Blood Test Privacy (2026): Who Sees Your Results, 14 Services

The lab that runs your blood is almost always covered by HIPAA. The company you buy the test from often is not, and its own privacy policy decides what happens to your name, your order and your results. Below: the wording that matters in each policy, what HIPAA and the FTC cover, and how to cut what gets shared. Every service is ranked on the best blood tests page.

What each privacy policy allows

Quoted from each provider's own policy or FAQ, read October 31, 2026. We report what the text allows, not what a company does in practice.

Each service's full privacy summary sits on its review page, for example Function, Superpower and Labs by Hims.

Why the lab and the app are treated differently

HIPAA covers health plans, most healthcare providers and their business associates. A clinical lab such as Quest or Labcorp is a covered entity for the testing it does. A company that sells you a membership or a kit can sit outside that, which is why Quest's own store says its consumer arm, Quest Consumer Inc., does "not provide HIPAA covered services" (Quest help center).

Membership companies describe themselves carefully. STAT reported that Function Health says on its website that it is "not a laboratory or medical provider" (STAT, January 30, 2026). Function's policy adds that it "may operate as a" HIPAA business associate, but that "HIPAA does not apply to all personal information that we process" (Function privacy policy). In plain terms: some of your data is protected by HIPAA and some is governed only by the company's own policy and state law.

What protects data outside HIPAA

The Federal Trade Commission fills part of the gap. Its Health Breach Notification Rule was updated in 2024 to underscore its "application to health apps and similar technologies not covered by HIPAA" (FTC). Under the rule, sharing health data without permission can count as a breach, not only a hack. The FTC also notes its rule "doesn’t apply to businesses or organizations covered by the Health Insurance Portability & Accountability Act" (FTC business guidance).

The first case under that rule was GoodRx, which the FTC said was "sharing sensitive personal health information for years with advertising companies and platforms" (FTC). In blood testing, Everlywell settled a class action over tracking pixels without admitting wrongdoing; our Everlywell vs LetsGetChecked guide covers it. Several states, including Washington, also have consumer health data laws that apply to companies outside HIPAA.

De-identified data: the clause most people miss

Almost every policy above lets the company strip names from your results and use or share what is left. Superpower's agreement goes furthest: you agree it may "use or disclose such de-identified information for any purpose" (Superpower membership agreement). Empirical names marketing and advertising among the uses. SiPhox lists sharing de-identified data with vendors, including "artificial intelligence company generating content" (SiPhox privacy policy).

De-identified does not mean nothing can be learned. It means the data no longer meets the legal definition of identifiable. If that matters to you, choose a service whose policy limits it to research, or that says it does not sell.

How to share less

• Read the policy, not the badge. "HIPAA compliant" on a product page and "we may share with advertising vendors" in the policy can both be true.
• Opt out of sale and sharing. Most policies above have a "Do Not Sell or Share" link; use it before or right after you order.
• Block ad trackers when you shop. The pixel cases were about what the shopping pages sent to ad platforms.
• Check linked accounts. Labcorp OnDemand says everyone linked to a Labcorp Patient account sees all OnDemand results.
• Pick the lab route when privacy matters most. A lab-store order that names Quest or Labcorp keeps the results with a HIPAA-covered lab; our guide to ordering your own blood test explains how, and which states allow it.

This site runs no ad or tracking pixels on test pages.