{"id":3,"date":"2025-09-20T06:13:49","date_gmt":"2025-09-20T06:13:49","guid":{"rendered":"https:\/\/bloodsense.ai\/?page_id=3"},"modified":"2026-07-11T15:18:31","modified_gmt":"2026-07-11T15:18:31","slug":"politica-de-privacidad","status":"publish","type":"page","link":"https:\/\/bloodsense.ai\/es\/politica-de-privacidad\/","title":{"rendered":"Pol\u00edtica de privacidad"},"content":{"rendered":"

Last updated: 8 July 2026<\/strong><\/p>\n

Introducci\u00f3n<\/h2>\n

Welcome to BloodSense. BloodSense is a service operated by Smart Medical Care SAS<\/strong> (“SMC”, “we”, “us”, “our”), which acts as the data controller for your personal data. This Privacy Policy explains how we collect, use, share, store and protect your personal data when you use our website bloodsense.ai (the “Site”) and our AI-powered lab result explanation services (the “Services”), and informs you of your data protection rights.<\/p>\n

The processing of your health data is based on your explicit consent, obtained separately. By using our Services, you acknowledge that you have reviewed this policy.<\/p>\n

Un servicio estrictamente informativo.<\/strong> BloodSense is an informational and educational service that helps you understand your lab results. It is a complement to \u2014 and not a substitute for \u2014 professional medical care, and it does not provide a diagnosis. BloodSense is not a medical device: this position has been confirmed by the French National Agency for Medicines and Health Products Safety (ANSM — reference GIO 23593272, file 2500297) and, for the United States, by an external FDA consultant.<\/p>\n

1. Responsable del tratamiento de datos y contacto de privacidad<\/h2>\n

El responsable del tratamiento de sus datos personales es:<\/p>\n

    \n
  • Compa\u00f1\u00eda:<\/strong> Smart Medical Care SAS (soci\u00e9t\u00e9 par actions simplifi\u00e9e under French law)<\/li>\n
  • Registration:<\/strong> RCS Nice 932 924 194<\/li>\n
  • Domicilio social:<\/strong> 37 Avenue Mar\u00e9chal Foch, 06000 Niza, Francia<\/li>\n
  • Correo electr\u00f3nico de contacto:<\/strong> contact@bloodsense.ai<\/li>\n<\/ul>\n

    Smart Medical Care Ltd (registered in England and Wales, company number 15309552) is a related group entity; the data controller for the BloodSense service is Smart Medical Care SAS (France).<\/p>\n

    Your Privacy Contact.<\/strong> For any question relating to this policy, to your personal data, or to exercise your rights, please contact our Privacy Contact, Julien P., at contact@bloodsense.ai.<\/p>\n

    Data Protection Officer.<\/strong> En esta etapa, SMC no ha designado un Delegado de Protecci\u00f3n de Datos (DPD) en el sentido de los art\u00edculos 37 a 39 del RGPD. Julien P. es nuestro contacto de privacidad y principal punto de contacto para todas las preguntas relacionadas con la protecci\u00f3n de sus datos personales.<\/p>\n

    Hosting of health data in France.<\/strong> All health data processed through BloodSense \u2014 for every user, whether located in the EEA, the United Kingdom, the United States or elsewhere \u2014 is hosted exclusively on Google Cloud<\/strong> servers located in France<\/strong>, benefiting from the French Health Data Hosting (HDS) certification. No health data is hosted outside the European Union.<\/p>\n

    2. Alcance de esta Pol\u00edtica<\/h2>\n

    This Privacy Policy applies to all personal data processed through the BloodSense website (bloodsense.ai) and the BloodSense Services, regardless of your country of residence. It applies to users in the European Economic Area (EEA), the United Kingdom (UK), the United States (US) and all other jurisdictions from which the Services may be accessed. Where specific provisions apply to users in certain jurisdictions (e.g., additional GDPR rights for EEA\/UK users, or state-specific rights for US users), these are identified in the relevant sections.<\/p>\n

    3. Datos personales que recopilamos<\/h2>\n
      \n
    • Datos de identificaci\u00f3n y contacto:<\/strong> name and email address. We use your name primarily to enable the pseudonymization (removal of direct identifiers) of your report before AI processing, and your email address to send you the generated AI report.<\/li>\n
    • Health and Contextual Data (Special Category Data):<\/strong> the lab report you upload (blood, urine, stool) and the contextual information you provide (age, sex, height, weight, personal and family medical history, allergies, medications, symptoms, lifestyle, and reason for the analysis). This constitutes health data and is subject to enhanced protection.<\/li>\n
    • Datos de la transacci\u00f3n:<\/strong> information relating to your purchase, processed directly by our payment provider Stripe, Inc. We do not store your full card details. Your transaction history is retained for accounting and legal purposes.<\/li>\n
    • Technical Usage Data:<\/strong> information about how you interact with our Site, collected via Google Analytics (subject to your consent via our cookie banner): truncated IP address, browser type, pages visited, time spent and user journey.<\/li>\n
    • Datos de comunicaci\u00f3n:<\/strong> any information you provide when you contact our customer support.<\/li>\n<\/ul>\n

      4. C\u00f3mo utilizamos sus datos personales (fines y bases legales)<\/h2>\n
        \n
      • Para prestar el servicio BloodSense:<\/strong> analysis of your report and generation of the AI explanation. Legal basis: your explicit consent for health data (GDPR Art. 9(2)(a)), collected via a mandatory checkbox before processing; and performance of a contract for non-health data (Art. 6(1)(b)).<\/li>\n
      • To pseudonymize your information:<\/strong> our internal tool removes direct identifiers (name) from your report before AI analysis. Legal basis: performance of a contract (Art. 6(1)(b)), within the scope of your explicit consent (Art. 9(2)(a)).<\/li>\n
      • To deliver the AI report:<\/strong> we use your email address to send you the result. Legal basis: performance of a contract (Art. 6(1)(b)).<\/li>\n
      • To manage your account and our customer relationship, and to process payments (via Stripe):<\/strong> legal basis: performance of a contract (Art. 6(1)(b)).<\/li>\n
      • To analyze site usage and ensure security:<\/strong> via Google Analytics cookies. Legal basis: your consent (Art. 6(1)(a)); and our legitimate interest for service-security aspects (Art. 6(1)(f)).<\/li>\n
      • Para responder a sus solicitudes:<\/strong> legal basis: performance of a contract (Art. 6(1)(b)) or our legitimate interest (Art. 6(1)(f)).<\/li>\n
      • To comply with legal obligations:<\/strong> legal basis: legal obligation (Art. 6(1)(c)).<\/li>\n<\/ul>\n

        Pseudonimizaci\u00f3n y mejora de la IA<\/h3>\n

        Our internal tool removes your direct identifiers (name) from your lab report before any AI analysis. This constitutes pseudonymization as defined by Article 4(5) of the GDPR: your health data is no longer directly identifying, but it sigue siendo un dato personal<\/strong> as long as it can be linked to you (via your email address, which is kept separately with technical and organizational safeguards). We do not create anonymous datasets retained indefinitely.<\/p>\n

        Where we use such pseudonymized data to improve the quality of our AI explanations, this processing is based on our legitimate interest (Art. 6(1)(f)) and the data remains subject to the GDPR. You may object (opt out) at any time<\/strong> by emailing contact@bloodsense.ai.<\/p>\n

        5. Compartir tus datos personales<\/h2>\n

        We do not sell your personal data. We share it with third parties (sub-processors) only as necessary to provide the Services, with appropriate safeguards:<\/p>\n

          \n
        • Alojamiento:<\/strong> Google Cloud (health data hosted on HDS-certified servers in France) — for the secure hosting of our systems and your data.<\/li>\n
        • Infraestructura de IA:<\/strong> OpenRouter, Inc. (United States), routing to the third-party Claude model (Anthropic), to generate your report. Only seudonimizadas<\/strong> data is sent — your name and direct identifiers are removed beforehand. OpenRouter and the model providers never receive your identification data and are contractually prohibited from using your data for their own purposes, including training their own models.<\/li>\n
        • Procesamiento de pagos:<\/strong> Stripe, Inc. (United States) — Stripe collects your payment data directly.<\/li>\n
        • Transactional email delivery:<\/strong> SendGrid (Twilio Inc.) — temporarily processes your email address and the report content to route and deliver it.<\/li>\n
        • Audience analysis:<\/strong> Google LLC (Google Analytics), sujeto a tu consentimiento de cookies.<\/li>\n<\/ul>\n

          We may also disclose data where required by law, or in the context of a merger, acquisition or sale under equivalent confidentiality commitments.<\/p>\n

          6. Transferencias internacionales de datos<\/h2>\n

          Health data is hosted in France and is not transferred outside the EEA for storage. Certain sub-processors are located in the United States (OpenRouter, Stripe, Google, Twilio). These transfers are governed by appropriate safeguards:<\/p>\n

            \n
          • The EU-US Data Privacy Framework (DPF) and its UK extension, for certified companies (Stripe, Google, Twilio).<\/li>\n
          • Standard Contractual Clauses (SCCs) approved by the European Commission and the UK ICO, together with a transfer impact assessment where necessary (in particular for the AI processing).<\/li>\n
          • Pseudonymization of the data sent to the AI provider, so that directly identifying data is removed before any transfer outside the EEA.<\/li>\n<\/ul>\n

            7. Seguridad de los datos<\/h2>\n

            We implement appropriate technical and organizational measures to protect your personal data, including:<\/p>\n

              \n
            • Hosting on secure, HDS-certified servers in France (Google Cloud, which maintains ISO\/IEC 27001 and SOC 2 certifications).<\/li>\n
            • Seudonimizaci\u00f3n de los informes (eliminaci\u00f3n de tus identificadores directos) antes del procesamiento por IA.<\/li>\n
            • Cifrado de los datos en tr\u00e1nsito (TLS) y en reposo (AES-256).<\/li>\n
            • Strict access controls based on the principle of least privilege; reinforced authentication (multi-factor) is being deployed.<\/li>\n
            • Procedures for handling suspected personal data breaches, in compliance with GDPR Articles 33 and 34.<\/li>\n<\/ul>\n

              8. Data Retention<\/h2>\n
                \n
              • Original lab report (PDF):<\/strong> a maximum of 90 days after successful generation and delivery of the AI report, then securely deleted (data minimization, Art. 5(1)(c)).<\/li>\n
              • Account and contact data:<\/strong> for the duration of the active account, plus a maximum of 3 years after the last interaction or account deactivation, then permanently deleted.<\/li>\n
              • Generated AI report and contextual health data:<\/strong> for the duration of the active account, plus a maximum of 3 years after account deactivation.<\/li>\n
              • Datos de transacciones:<\/strong> 6 years, and up to 10 years for invoices and accounting records, in accordance with the French Commercial Code (Art. L123-22) and applicable tax law.<\/li>\n
              • Analytics cookie data (Google Analytics):<\/strong> a maximum of 14 months (CNIL recommendation).<\/li>\n
              • Cookie de consentimiento:<\/strong> a maximum of 6 months (CNIL recommendation).<\/li>\n
              • Server logs (IP):<\/strong> a maximum of 90 days, based on our legitimate interest in service security.<\/li>\n<\/ul>\n

                A request for permanent account deletion results in the erasure of the data above, except data we are legally required to retain (e.g., transaction data for tax purposes).<\/p>\n

                9. Sus derechos de protecci\u00f3n de datos<\/h2>\n

                Depending on your jurisdiction, you may exercise the following rights: access; rectification; erasure (“right to be forgotten”), subject to legal retention obligations; restriction of processing; objection (including to the use of your data for AI-model improvement, and to direct marketing); data portability; and withdrawal of consent at any time (without affecting the lawfulness of processing carried out before withdrawal).<\/p>\n

                EEA and UK users.<\/strong> Under the GDPR and UK GDPR, you benefit from all the rights above. We respond within one month, extendable by two months for complex requests, free of charge unless the request is manifestly unfounded or excessive.<\/p>\n

                US users.<\/strong> Depending on your state, you may have additional rights under applicable state privacy laws (e.g., California CCPA\/CPRA, and laws in Virginia, Colorado, Connecticut and others): the right to know, to delete, to opt out of the “sale” of personal information (we do not sell your data), and to non-discrimination.<\/p>\n

                To exercise any right, email our Privacy Contact at contact@bloodsense.ai.<\/p>\n

                10. Ni\u00f1os y menores de edad<\/h2>\n

                Our Services are not intended for individuals under 18. We do not knowingly collect data from minors; if we become aware that we have, we will promptly delete it.<\/p>\n

                11. Cookies y tecnolog\u00edas similares<\/h2>\n

                We use cookies subject to your consent choices:<\/p>\n

                  \n
                • Strictly necessary cookies:<\/strong> essential to the functioning of the Site (e.g., session, security). They do not require consent.<\/li>\n
                • Analytics cookies:<\/strong> Google Analytics, to understand how visitors use our Site. Placed only with your consent, via our cookie banner.<\/li>\n<\/ul>\n

                  We do not use advertising or profiling cookies. When you first visit the Site, a cookie banner lets you accept or refuse non-essential cookies; you can change your choices at any time via the cookie settings on the Site, or by configuring your browser.<\/p>\n

                  12. Changes to this Privacy Policy<\/h2>\n

                  We may update this policy from time to time. The “last updated” date appears at the top. If we make material changes, we will provide notice before they take effect.<\/p>\n

                  13. Derecho a presentar una queja<\/h2>\n

                  If you have concerns about how we process your data, please contact our Privacy Contact first. You may also lodge a complaint with a supervisory authority:<\/p>\n

                    \n
                  • Francia (autoridad principal):<\/strong> Commission Nationale de l’Informatique et des Libert\u00e9s (CNIL) — www.cnil.fr<\/li>\n
                  • Reino Unido:<\/strong> Information Commissioner’s Office (ICO) — www.ico.org.uk<\/li>\n
                  • Otros pa\u00edses del EEE:<\/strong> the supervisory authority in your country of residence.<\/li>\n
                  • United States:<\/strong> the Federal Trade Commission (FTC) — www.ftc.gov — or your state Attorney General.<\/li>\n<\/ul>","protected":false},"excerpt":{"rendered":"

                    Last updated: 8 July 2026 Introduction Welcome to BloodSense. BloodSense is a service operated by Smart Medical Care SAS (“SMC”, “we”, “us”, “our”), which acts as the data controller for your personal data. This Privacy Policy explains how we collect, use, share, store and protect your personal data when you use our website bloodsense.ai (the […]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_acf_changed":false,"footnotes":""},"class_list":["post-3","page","type-page","status-publish","hentry"],"acf":[],"_links":{"self":[{"href":"https:\/\/bloodsense.ai\/es\/wp-json\/wp\/v2\/pages\/3","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/bloodsense.ai\/es\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/bloodsense.ai\/es\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/bloodsense.ai\/es\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/bloodsense.ai\/es\/wp-json\/wp\/v2\/comments?post=3"}],"version-history":[{"count":21,"href":"https:\/\/bloodsense.ai\/es\/wp-json\/wp\/v2\/pages\/3\/revisions"}],"predecessor-version":[{"id":3893,"href":"https:\/\/bloodsense.ai\/es\/wp-json\/wp\/v2\/pages\/3\/revisions\/3893"}],"wp:attachment":[{"href":"https:\/\/bloodsense.ai\/es\/wp-json\/wp\/v2\/media?parent=3"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}