Lab tests and reports

Blood test results and AI: where your data goes

October 20267 min read

Taking a photo of a medical report and asking an AI assistant what it means has become common. Italy's data protection authority, the Garante, has called it an alarming trend, for two reasons: control over health data and the reliability of the answers. This guide explains where the data goes in each case, when a report is read online and when it is read on the phone, and what privacy authorities in Europe and the United States advise. Every statement has its source at the bottom of the page.

This guide is about where your data goes, not about how to read results. No tool, online or on your phone, replaces your doctor: they explain what a test or a report means. Services change their terms over time: before using one, read its current privacy notice.

What happens when you upload a report online

An online AI assistant, that is a chat service answering from a website or an app, runs on the computers of the company that provides it. When you upload the photo or PDF of a report, the file leaves your phone and reaches those computers: that is where it is read and where the answer is prepared.

From then on, what happens to the file depends on the service and on the settings you chose: how long it is kept, whether it is deleted after the answer, whether it can be used to train models. The Garante advises reading the privacy notice precisely to check whether uploaded data is deleted after the request or used to train algorithms.

A report carries a name, a date of birth, the lab and the results. When the report belongs to a child, it is the health data of someone who did not choose to share it.

What privacy authorities say

On July 30, 2025, the Garante per la protezione dei dati personali, Italy's data protection authority, published a press release on medical reports and AI. It describes people uploading lab results, X-rays and other reports to generative AI platforms to get an interpretation or a diagnosis, and points to two risks:

losing control over your own health data;
wrong guidance from systems that were not designed as medical devices.

It advises weighing carefully whether to share health data, reading the privacy notice to know whether uploaded data is deleted or used for training, and remembering that the answers should always be checked with a medical professional. It also refers to the EU Artificial Intelligence Act, which requires human oversight, and to a 2021 opinion of Italy's Superior Health Council: when AI processes health data, a qualified human intermediary is needed.

In the United States, the Federal Trade Commission gives similar advice for health apps: look for a privacy notice that explains in simple terms what health information the app collects, check the settings to see whether they give you control over what it collects and shares, and remember that, unlike your doctor, these apps may not be covered by health privacy laws like HIPAA. In the FTC's words, sharing sensitive information always carries risks, so be sure you are comfortable with what you have shared.

If you decide to use an online assistant

The choice is yours. If you make it, these are the checks the authorities suggest, with a few practical extras:

Read the service's privacy notice: where the file goes, how long it stays, whether it can be used to train models.
Look at the settings: they may let you decide whether history is kept and whether content can be used to improve the service.
Ask yourself whether the file really needs to show the name, date of birth and ID numbers.
Use the answer as a list of questions for your doctor, not as an answer: your doctor is the one who checks it, as the Garante asks.

Reading the pages on the phone: what changes

There is another way to turn the photo of a report into text: have it read by tools that work on the phone, without sending the image to a server. Text recognition is something iPhone and Android can already do.

On Android, Google's text recognition library, ML Kit, processes on the device and works offline: Google describes it as suitable for images and text that need to remain on the device. Google also publishes the list of what the library sends: technical information such as the device model, the app version, the settings used, performance and error codes. The list does not include the images or the text that was read.

On iPhone, Apple gives apps access to the on-device Apple Intelligence model through the Foundation Models framework, and describes it as available offline. On its privacy page Apple says its on-device models complete a task without data leaving the device; for more complex requests Apple Intelligence can also use Apple's servers (Private Cloud Compute), where, Apple says, data is not stored.

Reading on the phone does not make an answer more accurate: it changes where the data is. What the results mean remains a question for your doctor.

The same questions apply to any app

These checks are not only about AI assistants: they apply to any app you trust with reports and results, including the one you use to keep them. The FTC advice above was written for health apps in general, and the Garante's advice on privacy notices works for any service.

In practice, before you upload a report, ask yourself:

Where is the document read: on the phone, or on the computers of the company that runs the service?
What leaves the phone, to whom, and for what purpose?
Do you need an account? If so, what stays tied to that account?
Where is the data stored, and how is it protected?
Who else sees it: your family, your doctor, no one?

The next two sections answer these questions for Pediary.

How Pediary does it

Pediary reads the pages of lab tests and medical reports on the phone. When you choose how to add a lab test, the app puts it this way: “The pages are read on this device: nothing is sent anywhere to read them.” Not to Pediary, not to Apple, not to Google.

On iPhone, text is taken from the PDF when it has any, otherwise it is recognized from the image with Apple's tools on the phone. On Android, ML Kit is used as described above; to fix misread words, the app passes them to the spell checker of the keyboard chosen on the phone.

The limits, plainly:

Automatic reading works for reports in Italian and English. For a report in another language the pages stay attached and you type the details yourself.
Apple Intelligence is used only for medical reports, not for lab tests, and only on iPhone, on devices that have it and if you allow it, with the model that runs on the phone. The app asks once (“Use Apple Intelligence?”) and you can change your choice in Settings, under “Apple Intelligence for reports”.
Apple Intelligence suggests the category, title and facility of the report and looks for the doctor's conclusions by choosing only among the lines of the document: it does not write words of its own and does not explain the results.
Whatever the reading fills in must always be checked: for lab tests the app reminds you with “Check every value against the pages before saving”.

Where the data stays after reading

Pages and results stay in the app's database on the phone. On iPhone the database file is encrypted by iOS until the phone is unlocked for the first time after it is switched on; on Android the database is encrypted and its key is kept in the Android Keystore, the phone's protected key store.

They leave the phone only when you choose:

with sync, end-to-end encrypted, to the family's phones running Pediary 3.3.0 or later;
with automatic backup, if you turn it on: it copies to your Google Drive, Dropbox or OneDrive the same ZIP file as the manual export, which has no password and is as protected as your cloud account;
with “Share PDF” or “Share text”, when you send a lab test or a report to your doctor.

You do not need a Pediary account to use Pediary: sync and backup use the family's own cloud storage.

Pediary stores your lab tests and medical reports and helps you find them: it does not interpret them or give medical advice. To understand what they mean, talk to your doctor.

Lab tests and medical reports, all in one place

Pediary is a free app for iPhone and Android, with no Pediary account and no ads, that keeps lab tests and medical reports for children and adults, reads the pages of Italian and English reports on the phone, and shows how values change over time.

Discover lab tests and reports