Privacy Policy

Bloodworks (KvK: 96134070, based in Amsterdam) offers consumers the option to request blood tests without a medical referral. We are the controller responsible for processing your personal data as described in this privacy policy.

Questions? Contact us at privacy@bloodworks.nl.

We process the following categories of personal data:

• Identification data, name, date of birth, sex
• Contact details, email address, telephone number, postal address
• Payment data, payment method, transaction reference (no full card details)
• Health data, laboratory results, chosen package, blood-draw location
• Technical data, IP address, browser type, session cookies

Health data are special categories of personal data within the meaning of the GDPR. We process these solely on the basis of your explicit consent and to perform the contract.

We process your personal data for the following purposes:

• Processing your order and arranging the blood draw
• Providing and interpreting your lab report
• Communicating about your order and results
• Complying with legal obligations (tax, statutory retention of medical records)
• Improving our services (anonymised statistics)
• Newsletter and offers (only with your consent, always unsubscribable)

We process your data on the basis of:

• Performance of a contract, to process and carry out your order (Art. 6(1)(b) GDPR)
• Legal obligation, for tax and medical-legal retention duties (Art. 6(1)(c) GDPR)
• Consent, for health data and the optional newsletter (Art. 6(1)(a) & Art. 9(2)(a) GDPR)
• Legitimate interest, for security and fraud prevention (Art. 6(1)(f) GDPR)

We do not keep your personal data longer than necessary:

• Laboratory results, at least 15 years (statutory retention of medical records)
• Order and payment data, 7 years (tax retention obligation)
• Account data, as long as your account is active, plus 2 years after closure
• Marketing consent, until you unsubscribe

We only share your data with:

• Certified laboratories, to carry out the blood analysis
• Blood-draw locations, to schedule your blood draw
• Payment processors, to securely handle your payment (PCI DSS certified)
• Hosting & IT partners, EU-based, to securely host and manage our systems

Under the GDPR you have the following rights:

• Access, request which data we hold about you
• Rectification, have inaccurate data corrected
• Erasure, have your data deleted (unless a statutory retention applies)
• Objection, object to processing based on legitimate interest
• Restriction, temporarily restrict processing
• Portability, receive your data in a structured format
• Withdraw consent, withdraw consent for health data or marketing

Send your request to privacy@bloodworks.nl. We respond within 30 days.

We use functional cookies that are necessary for the website to work, such as your shopping cart and session. We place these without consent because the website does not function properly without them.

We also use analytics and marketing cookies (including Google Analytics 4 and Google Ads, loaded via Google Tag Manager) to improve the website and measure our campaigns. We place these only with your consent. We apply Google Consent Mode: without your consent, no analytics or marketing cookies are placed and no personal data is shared for these purposes.

On your first visit we ask for your choice via our cookie banner. You can change or withdraw your consent at any time via the cookie settings. See our cookie policy for the full list of cookies. We never share health data with advertising or analytics partners.

We take appropriate technical and organisational measures to protect your data: encrypted connections (HTTPS/TLS), access control, regular audits and ISO 15189 certified laboratory partners.

Do you have a complaint about the processing of your personal data? You can contact us at privacy@bloodworks.nl. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

This privacy policy may be amended. In the event of material changes we will inform you by email. The most recent version is always available on this page.