Union.<\/p>\n

    2. Scope of this Policy<\/h2>\n

    This Privacy Policy applies to all personal data processed through the BloodSense website (bloodsense.ai) and the BloodSense Services, regardless of your country of residence. It applies to users in the European Economic Area (EEA), the United Kingdom (UK), the United States (US) and all other jurisdictions from which the Services may be accessed. Where specific provisions apply to users in certain jurisdictions (e.g., additional GDPR rights for EEA\/UK users, or state-specific rights for US users), these are identified in the relevant sections.<\/p>\n

    3. Personal Data We Collect<\/h2>\n
      \n
    • Identification and Contact Data:<\/strong> name and email address. We use your name primarily to enable the pseudonymization (removal of direct identifiers) of your report before AI processing, and your email address to send you the generated AI report.<\/li>\n
    • Health and Contextual Data (Special Category Data):<\/strong> the lab report you upload (blood, urine, stool) and the contextual information you provide (age, sex, height, weight, personal and family medical history, allergies, medications, symptoms, lifestyle, and reason for the analysis). This constitutes health data and is subject to enhanced protection.<\/li>\n
    • Transaction Data:<\/strong> information relating to your purchase, processed directly by our payment provider Stripe, Inc. We do not store your full card details. Your transaction history is retained for accounting and legal purposes.<\/li>\n
    • Technical Usage Data:<\/strong> information about how you interact with our Site, collected via Google Analytics (subject to your consent via our cookie banner): truncated IP address, browser type, pages visited, time spent and user journey.<\/li>\n
    • Communication Data:<\/strong> any information you provide when you contact our customer support.<\/li>\n<\/ul>\n

      4. How We Use Your Personal Data (Purposes and Legal Bases)<\/h2>\n
        \n
      • To provide the BloodSense service:<\/strong> analysis of your report and generation of the AI explanation. Legal basis: your explicit consent for health data (GDPR Art. 9(2)(a)), collected via a mandatory checkbox before processing; and performance of a contract for non-health data (Art. 6(1)(b)).<\/li>\n
      • To pseudonymize your information:<\/strong> our internal tool removes direct identifiers (name) from your report before AI analysis. Legal basis: performance of a contract (Art. 6(1)(b)), within the scope of your explicit consent (Art. 9(2)(a)).<\/li>\n
      • To deliver the AI report:<\/strong> we use your email address to send you the result. Legal basis: performance of a contract (Art. 6(1)(b)).<\/li>\n
      • To manage your account and our customer relationship, and to process payments (via Stripe):<\/strong> legal basis: performance of a contract (Art. 6(1)(b)).<\/li>\n
      • To analyze site usage and ensure security:<\/strong> via Google Analytics cookies. Legal basis: your consent (Art. 6(1)(a)); and our legitimate interest for service-security aspects (Art. 6(1)(f)).<\/li>\n
      • \u0644\u0644\u0631\u062f \u0639\u0644\u0649 \u0637\u0644\u0628\u0627\u062a\u0643:<\/strong> legal basis: performance of a contract (Art. 6(1)(b)) or our legitimate interest (Art. 6(1)(f)).<\/li>\n
      • To comply with legal obligations:<\/strong> legal basis: legal obligation (Art. 6(1)(c)).<\/li>\n<\/ul>\n

        Pseudonymization and AI Improvement<\/h3>\n

        Our internal tool removes your direct identifiers (name) from your lab report before any AI analysis. This constitutes pseudonymization as defined by Article 4(5) of the GDPR: your health data is no longer directly identifying, but it \u0644\u0627 \u062a\u0632\u0627\u0644 \u0628\u064a\u0627\u0646\u0627\u062a \u0634\u062e\u0635\u064a\u0629<\/strong> as long as it can be linked to you (via your email address, which is kept separately with technical and organizational safeguards). We do not create anonymous datasets retained indefinitely.<\/p>\n

        Where we use such pseudonymized data to improve the quality of our AI explanations, this processing is based on our legitimate interest (Art. 6(1)(f)) and the data remains subject to the GDPR. You may object (opt out) at any time<\/strong> by emailing contact@bloodsense.ai.<\/p>\n

        5. Sharing Your Personal Data<\/h2>\n

        We do not sell your personal data. We share it with third parties (sub-processors) only as necessary to provide the Services, with appropriate safeguards:<\/p>\n

          \n
        • \u0627\u0644\u0627\u0633\u062a\u0636\u0627\u0641\u0629:<\/strong> Google Cloud (health data hosted on HDS-certified servers in France) — for the secure hosting of our systems and your data.<\/li>\n
        • \u0627\u0644\u0628\u0646\u064a\u0629 \u0627\u0644\u062a\u062d\u062a\u064a\u0629 \u0644\u0644\u0630\u0643\u0627\u0621 \u0627\u0644\u0627\u0635\u0637\u0646\u0627\u0639\u064a:<\/strong> OpenRouter, Inc. (United States), routing to the third-party Claude model (Anthropic), to generate your report. Only \u0645\u064f\u062c\u0647\u064e\u0651\u0644\u0629 \u0627\u0644\u0647\u0648\u064a\u0629<\/strong> data is sent — your name and direct identifiers are removed beforehand. OpenRouter and the model providers never receive your identification data and are contractually prohibited from using your data for their own purposes, including training their own models.<\/li>\n
        • \u0645\u0639\u0627\u0644\u062c\u0629 \u0627\u0644\u0645\u062f\u0641\u0648\u0639\u0627\u062a:<\/strong> Stripe, Inc. (United States) — Stripe collects your payment data directly.<\/li>\n
        • Transactional email delivery:<\/strong> SendGrid (Twilio Inc.) — temporarily processes your email address and the report content to route and deliver it.<\/li>\n
        • Audience analysis:<\/strong> Google LLC (Google Analytics)\u060c \u0648\u0641\u0642\u0627\u064b \u0644\u0645\u0648\u0627\u0641\u0642\u062a\u0643 \u0639\u0644\u0649 \u0645\u0644\u0641\u0627\u062a \u062a\u0639\u0631\u064a\u0641 \u0627\u0644\u0627\u0631\u062a\u0628\u0627\u0637.<\/li>\n<\/ul>\n

          We may also disclose data where required by law, or in the context of a merger, acquisition or sale under equivalent confidentiality commitments.<\/p>\n

          6. International Data Transfers<\/h2>\n

          Health data is hosted in France and is not transferred outside the EEA for storage. Certain sub-processors are located in the United States (OpenRouter, Stripe, Google, Twilio). These transfers are governed by appropriate safeguards:<\/p>\n

            \n
          • The EU-US Data Privacy Framework (DPF) and its UK extension, for certified companies (Stripe, Google, Twilio).<\/li>\n
          • Standard Contractual Clauses (SCCs) approved by the European Commission and the UK ICO, together with a transfer impact assessment where necessary (in particular for the AI processing).<\/li>\n
          • Pseudonymization of the data sent to the AI provider, so that directly identifying data is removed before any transfer outside the EEA.<\/li>\n<\/ul>\n

            7. Data Security<\/h2>\n

            We implement appropriate technical and organizational measures to protect your personal data, including:<\/p>\n

              \n
            • Hosting on secure, HDS-certified servers in France (Google Cloud, which maintains ISO\/IEC 27001 and SOC 2 certifications).<\/li>\n
            • \u0625\u062e\u0641\u0627\u0621 \u0647\u0648\u064a\u0629 \u0627\u0644\u062a\u0642\u0627\u0631\u064a\u0631 (\u062d\u0630\u0641 \u0645\u0639\u0631\u0651\u0641\u0627\u062a\u0643 \u0627\u0644\u0645\u0628\u0627\u0634\u0631\u0629) \u0642\u0628\u0644 \u0645\u0639\u0627\u0644\u062c\u062a\u0647\u0627 \u0628\u0627\u0644\u0630\u0643\u0627\u0621 \u0627\u0644\u0627\u0635\u0637\u0646\u0627\u0639\u064a.<\/li>\n
            • \u062a\u0634\u0641\u064a\u0631 \u0627\u0644\u0628\u064a\u0627\u0646\u0627\u062a \u0623\u062b\u0646\u0627\u0621 \u0627\u0644\u0646\u0642\u0644 (TLS) \u0648\u0623\u062b\u0646\u0627\u0621 \u0627\u0644\u062a\u062e\u0632\u064a\u0646 (AES-256).<\/li>\n
            • Strict access controls based on the principle of least privilege; reinforced authentication (multi-factor) is being deployed.<\/li>\n
            • Procedures for handling suspected personal data breaches, in compliance with GDPR Articles 33 and 34.<\/li>\n<\/ul>\n

              8. Data Retention<\/h2>\n
                \n
              • Original lab report (PDF):<\/strong> a maximum of 90 days after successful generation and delivery of the AI report, then securely deleted (data minimization, Art. 5(1)(c)).<\/li>\n
              • Account and contact data:<\/strong> for the duration of the active account, plus a maximum of 3 years after the last interaction or account deactivation, then permanently deleted.<\/li>\n
              • Generated AI report and contextual health data:<\/strong> for the duration of the active account, plus a maximum of 3 years after account deactivation.<\/li>\n
              • \u0628\u064a\u0627\u0646\u0627\u062a \u0627\u0644\u0645\u0639\u0627\u0645\u0644\u0627\u062a:<\/strong> 6 years, and up to 10 years for invoices and accounting records, in accordance with the French Commercial Code (Art. L123-22) and applicable tax law.<\/li>\n
              • Analytics cookie data (Google Analytics):<\/strong> a maximum of 14 months (CNIL recommendation).<\/li>\n
              • \u0645\u0644\u0641 \u062a\u0639\u0631\u064a\u0641 \u0627\u0631\u062a\u0628\u0627\u0637 \u0627\u0644\u0645\u0648\u0627\u0641\u0642\u0629:<\/strong> a maximum of 6 months (CNIL recommendation).<\/li>\n
              • Server logs (IP):<\/strong> a maximum of 90 days, based on our legitimate interest in service security.<\/li>\n<\/ul>\n

                A request for permanent account deletion results in the erasure of the data above, except data we are legally required to retain (e.g., transaction data for tax purposes).<\/p>\n

                9. Your Data Protection Rights<\/h2>\n

                Depending on your jurisdiction, you may exercise the following rights: access; rectification; erasure (“right to be forgotten”), subject to legal retention obligations; restriction of processing; objection (including to the use of your data for AI-model improvement, and to direct marketing); data portability; and withdrawal of consent at any time (without affecting the lawfulness of processing carried out before withdrawal).<\/p>\n

                EEA and UK users.<\/strong> Under the GDPR and UK GDPR, you benefit from all the rights above. We respond within one month, extendable by two months for complex requests, free of charge unless the request is manifestly unfounded or excessive.<\/p>\n

                US users.<\/strong> Depending on your state, you may have additional rights under applicable state privacy laws (e.g., California CCPA\/CPRA, and laws in Virginia, Colorado, Connecticut and others): the right to know, to delete, to opt out of the “sale” of personal information (we do not sell your data), and to non-discrimination.<\/p>\n

                To exercise any right, email our Privacy Contact at contact@bloodsense.ai.<\/p>\n

                10. Children and Minors<\/h2>\n

                Our Services are not intended for individuals under 18. We do not knowingly collect data from minors; if we become aware that we have, we will promptly delete it.<\/p>\n

                11. Cookies and Similar Technologies<\/h2>\n

                We use cookies subject to your consent choices:<\/p>\n

                  \n
                • Strictly necessary cookies:<\/strong> essential to the functioning of the Site (e.g., session, security). They do not require consent.<\/li>\n
                • Analytics cookies:<\/strong> Google Analytics, to understand how visitors use our Site. Placed only with your consent, via our cookie banner.<\/li>\n<\/ul>\n

                  We do not use advertising or profiling cookies. When you first visit the Site, a cookie banner lets you accept or refuse non-essential cookies; you can change your choices at any time via the cookie settings on the Site, or by configuring your browser.<\/p>\n

                  12. Changes to this Privacy Policy<\/h2>\n

                  We may update this policy from time to time. The “last updated” date appears at the top. If we make material changes, we will provide notice before they take effect.<\/p>\n

                  13. Right to Lodge a Complaint<\/h2>\n

                  If you have concerns about how we process your data, please contact our Privacy Contact first. You may also lodge a complaint with a supervisory authority:<\/p>\n

                    \n
                  • \u0641\u0631\u0646\u0633\u0627 (\u0627\u0644\u062c\u0647\u0629 \u0627\u0644\u0631\u0642\u0627\u0628\u064a\u0629 \u0627\u0644\u0631\u0626\u064a\u0633\u064a\u0629):<\/strong> Commission Nationale de l’Informatique et des Libert\u00e9s (CNIL) — www.cnil.fr<\/li>\n
                  • \u0627\u0644\u0645\u0645\u0644\u0643\u0629 \u0627\u0644\u0645\u062a\u062d\u062f\u0629:<\/strong> Information Commissioner’s Office (ICO) — www.ico.org.uk<\/li>\n
                  • \u062f\u0648\u0644 \u0627\u0644\u0645\u0646\u0637\u0642\u0629 \u0627\u0644\u0627\u0642\u062a\u0635\u0627\u062f\u064a\u0629 \u0627\u0644\u0623\u0648\u0631\u0648\u0628\u064a\u0629 \u0627\u0644\u0623\u062e\u0631\u0649:<\/strong> the supervisory authority in your country of residence.<\/li>\n
                  • United States:<\/strong> the Federal Trade Commission (FTC) — www.ftc.gov — or your state Attorney General.<\/li>\n<\/ul>","protected":false},"excerpt":{"rendered":"

                    Last updated: 8 July 2026 Introduction Welcome to BloodSense. BloodSense is a service operated by Smart Medical Care SAS (“SMC”, “we”, “us”, “our”), which acts as the data controller for your personal data. This Privacy Policy explains how we collect, use, share, store and protect your personal data when you use our website bloodsense.ai (the […]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_acf_changed":false,"footnotes":""},"class_list":["post-3","page","type-page","status-publish","hentry"],"acf":[],"_links":{"self":[{"href":"https:\/\/bloodsense.ai\/ar\/wp-json\/wp\/v2\/pages\/3","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/bloodsense.ai\/ar\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/bloodsense.ai\/ar\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/bloodsense.ai\/ar\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/bloodsense.ai\/ar\/wp-json\/wp\/v2\/comments?post=3"}],"version-history":[{"count":21,"href":"https:\/\/bloodsense.ai\/ar\/wp-json\/wp\/v2\/pages\/3\/revisions"}],"predecessor-version":[{"id":3893,"href":"https:\/\/bloodsense.ai\/ar\/wp-json\/wp\/v2\/pages\/3\/revisions\/3893"}],"wp:attachment":[{"href":"https:\/\/bloodsense.ai\/ar\/wp-json\/wp\/v2\/media?parent=3"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}