Legal
Patient Thread Ltd. Registered in England and Wales, company number 17167409. Registered office: Aston Park Farm, Stringers Lane, Aston, Hertfordshire, SG2 7EF. ICO registration ZC223090. Contact: chris@patientthread.com.
Patient Thread Ltd is the data controller for the Results Checker service. Where you use Results Checker alongside a clinic's Patient Thread account, that clinic remains controller of its own clinical record; Results Checker data is separate and is not shared with any clinic.
Email address and a password (stored only as a hash by our authentication provider, Supabase). Optionally a name for your printed summaries, your sex (used only to select sex-specific typical reference ranges where laboratories print them) and year of birth. Legal basis: performance of a contract.
The files you upload (photos, PDFs) or forward by email, the text pasted or typed in, and the values, units, dates, reference ranges and flags read from them. These are special category health data. Legal basis: your explicit consent (UK GDPR Article 9(2)(a)), given when you create an account and each time you upload. You may withdraw consent by deleting your account.
Records of uploads, exports and plan changes (for support and to run the free-report allowance), and, if you subscribe, your Stripe customer and subscription identifiers. We never see or store card numbers. Legal basis: performance of a contract and our legitimate interest in running and securing the service.
Standard server logs held by our hosting providers (IP address, browser type, timestamps) for security and fault-finding. We do not use analytics cookies or advertising trackers. The app uses browser storage only to keep you signed in.
When you upload a report we send its content to Anthropic PBC's Claude API to transcribe the values. We send the document and our instructions only; we do not send your name, email or account identifiers. Anthropic's commercial API terms prohibit training on customer data. Anthropic may retain API inputs for up to 30 days for trust-and-safety purposes, then deletes them. Anthropic is a US company; this transfer is covered by the UK International Data Transfer Addendum in Anthropic's Data Processing Addendum. If you would rather not use this, type results in by hand: typed-in results are never sent to Anthropic.
Password-protected PDFs are opened in your browser; the password never leaves your device and only the extracted text is sent for reading.
Your account has a private forwarding address. Email sent to it is received by Postmark (ActiveCampaign LLC) and passed to our servers; attachments are stored in your account and read in the same way as an upload. The email body and headers are discarded after processing. Anyone who learns your forwarding address could add documents to your account, so keep it private; you can ask us to rotate it.
Your account, results and files are stored by Supabase Inc. in a database and file store located in London, United Kingdom, encrypted at rest and in transit, with row-level security so that only your signed-in session can read your rows. Our processors are:
We do not sell data, share it with advertisers, or share it with any clinic, insurer or employer. We will disclose data only where the law requires it.
For as long as your account exists. Deleting your account (Account screen, or by email to us) removes your profile, every result, every uploaded file and your login within minutes; database backups held by Supabase roll off within 30 days. Stripe retains billing records for the period required by tax law. Accounts unused for 24 months are deleted after a warning email.
Under UK GDPR you can access, correct, download (Account screen: JSON and CSV), restrict, object to, and erase your data, and withdraw consent. Most of these you can do yourself in the app; for anything else email chris@patientthread.com and we will respond within one month. You can complain to the Information Commissioner's Office: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, 0303 123 1113, ico.org.uk.
Results Checker is for adults aged 18 and over managing their own results. A parent may upload a child's results under their own account; the parent is responsible for that data and may delete it at any time.
Encryption in transit (TLS) and at rest; row-level security on every table; private file storage with signed access only; server-side entitlement checks so that report reading cannot be triggered without a valid session; independent penetration testing of the Patient Thread platform (most recently September 2026). No system is perfectly secure; if you suspect a problem, email us.
Results Checker displays your results against the reference range printed by your laboratory (or a typical UK adult range, clearly labelled, where none was printed) and provides general educational text about each test written by a UK consultant physician. It does not interpret your individual results, calculate any risk, suggest a diagnosis, or advise on treatment, and it is not a substitute for the doctor who requested the test. Reference ranges vary between laboratories.
We will post changes here with a new version number and date, and email account holders about material changes before they take effect.