Privacy Policy

Bloodworks B.V. (KvK: 42184336, based in Amsterdam) offers consumers the option to request blood tests without a medical referral. We are the controller responsible for processing your personal data as described in this privacy policy.

Questions? Contact us at privacy@bloodworks.nl.

We process the following categories of personal data:

• Identification data, name, date of birth, sex
• Citizen service number (BSN), only if you provide it yourself, solely to register your laboratory request in your name
• Contact details, email address, telephone number, postal address
• Payment data, payment method, transaction reference (no full card details)
• Health data, laboratory results, chosen package, blood-draw location
• Technical data, IP address, browser type, session cookies

Health data are special categories of personal data within the meaning of the GDPR. We process these solely to perform the contract and for the medical assessment by our BIG-registered doctors, who are bound by medical confidentiality.

We process your personal data for the following purposes:

• Processing your order and arranging the blood draw
• Providing and interpreting your lab report
• Communicating about your order and results
• Complying with legal obligations (tax, statutory retention of medical records)
• Improving our services (anonymised statistics)
• Newsletter and offers (only with your consent, always unsubscribable)

We process your data on the basis of:

• Performance of a contract, to process and carry out your order (Art. 6(1)(b) GDPR)
• Legal obligation, for tax and medical-legal retention duties (Art. 6(1)(c) GDPR)
• Medical assessment, for health data, by or under the responsibility of our BIG-registered doctors, who are bound by medical confidentiality (Art. 9(2)(h) GDPR and Art. 30(3)(a) of the Dutch GDPR Implementation Act)
• Consent, for the optional newsletter (Art. 6(1)(a) GDPR)
• Legitimate interest, for security, fraud prevention and quality assurance of our doctors' explanations (Art. 6(1)(f) GDPR)

We do not keep your personal data longer than necessary:

• Laboratory results, for as long as the law requires (statutory retention of medical records)
• Order and payment data, for as long as the law requires (tax retention obligation)
• Citizen service number (BSN), we delete it as soon as your order has been completed. It does not fall under the tax retention period above, because it plays no part in it
• Account data, as long as your account is active and after that no longer than necessary
• Marketing consent, until you unsubscribe

We only share your data with:

• Certified laboratories, to carry out the blood analysis
• Blood-draw locations, to schedule your blood draw
• Payment processors, to securely handle your payment (PCI DSS certified)
• Hosting & IT partners, EU-based, to securely host and manage our systems

Under the GDPR you have the following rights:

• Access, request which data we hold about you
• Rectification, have inaccurate data corrected
• Erasure, have your data deleted (unless a statutory retention applies)
• Objection, object to processing based on legitimate interest
• Restriction, temporarily restrict processing
• Portability, receive your data in a structured format
• Withdraw consent, withdraw consent for marketing

Send your request to privacy@bloodworks.nl. We respond within 30 days.

We use functional cookies that are necessary for the website to work, such as your shopping cart and session. We place these without consent because the website does not function properly without them.

We also use analytics and marketing cookies (including Google Analytics 4 and Google Ads, loaded via Google Tag Manager) to improve the website and measure our campaigns. We place these only with your consent. We apply Google Consent Mode: without your consent, no analytics or marketing cookies are placed and no personal data is shared for these purposes.

On your first visit we ask for your choice via our cookie banner. You can change or withdraw your consent at any time via the cookie settings. See our cookie policy for the full list of cookies. We never share health data with advertising or analytics partners.

We take appropriate technical and organisational measures to protect your data: encrypted connections (HTTPS/TLS), access control and ISO 15189 certified laboratory partners.

Do you have a complaint about the processing of your personal data? You can contact us at privacy@bloodworks.nl. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

This privacy policy may be amended. We announce material changes on this page. The most recent version is always available on this page.