A laboratory report contains more than numbers: it can reveal identity, location, family relationships, and highly sensitive clinical history. This patient-first checklist helps you decide what to remove, what to preserve, and what to ask before an AI review.
- Redact identifiers first: remove your full name, date of birth, address, phone number, medical-record number, barcode, QR code, and laboratory account number before you upload blood test results.
- Keep clinical context: preserve collection date, test name, units, reference intervals, fasting status, sex when relevant, and age band so interpretation remains clinically useful.
- Health data is protected: laboratory results are special-category personal data under UK GDPR Article 9, so a clear privacy notice and defined purpose matter.
- Ask about retention: a responsible service should explain active-storage time, backup-deletion timing, whether de-identified data are retained, and how you request erasure.
- Use a unique password: choose a password-manager generated password of at least 14 characters and enable multi-factor authentication when it is offered.
- Verify the company: check the legal entity, privacy contact, data-processing locations, sub-processors, medical-review approach, and current policy date before sharing.
- AI is not urgent care: potassium of 6.5 mmol/L or higher, severe symptoms, or a clinician-marked critical result needs immediate medical contact rather than waiting for an online interpretation.
- Check extraction quality: compare every uploaded result, unit, reference range, and collection date with the original laboratory report before acting on an AI summary.
What to do before you upload blood test results
Before you upload blood test results, make a private copy, redact direct identifiers, preserve the laboratory values and units, then read the service’s retention and model-use terms. Kantesti is an AI blood test analyzer designed to interpret laboratory reports, but the safest upload is still the one that shares only the information needed for interpretation.
As of July 25, 2026, a lab PDF can contain 10 or more identifying fields beyond your name, including an accession number, barcode, clinician location, and QR code. Dr. Thomas Klein’s practical rule is simple: if a field helps someone contact, locate, or uniquely match you, remove it before sending the document anywhere online.
Do not crop so aggressively that the report loses its clinical meaning. A sodium result of 128 mmol/L means something different when the collection date, units, laboratory interval, medication list, and recent illness are visible; preserve those details while reviewing the AI analyzer licence terms.
A redacted report is not anonymous merely because the name is absent. A rare diagnosis, exact postcode, date of birth, and unusual combination of tests can sometimes identify a person when combined with other data, which is why data minimisation beats casual sharing.
The 90-second pre-upload pause
Spend 90 seconds checking the file name, visible page headers, embedded QR codes, and photo gallery background before upload. A file called "Maria-Smith-Hospital-2026" can disclose as much as the report itself, even if the page image has been carefully masked.
How to redact a lab report without hiding useful results
Redact identity fields permanently, not with a visual cover that can be removed. Keep analyte names, results, units, flags, reference ranges, specimen date, and laboratory method when shown; these are the details that make a result interpretable.
Remove your full name, exact date of birth, address, email, phone number, patient ID, national health identifier, insurance number, clinician name, barcode, QR code, and appointment identifier. In my experience, the most commonly missed items sit in the upper-right corner and page footer rather than beside the result table.
Use a true redaction tool that deletes the underlying characters, then export a flattened copy and reopen it to test the masking. Drawing a black rectangle over a PDF is not enough: in many files, copied text, selectable layers, or metadata can remain accessible after the visible page looks covered.
A photograph needs a separate check. Crop out the kitchen counter, prescription labels, computer notifications, and reflections in glossy paper, then compare the upload against our PDF and OCR error checklist before sharing it.
What should remain visible
Keep the collection date rather than your birth date, and keep an age band such as 40–49 years when the service permits it. Reference intervals differ by laboratory, sex, age, pregnancy status, and assay method; deleting every contextual field can turn a careful interpretation into an educated guess.
Which lab details should stay visible for an accurate AI review
The minimum clinically useful upload includes the test date, analyte name, numeric value, unit, laboratory reference interval, and any high or low flag. Removing these fields to improve privacy can create a more serious risk: a technically clean but clinically misleading interpretation.
A ferritin value of 18 ng/mL is not interchangeable with 18 µg/L only because those units happen to be numerically equivalent; other analytes are not so forgiving. Vitamin B12 is commonly reported in pg/mL or pmol/L, while glucose may be reported in mg/dL or mmol/L, so the unit must travel with the number.
Keep whether you were fasting, had exercised intensely, were acutely unwell, or had taken supplements within 24 hours. Biotin doses of 5,000–10,000 micrograms can interfere with some immunoassays, and supplement timing is often the hidden clue in an apparently surprising thyroid or hormone result; see our guide to supplements before blood tests.
Do not delete every abnormal flag out of embarrassment. A laboratory flag is not a diagnosis, but its presence helps show the original report structure and supports a better explanation of what out-of-range results mean.
How to upload lab results safely from a phone or computer
Upload from a private device and a trusted network, using a PDF or clear image that contains only the report. Avoid public Wi-Fi, shared tablets, work computers, and screenshots that show notifications, browser tabs, or unrelated medical messages.
A password-protected home network is generally preferable to airport, café, hotel, or hospital guest Wi-Fi for health-document uploads. If public Wi-Fi is your only option, wait if the result is not urgent; a virtual private network can help, but it does not correct an unsafe account or an over-shared document.
PDF files often preserve result alignment better than photographs, especially for multi-page complete blood counts and metabolic panels. If you use a photo, take it in even daylight, check that decimal points are legible, and never rely on a blurry image of a potassium result such as 5.8 mmol/L.
Turn off automatic cloud-camera sharing if the image contains a full report before redaction. The same preparation details that affect result interpretation, including fasting and strenuous exercise, are worth retaining privately in a separate note; our overview of serum versus plasma results explains why report labels matter.
What meaningful consent looks like before you share blood test results online
Meaningful consent tells you who receives your report, why they need it, whether use is optional, and how you withdraw permission. A pre-ticked box or a vague statement that data may improve services is not enough for most patients to make an informed choice.
Health information is special-category personal data under UK GDPR Article 9, which means it receives extra legal protection. The practical question is not whether a page says “secure”; ask whether the service explains its lawful basis, the purpose of processing, and the precise choices you can make.
Price and Cohen described privacy as a condition for public trust in medical big-data systems, rather than a paperwork obstacle (Price and Cohen, 2019). If an AI service offers research, product-improvement, or model-training choices, those choices should be separate from the basic act of interpreting your own report.
Never upload another adult’s results merely because you have access to the PDF. Family lab records can reveal inherited conditions and pregnancy, fertility, infectious-disease, or medication information; use explicit permission and review our guide on sharing test results with family.
Questions to ask about retention, deletion, and AI training
Ask four questions before sharing: how long is the original file retained, how long do backups persist, is data used to train models, and how do you request deletion? UK GDPR does not set one universal deletion period, so a provider should give a concrete, understandable answer rather than a slogan.
A useful retention answer separates the uploaded PDF or image, extracted laboratory data, account history, audit logs, and disaster-recovery backups. “We delete your data” is incomplete if the provider cannot explain whether deletion takes 30 days, 90 days, or another documented interval across each of those systems.
Kantesti is an AI blood test interpretation platform that should be assessed on what it says it does with files as well as on the quality of its interpretations. Review the current privacy material, identify the legal entity, and use the contact information published by Kantesti as an organisation if any retention term is unclear.
Rumbold and Pierscionek noted that GDPR changed medical-data research by making governance and transparency operational issues, not just legal formalities (Rumbold and Pierscionek, 2017). Under UK GDPR, organisations generally have one month to respond to a valid access or erasure request, though limited extensions can apply to complex requests.
How to verify an AI health platform before sharing a lab report
Verify the legal company, policy date, security contact, data locations, medical limitations, and deletion route before you upload. A credible health service makes these details findable without requiring you to hand over a laboratory report first.
Start with the footer: look for a registered company name, physical jurisdiction, privacy contact, current terms, and a readable policy version date. A service that cannot identify its controller, processors, or data-transfer approach leaves you unable to judge where your health information may travel.
Ask whether data are encrypted in transit and at rest, whether the provider uses named cloud sub-processors, and whether staff access is role-limited and logged. Encryption alone is not a complete answer; account recovery, staff permissions, incident response, and deletion procedures matter just as much.
Kantesti AI describes how its interpretation approach is evaluated through its technology guide, but no AI output should be mistaken for a diagnosis or an emergency triage service. Vayena, Blasimme, and Cohen argued that medical machine learning requires accountability alongside technical performance (Vayena et al., 2018).
Account security steps that protect online lab results
A unique password, multi-factor authentication, and prompt device logout are the highest-yield protections for an online health account. Most privacy failures I see in practice begin with account reuse or a shared device, not with a dramatic technical breach.
Use a password manager to create a unique password of at least 14 characters for each health account. Reusing a password from shopping, social media, or email turns a breach elsewhere into a possible route to your laboratory history.
Prefer a passkey or authenticator-app code over SMS when the service offers it, because text messages can be exposed through number-porting scams. Save recovery codes in an encrypted password manager or a locked offline place, never in the same email inbox used for account recovery.
Sign out of shared devices, remove saved downloads, and check active sessions after you upload. If you are comparing reports, verify that the account is showing your own profile and not a relative’s; our AI report accuracy checklist also covers common identity and transcription mix-ups.
How to share blood test results with family without losing control
Share a time-limited, de-identified copy when a family member needs context, and get consent before placing another person’s report into your account. A family relationship does not automatically give permission to store, analyse, or redistribute someone else’s health data.
For an adult relative, ask permission for the exact action: viewing a PDF is different from uploading it to an AI account, saving it long term, or using it in a family-risk feature. Keep a simple dated note of what they agreed to, especially where results include genetic, reproductive, or infectious-disease information.
Parents and legal guardians often manage a child’s reports, but adolescent privacy rules vary by country and service. Do not assume that a 16-year-old’s hormonal, sexual-health, or mental-health related laboratory data should be visible to every family account holder.
Use separate profiles and never merge family results into one chronological timeline. The practical safeguards in our dependent-result tracking guide reduce the very real risk of attributing a parent’s LDL cholesterol or child’s ferritin result to the wrong person.
What AI interpretation can and cannot do after upload
AI can organise patterns, explain reference ranges, and prompt sensible follow-up questions, but it cannot replace clinical assessment, examination, or urgent care. The safest use is as preparation for a clinician conversation, particularly when results are new, rapidly changing, or marked critical.
Kantesti, an AI biomarker interpretation platform, can place multiple results into context, but it cannot see whether you are confused, short of breath, dehydrated, or developing chest pain. Symptoms alter risk far more than a single isolated number in many laboratory scenarios.
A potassium result of 6.5 mmol/L or higher is commonly treated as severe hyperkalaemia and needs urgent clinical assessment, particularly with weakness, palpitations, kidney disease, or medicines that raise potassium. Do not wait for an online report if the laboratory has called a critical result; use our urgent potassium-result guidance for next-step context.
Context can reverse an initial impression. A 52-year-old marathon runner with AST 89 IU/L after a race may have exercise-related muscle release, whereas AST 89 IU/L with jaundice, rising bilirubin, and high ALP points toward a very different pathway; that distinction needs history and, often, repeat testing.
How to check AI extraction before trusting an interpretation
Compare the AI-extracted result against the original report line by line before using it. A missed decimal, incorrect unit, or swapped reference interval can change a harmless result into an alarming one—or hide a result that needs follow-up.
Check at least six fields for every unusual result: analyte, value, unit, reference interval, collection date, and high or low flag. A glucose value of 5.6 mmol/L is approximately 101 mg/dL, but treating 5.6 as mg/dL would be a major extraction error rather than a clinical finding.
Kantesti AI should flag uncertain text rather than quietly invent a value from a blurred scan. The risk rises with multi-column tables, handwritten annotations, faint printer ink, and reports that mix conventional with SI units; our review of AI checks for lab errors explains what software can reasonably detect.
A sensible verification habit takes 2 minutes for a standard panel and longer for specialist reports. Pay special attention to hormone tests, tumour markers, paediatric ranges, and results from laboratories using a different assay method than your previous tests.
How to request access, correction, or deletion of uploaded health data
You can ask a provider what health data it holds, request a copy, correct account details, withdraw optional consent, or request deletion where applicable. The most effective request names the account email, upload date, file type, and the exact action you want.
Write down the upload date, original file name, account email, and whether you are asking to delete the image, extracted results, account history, or all categories. A vague request can delay resolution because a report may exist in active storage, backup systems, and access logs under different identifiers.
Do not ask a service to alter the underlying laboratory value simply because it looks wrong. Request correction of transcription, identity, or account errors, then ask the laboratory or clinician to resolve a possible analytic error; keeping a family lab-history record can help show which source is authoritative.
Deletion may not mean instantaneous disappearance from every encrypted backup, and narrowly defined legal or security records may be retained. What matters is a plain explanation of what is deleted now, what is isolated from normal use, and when residual copies are scheduled for removal.
What to do immediately after you share blood test results online
After upload, review the extracted data, save a copy of your privacy choices, remove local temporary files, and use the interpretation to prepare a clinician question list. Online interpretation is most useful when it improves the next medical conversation rather than replacing it.
Confirm that the report belongs to the correct person and that every flagged result matches the PDF. Then save a private record of the upload date, consent selections, and any deletion request; a screenshot of your choices is useful if the privacy interface changes later.
Delete unredacted copies from downloads, recently deleted folders, shared messaging threads, and printer queues. This matters more than people think: a full blood count PDF sent to a family group chat can remain searchable long after the original concern has passed.
Bring a concise list of questions to your appointment: what changed, what may explain it, what needs repeating, and what symptoms should trigger faster review. Our doctor-visit lab summary checklist helps turn a long report into a focused conversation.
A final patient privacy checklist before AI lab analysis
Do not upload until you can answer yes to five points: identifiers are removed, clinical details remain, consent is clear, retention is explained, and your account is protected. If any answer is no, pause; waiting 24 hours is usually safer than sharing a report you cannot take back.
My final checklist is deliberately short: redact direct identifiers; retain values, units, ranges, dates, and relevant context; use a private device; choose a unique 14-character-or-longer password; and confirm how to reach the provider’s privacy contact. Dr. Thomas Klein recommends repeating the check whenever you upload a new laboratory format, because portals change their headers and identifiers.
Kantesti’s medical approach is subject to clinical oversight, and readers can review the credentials and role of our Medical Advisory Board. Privacy and clinical quality are connected: an interpretation cannot be trusted if the uploaded report belongs to the wrong person or contains a silent OCR error.
Finally, keep perspective. A privacy checklist lowers avoidable exposure; it does not make any online service risk-free, and it never changes the need for direct medical care when you have alarming symptoms, a critical laboratory call, or a result your clinician wants addressed promptly.
Frequently Asked Questions
Is it safe to upload blood test results to AI?
It can be reasonably safe to upload blood test results to AI only when you minimise identifiers, use a protected account, and understand the service’s retention and data-use policy. Remove your name, date of birth, address, record number, barcode, QR code, and contact details, while keeping the result, unit, reference interval, and collection date. Use a unique password of at least 14 characters and multi-factor authentication when available. Do not use an AI upload as a substitute for urgent care when a laboratory has reported a critical result or you feel acutely unwell.
What should I redact before sharing lab results online?
Before you share blood test results online, redact your full name, exact date of birth, address, email, telephone number, medical-record number, insurance identifier, laboratory account number, barcode, QR code, clinician name, and appointment details. Keep analyte names, values, units, laboratory reference intervals, collection date, fasting status, and relevant medication or supplement context. A black box drawn over a PDF may leave selectable text underneath, so use permanent redaction and reopen the exported file to test it. Check the file name too, because it can contain a full name or hospital identifier.
Can I remove the date from a blood test report before AI interpretation?
You should usually keep the specimen collection date while removing your date of birth. The collection date helps distinguish a fasting result from a later repeat, shows whether a result predates a medication change, and prevents an AI system from treating an old value as current. For example, an ALT of 72 IU/L collected 18 months ago has a different follow-up meaning from the same value collected yesterday. If privacy is a concern, keep the month and year only when the service can still interpret the report accurately.
How long should an AI health service keep my uploaded lab report?
There is no single universal retention period for uploaded laboratory reports, so the service should state its specific policy before you upload. Ask separately about the original PDF or photo, extracted laboratory data, account history, audit logs, and encrypted backups; these categories can have different deletion schedules. Under UK GDPR, organisations generally have one month to respond to a valid access or erasure request, although complex requests may take longer with notice. A clear answer should explain what is deleted immediately, what remains in backup isolation, and when backups are purged.
Can an AI health platform use my blood test data to train its model?
An AI health platform may use uploaded data for model improvement only if its terms and privacy choices say so, and patients should be able to understand that use before uploading. Ask whether the original report, extracted values, or only de-identified aggregate data are involved; these are materially different uses. A separate opt-in is easier to understand than a bundled consent screen, especially for special-category health data under UK GDPR Article 9. If the answer is unclear, decline optional use or choose not to upload until you receive a written explanation.
Should I share my blood test results through a family member’s account?
Adults should not share blood test results through a family member’s account unless they have explicitly agreed to that storage and access arrangement. Shared accounts can mix laboratory histories, expose sensitive results, and make deletion requests difficult because one profile may contain several people’s data. Use separate profiles for each person and preserve the collection date, age group, and sex-specific reference interval when relevant. For children and adolescents, local consent rules and family circumstances can differ, so a separate account structure is still the safer default.
Get AI-Powered Blood Test Analysis Today
Join over 2 million users worldwide who trust Kantesti for instant, accurate lab test analysis. Upload your blood test results and receive comprehensive interpretation of 15,000+ biomarkers in seconds.
📚 Referenced Research Publications
Klein, T., Mitchell, S., & Weber, H. (2026). A Pre-Registered, Rubric-Based Automated Technical Benchmark of the Kantesti Blood-Test Interpretation Engine on 100,000 Synthetic Test Cases. Kantesti AI Medical Research.
Klein, T., Mitchell, S., & Weber, H. (2026). Clinical Validation Framework v2.0 (Medical Validation Page). Kantesti AI Medical Research.
📖 External Medical References
⚕️ Medical Disclaimer
This article is for educational purposes only and does not constitute medical advice. Always consult a qualified healthcare provider for diagnosis and treatment decisions.
E-E-A-T Trust Signals
Experience
Physician-led clinical review of lab interpretation workflows.
Expertise
Laboratory medicine focus on how biomarkers behave in clinical context.
Authoritativeness
Written by Dr. Thomas Klein with review by Dr. Sarah Mitchell and Prof. Dr. Hans Weber.
Trustworthiness
Evidence-based interpretation with clear follow-up pathways to reduce alarm.