Privacy Policy
Last Updated: July 15, 2026
1. Information We Collect
When you submit a request, we collect: contact information (name, phone, email), the ZIP code where service is requested, the type of service you select, whether you have a doctor's order or a test kit (and the kit brand/test name if you provide it), your preferred date and time window, your payment preference, the provider you select or are matched with, optional access/logistics notes, and a record of the terms version you accepted and the browser used, as evidence of consent. For site visitors, we collect approximate IP-derived location data, which may include city, state, and ZIP code when available, along with search queries, to improve local provider matching and service coverage.
2. Health-Related Information Boundaries
PhlebFlow is designed as a logistics and matching platform. We ask users only for the limited contact, location, scheduling, service preference, and logistics information needed to connect them with independent providers. We do not request or store lab results, diagnoses, prescriptions, or copies of medical orders through the platform — please share clinical documents and medical instructions directly with your licensed provider, physician, or laboratory, and do not include them in notes. Depending on applicable law and how the service is used, some information we collect may still be considered sensitive health-related information, and we treat it with corresponding care: it is used only to coordinate your request and is shared only as described below.
3. How We Share Information
Your request details are shared with the independent provider you select or are matched with, and with our platform administrators for dispatch, quality, and support purposes. We use service providers to operate the platform, including database hosting (Supabase), website hosting (Cloudflare), email delivery (Resend), SMS delivery (Twilio), and location lookup — IP-based, and ZIP-to-city resolution via api.zippopotam.us to name a searched area. We do not sell your personal information or share it with third parties for behavioral advertising.
To protect the request form from bots and abuse, we use Cloudflare Turnstile, which runs a silent verification when you submit a request. Turnstile's handling of end-user data is governed by the Cloudflare Turnstile Privacy Addendum.
4. Provider and Laboratory Listing Information
Provider and laboratory profiles on PhlebFlow are business listings, not patient data. A listing shows the information the provider submitted: business and contact name, city and coverage ZIP codes, services, fees, and credentials. Credentials are self-reported unless a badge explicitly says PhlebFlow verified them. We review every listing before it is published, and providers can edit their information from their portal at any time. To request a correction or removal of a listing, email [email protected].
5. Communications
By submitting a request you consent to be contacted by PhlebFlow and/or independent providers by phone, email, or text message about your request. Consent is not required to purchase services. You may opt out of communications at any time by contacting [email protected].
6. Your Privacy Rights
You may request access to, correction of, or deletion of your personal information at any time by contacting [email protected]. California residents may have additional rights under the CCPA/CPRA, including the right to know, delete, and correct personal information, and the right to limit use of sensitive personal information. We respond to verified requests within the timeframes required by applicable law.
7. Data Retention
We retain request information only as long as needed to coordinate your request, operate and improve the service, prevent abuse, and meet legal obligations. Patient contact details (name, phone, email, and notes) attached to a booking request are automatically de-identified about six months after the request; the de-identified record (such as ZIP, service type, and dates, without contact details) may be kept for coverage analytics. You may request deletion of your information at any time (see Section 6), and we will honor verified deletion requests except where retention is required by law. Aggregated or de-identified data that no longer identifies you may be retained for service analytics.