Labvi Privacy Policy

Last updated: October 26, 2026

1. Who we are

The Labvi app (the “App”) is developed and provided by Viktar Muronchyk, an individual in the Republic of Belarus (“we,” “us,” the “developer”). Labvi is the new name of the Lably app (since October 26, 2026); the website and support address moved from lably-app.com to labvi.app.

The App does not replace a consultation with a doctor and is not a medical device. We do not provide any medical services.

This Policy also applies to the labvi.app website (the “Website”): what happens to data when you visit it is described in Section 2.7.

For the purposes of the GDPR, the UK GDPR, and the personal data laws of the CIS countries, we are the controller (“operator”) of the data processed on our server and by our service providers. We do not receive or see the data that is stored only on your device — you are in control of it.

Contact for data matters: [email protected]

Postal address: vul. Karla Marksa 29, OPS-25 (Post Office No. 25), 230025 Hrodna, Republic of Belarus

2. What data we process

2.1. Data only on your device

Stored in the App’s storage on your device. We have no access to it:

• profiles (yours and, on the Max plan, up to four family members’ profiles);
• Health Passport: name, date of birth, sex, height, weight, drug and food allergies, chronic conditions, current medications;
• lab reports and documents: test values, reference ranges, dates, laboratories, the text of conclusions and referrals, photos and PDFs of documents (after redaction);
• your corrections to the names of test indicators and laboratories extracted from documents, the country you selected, language, theme, and app lock settings;
• temporary files: PDF summaries for your doctor and backup files while you are sharing them.

Protection on the device: encryption provided by the operating system; service keys and settings are kept in the system’s secure storage (Keychain / Android Keystore). If you turn on unlocking with Face ID, Touch ID, or a fingerprint, the biometric check is performed by the operating system — the App receives only a “confirmed / not confirmed” answer and never receives the biometric data itself.

The App requests access to the camera, photos, and files only so that you can add a document. The files you select are processed on the device.

2.2. Data on our server

The server is needed for the trial, the subscription, and the daily limit on adding documents by photo or file (Section 2.3). It holds no health data.

The device ID is kept in the device’s secure storage and may persist after the App is reinstalled (on iOS it usually does). This is intentional: otherwise the trial could be obtained over and over again. The device ID is shown on the “Data” screen so that you can refer to it in a request.

Each request to the server uses your IP address (only to limit excessive requests) and your time zone offset (so that the limit resets at your midnight) and, when you add a document by photo or file, also your country, which Cloudflare determines from your IP address (only to choose the route the document takes, Section 6). We do not store them. Our infrastructure provider (Cloudflare) may keep technical logs for a short time for security purposes — under its own rules, as our processor.

2.3. Adding documents to the App

When you add a photo or a PDF file of a document to the App, we use a text recognition service to extract the test values and the text of the report from its pages. A document is sent to this service only when you add it yourself and confirm sending it on the redaction screen. If you enter results manually, nothing is sent.

What is sent: images of the pages, with the areas you blacked out burned into the image itself (the original photo or file is not sent); the App’s language; public reference lists — the list of test indicators and the list of laboratories for the selected country.

What is not sent to the text recognition service: name, surname, email, phone number, device ID, Health Passport data, age, and sex. Only our server receives the device ID — to count the document toward your daily limit (Section 2.2). The instructions given to the text recognition service prohibit it from extracting the patient’s full name, date of birth, address, phone number, document and insurance policy numbers, and the doctor’s name.

How it works: our server holds the copy in memory only for the duration of the request, passes it to the OpenAI text recognition service (United States), and returns the extracted data to the App; the copy is never written to the server’s disk. OpenAI processes the request as our processor: it does not use it to train its models and does not store it in its request history, but it may retain the request, including the images, for up to 30 days in logs used to detect abuse (requests flagged by its safety systems — longer, for the duration of the review), after which it deletes it.

Important: the text recognition service sees everything you have not blacked out. Black out your full name, date of birth, address, insurance policy number, and other personal details. If the page contains information about another person, black that out too.

2.4. Usage statistics

We use Google Firebase Analytics to understand which features work and where users run into errors. The following is sent:

• an App installation ID (created by Firebase; it is not the same as the device ID in Section 2.2);
• events: screens opened, buttons tapped, counts (for example, the number of pages in a document), the document type (“lab report,” “referral,” etc.) — detected automatically when you add a document by photo or file, or set by you manually — technical errors;
• information that Firebase collects on its own: device model, OS version, language, country (based on the IP address, without precise location), App version.

Not sent: the contents of documents, names and values of test indicators, diagnoses, Health Passport information, or any inferences about your health.

Consent and opting out. If your device’s region or the country selected in the App (the “Country” setting) is an EEA country, the United Kingdom, or Switzerland, or if your device’s region cannot be determined, statistics are off until you allow them: the App asks you once, and nothing is sent until you answer. In other countries statistics are on by default. You can turn them on or off at any time in “Profile → Settings → Usage statistics.” While statistics are off, no events are sent.

Statistics are retained for 2 months. “Delete all data” resets the installation ID and your choice: in countries where consent is required, the App will ask again; elsewhere, statistics are turned back on by default.

2.5. Purchases and subscriptions

We are not charging anything at this time. The App is in a testing phase: all plans are provided free of charge, and no payment details are requested or processed. The server stores only a record of the plan unlocked for free and its term (Section 2.2).

When real payments are introduced (we will announce this in the App in advance and update this Policy), subscriptions will be purchased through the App Store or Google Play. Payment details (card, address, Apple Account / Google Account) are processed by Apple or Google — we do not receive them. We receive purchase information from the store (transaction ID, plan, term, status, country) and link it to the device ID to unlock access.

2.6. Support requests

If you write to us, we receive your email address, the text of your message, and anything you attach to it. Please don’t send medical documents or results to support — we don’t need them to resolve your issue.

2.7. Visiting the Website

The Website consists of ready-made pages: it has no accounts, forms, ads, pixels, or embedded content from other services (videos, maps, social media buttons); fonts are loaded from the Website itself. The only third-party script on the Website is the Cloudflare Web Analytics statistics script (see below). The support link opens your email app — your message is sent as an ordinary support request (Section 2.6).

What the host sees. The Website is hosted on Cloudflare Pages (Cloudflare, Inc.). To deliver pages to you and to protect the Website from attacks and bots, Cloudflare processes technical data with each request: your IP address, information about your browser and device (user agent), the address of the requested page, and the date and time of the request. Cloudflare does this as our processor; in addition, under its own privacy policy, Cloudflare may use traffic information to detect and block malicious activity on its network. Cloudflare does not publicly state how long it keeps such logs. We do not keep or export visitor logs and do not try to find out who visited the Website. In the Cloudflare dashboard we can see aggregate traffic statistics and information about requests that Cloudflare’s protection blocked or challenged (including the IP address) — we look at it only to keep the Website running and secure.

Website statistics (Cloudflare Web Analytics). To understand how many people visit the Website, which pages they open, and how fast the pages load, we use Cloudflare Web Analytics. When you open a page, your browser loads a small Cloudflare script from static.cloudflareinsights.com and sends Cloudflare the page address, the address of the page you came from (referrer), and page load and performance metrics, together with — as with any request — your IP address and information about your browser and device (user agent). From this data, Cloudflare shows us aggregate statistics: the number of visits and page views, countries, device and browser types, referral sources, and load speed; we do not see information about individual visitors in them. The script does not use cookies and stores nothing in your browser; under its own rules, Cloudflare does not track visitors across different websites. Cloudflare processes this data as our processor; Cloudflare does not publicly state how long it keeps it.

Where statistics are not collected. The statistics script is not loaded if your request is served by a Cloudflare data center in an EEA country, the United Kingdom, or Switzerland. Which data center serves a request is chosen by Cloudflare’s network — usually the one nearest to you; your location is not determined. So if you are in one of these countries but use a VPN or proxy that exits in another country, statistics may be collected, and vice versa. You can opt out at any time by blocking static.cloudflareinsights.com in your browser (for example, with a content blocker) — the Website will work as usual.

Cookies and browser storage. The Website does not set cookies. If Cloudflare’s protection against bots and attacks is triggered (for example, if your browser needs to be checked), Cloudflare may set a strictly necessary security cookie; it is not used for advertising or tracking. If you choose a language yourself in the Website’s menu, your browser remembers that choice (the labvi.locale entry in the browser’s local storage) so that the Website opens in that language next time. Likewise, if you switch the Website between light and dark appearance, your browser remembers it (the labvi.theme entry). These entries contain only the language code and the name of the appearance, stay in your browser, and are never sent anywhere; you can delete them by clearing the site data in your browser settings.

3. Purposes and legal bases

For the purposes of the laws of Belarus, Russia, and Kazakhstan, the legal basis for processing health data and transferring it abroad is your consent, which you give by a separate action on the screen where you send the document, each time you add a document by photo or file; for all other data, it is the contract (the Terms of Use). Technical data about visits to the Website and its statistics data (Section 2.7) are processed to display the Website, protect it, and keep aggregate visit statistics.

You can withdraw your consent at any time: simply stop adding documents by photo or file (each submission is a separate consent; you can enter results manually) and turn off statistics. Withdrawal does not affect the lawfulness of processing carried out before it.

4. Automated decision-making

We do not make decisions about you based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. The text recognition service only converts a document you add into digital form. Comparing a result with the reference range printed on your form happens on the device and is not a diagnosis.

5. Who else processes data

We do not sell or rent out your data, do not show ads, and do not share data for advertising. Data is received only by the recipients listed in the table below and, for documents added from Belarus and Russia, also by Fly.io (Section 6): our processors — under a contract and on our instructions — and the app stores (Apple, Google) — under their own rules:

We may disclose data where required by law, a court order, or a binding request from a public authority — only to the minimum extent necessary and after verifying that the request is lawful. If the rights to the App pass to another person, the data on our server will pass to them together with the App; the new owner will be required to comply with this Policy, and we will notify you in the App in advance.

6. International data transfers

Our processors and the other recipients in Section 5 are located in the United States and other countries, so your data may be processed outside the country where you live, including in countries where the level of personal data protection is lower than in yours.

• EEA, United Kingdom, Switzerland: where the recipient is certified under the EU–U.S. Data Privacy Framework, we rely on the European Commission’s adequacy decision and, for the United Kingdom and Switzerland, on the UK Extension to that framework (the UK government’s adequacy regulations) and the Swiss–U.S. Data Privacy Framework (the Swiss Federal Council’s adequacy decision); in all other cases, on Standard Contractual Clauses (SCCs) with supplementary measures.
• Belarus, Russia, Kazakhstan, and other CIS countries: our server, processors, and the other recipients in Section 5 are located outside your country, including in the United States, which is not on the lists of countries that ensure an adequate level of personal data protection. The transfer takes place on the basis of your consent. We inform you of the risks: the recipient’s country may not offer the same safeguards for your rights as your country, and it may have no independent supervisory authority; to reduce these risks, you black out your personal details on documents before sending them, and documents are sent only over an encrypted connection and are not stored by us. Technical data about visits to the Website and its statistics data (Section 2.7) are processed by Cloudflare’s network, including outside your country.

Adding documents from Belarus and Russia. To transmit documents to the text recognition service, we use a proxy server operated by Fly.io, Inc.

7. How long we keep data

• Data on your device — until you delete it or delete the App. We do not store it.
• Server data — the periods in the table in Section 2.2.
• Documents you add by photo or file — not stored by our server; OpenAI — up to 30 days (Section 2.3).
• Statistics — 2 months.
• Website visits and statistics — we keep no visitor logs; Cloudflare keeps technical logs and statistics for the period it determines itself (Section 2.7).

8. Deleting data

In the App: “Profile → Settings → Data → Delete all data.” This deletes all profiles, lab reports, results, the Health Passport, photos and PDFs of documents, temporary files, and settings on this device, and resets the statistics ID. Deletion cannot be undone. You can delete any individual document or family member’s profile at any time.

What the button in the App does not delete, and why:

• backup files you saved outside the App — delete them yourself;
• the server record with the device ID and subscription status, and the device ID itself on your device (Section 2.2) — the trial, the subscription, and the limit depend on them.

Full deletion from the server: email [email protected] and include the device ID from the “Data” screen. We will delete the server records within 10 business days. Exception: the trial record is kept for up to 2 years from the start of the trial to prevent abuse; we will tell you about it in our reply.

9. Security

Data is transmitted only over an encrypted connection (TLS). A backup is encrypted on the device (AES-256) with a recovery code: the App creates it, shows it to you, and keeps it in this device’s secure storage; it is never sent to us. Restoring the backup on another device requires this code; if you lose it, neither we nor anyone else can restore the backup. Access to the server infrastructure is restricted and protected; server logs contain no health data and no device IDs.

No system is entirely risk-free. Protect your device with a passcode and turn on the app lock. If we become aware of a breach affecting your data, we will notify you and the supervisory authorities within the time limits set by law (in the EU, 72 hours for notifying the supervisory authority; in the United States, under the FTC Health Breach Notification Rule).

10. Your rights

Wherever you live, you can: find out what data about you we process and get a copy of it; correct it; delete it; withdraw your consent; object to processing; and lodge a complaint with us and with a supervisory authority. You can do most of this yourself, directly in the App, because your health data is kept by you. For requests about server data, email [email protected] and include your device ID.

Response times. We respond within 10 business days — the shortest period under the applicable laws. If additional verification is needed, we will tell you so and why.

Identity verification. There are no accounts, so we verify a request using the device ID, which is visible only on your device. Do not share it publicly. We do not ask for any additional documents.

10.1. EEA, United Kingdom, Switzerland

In addition to the rights above: the right to restriction of processing, the right to data portability (you can export your data to a backup at any time and, on the Premium and Max plans, also to a PDF summary), and the right to object at any time to processing based on legitimate interests. You may lodge a complaint with the supervisory authority of the country where you live or work, or where you believe the infringement took place. In the United Kingdom, you have the right to complain to us first: we will acknowledge your complaint within 30 days and respond without undue delay; after that, you can contact the Information Commissioner’s Office (ICO).

10.2. United States

• We do not sell or “share” personal information as those terms are defined in California and other state laws, do not use it for targeted advertising, and do not engage in profiling in furtherance of decisions that produce significant effects. Global Privacy Control signals are honored automatically — there is nothing for us to turn off.
• Washington, Nevada, Connecticut, and other states with health data laws: see the Consumer Health Data Privacy Policy.
• Residents of states with comprehensive privacy laws (California, Colorado, Virginia, Texas, and others): you have the right to know about, access, correct, and delete your data and not to be discriminated against for exercising your rights. If we deny your request, you may appeal by replying to our email with the word “Appeal”; we will decide on the appeal within the time limit set by your state’s law and tell you how to contact your state Attorney General.
• HIPAA does not apply to the App: we are not a HIPAA covered entity (such as a health care provider) or a business associate of one. Your data is protected by this Policy and by state law.

10.3. Belarus

Under Law No. 99-Z “On Personal Data Protection,” you may at any time, without giving reasons, withdraw your consent, obtain information about the processing of your data and about its transfer to third parties, and demand that your data be changed, that its processing be stopped, and that it be deleted. The law gives 15 days to consider such requests; in practice, we respond within 10 business days. You may lodge a complaint with the National Personal Data Protection Center of the Republic of Belarus.

10.4. Russia

Under Federal Law No. 152-FZ “On Personal Data,” you have the right to obtain information about the processing, to demand the rectification, blocking, or destruction of your data, and to withdraw your consent. We respond within 10 business days; after consent is withdrawn, we destroy the data within 30 days. You may lodge a complaint with Roskomnadzor or with a court.

10.5. Kazakhstan

Under the Law “On Personal Data and Their Protection,” you have the right to know about the processing of your data, to demand that it be changed, blocked, or destroyed, and to withdraw your consent. You may lodge a complaint with the authorized body for personal data protection.

10.6. Other countries

If you live in Brazil (LGPD), Canada, or another country with a data protection law, you have the rights that law gives you; we honor them in the same way and within the same time limits.

11. Children and family members’ profiles

The App is intended for adults (18 and over). We do not knowingly collect data from children.

On the Max plan, you can keep profiles for family members, including children. This data is stored only on your device; we do not receive it. By creating such a profile, you confirm that you are the parent or legal guardian of that person or have obtained that person’s consent. A family member’s documents that you add by photo or file are sent in the same way as yours (Section 2.3) — black out the personal details on them.

If you believe we have received a child’s data without parental consent, contact us and we will delete it.

12. Changes to this Policy

If the changes are material (new data, new recipients, new purposes), we will notify you in the App in advance and, where required, ask for your consent again. The date of the last update is shown at the top.

13. Contact us

Viktar Muronchyk, an individual, developer of the App

Postal address: vul. Karla Marksa 29, OPS-25 (Post Office No. 25), 230025 Hrodna, Republic of Belarus

Email: [email protected]

This Policy is available in the App’s languages. If the law of your country requires the Policy to be in your language, the version in your language prevails.