Skip to content
Build your panel
Create account to build your panelHelp me choose
Legal

Privacy Policy

Your body. Your data. Your choice.

Effective October 28, 2026

On this page

This Privacy Policy explains how EllaDx LLC (“EllaDx,” “we,” “our,” or “us”) collects, uses, shares, and protects information about you when you use our website, order a laboratory panel, receive test results, or otherwise interact with our services (collectively, the “Service”).

EllaDx provides in-lab diagnostic testing designed for women, delivered through independently contracted CLIA- and CAP-accredited laboratory partners. We are a wellness and educational service; we are not a healthcare provider and we do not diagnose, treat, cure, or prevent any disease. Please read this Policy alongside our Terms of Service.

If you are in a medical emergency, call 911 or go to the nearest emergency room. Do not rely on the Service for urgent medical needs.

You can reach EllaDx LLC at Hello@elladx.com. For privacy-specific requests use the same address and mark your message “Privacy Request.”

We collect information in three ways: information you give us directly, information we collect automatically when you use the Service, and information we receive from service providers and laboratory partners acting on our behalf.

2.1 Information you give us directly

  • Account and contact information: name, email address, mailing address, phone number (if provided), and account credentials.
  • Health information: responses to our symptom quiz, including information about your cycle, reproductive history, symptoms, family history, medications, and lifestyle; the biomarker panel you order; and intake information you provide before a blood draw.
  • Payment information: we do not store full payment card numbers. Payment is processed by Stripe, Inc., which collects and stores your card details under its own privacy terms. We retain only a tokenized reference, the amount, the last four digits, and the card brand, along with flags indicating whether HSA/FSA funds were used.
  • Communications: messages you send us via the contact form, careers form, email, or customer support.

2.2 Information we collect automatically

  • Device and usage data: IP address (which we hash before storing for rate-limit purposes on public endpoints), browser type and version, device type, pages viewed, referring URL, and timestamps.
  • Cookies, pixels, and similar technologies: we use session cookies for essential functionality (authentication, cart state, CSRF protection). On our public website pages and the order confirmation page, we also use analytics and advertising cookies and pixels from Google, Meta, and Microsoft. See “Analytics and advertising partners” and “Cookies and tracking” below for details and how to turn them off.

2.3 Information we receive from third parties

  • Laboratory results: Quest Diagnostics (our primary laboratory partner) returns your biomarker results to us through Junction (our lab-orchestration provider).
  • Address verification and autocomplete: Google Places may assist in address entry during intake.
  • Email validation: SendGrid may validate the deliverability of an email address you submit.

We use your information to:

  • Provide, maintain, and improve the Service, including matching your quiz responses to the biomarker panels most likely to be relevant to your symptoms.
  • Process your order, schedule your blood draw, generate lab requisitions, and deliver your results report.
  • Communicate with you about your account, your order, changes to the Service, and — only if you opt in — marketing content about EllaDx.
  • Detect, investigate, and prevent fraud, abuse, and security incidents.
  • Comply with legal obligations, respond to lawful requests, and enforce our Terms of Service.
  • Produce aggregated, de-identified statistics about how the Service is used. De-identified data does not identify you and is not subject to this Policy.

We do not sell your personal information for money. We share information only as described below. Some of the sharing with analytics and advertising partners described in section 4.5 may be considered a “sale” or “sharing” of personal information, or “targeted advertising,” under some state privacy laws. You can opt out as described in section 7.

4.1 Service providers (processors and business associates)

We use trusted service providers to operate the Service. Each receives only the minimum information needed to perform its function and is contractually required to protect that information.

  • Amazon Web Services (AWS) — application hosting, authentication through Amazon Cognito, database services through Amazon Aurora, file storage through Amazon S3, content delivery through Amazon CloudFront, and optional AI processing using Claude models through Amazon Bedrock as described below.
  • Cloudflare — delivery of selected images in marketing emails.
  • Stripe — payment processing.
  • Paubox — delivery of account, transactional, and opted-in marketing emails sent by the application.
  • Quest Diagnostics — CLIA- and CAP-accredited laboratory processing.
  • Junction — lab-order orchestration between EllaDx and Quest Diagnostics.
  • Klaviyo — marketing email delivery to users who have opted in. We do not send protected health information to Klaviyo.
  • SendGrid — transactional email and email validation.
  • Google Places — address autocomplete during intake.

4.2 Legal and safety

We may disclose information when we reasonably believe disclosure is required or permitted by law — for example, to respond to a subpoena, court order, or other legal process; to enforce our Terms of Service; to protect the rights, property, or safety of EllaDx, our users, or the public; or to comply with regulatory obligations.

4.3 Business transfers

If EllaDx is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction, subject to the receiving party's commitment to honor this Policy (or give notice and an opportunity to opt out before any materially different use).

4.4 With your consent

We may share your information for other purposes disclosed at the time of collection or with your explicit consent.

4.5 Analytics and advertising partners

When you visit our public website pages, such as the home page, our test catalog, and our articles, and the order confirmation page, Google (Google Analytics, Google Ads, and Google Tag Manager), Meta (the Meta pixel), and Microsoft (Microsoft Clarity) receive information through their cookies and pixels. This includes the address of the page and the page that referred you, your IP address, browser and device details, cookie identifiers, the ad you clicked (if any), how you interact with the page, and events such as starting our quiz, finishing it, starting checkout, and completing a purchase, with the order total and an order reference. They use it to provide analytics to us and to measure and target our advertising, and they may combine it with other information they hold about you.

We do not send them your quiz answers, the tests you choose, your results, your name, your email address, or other health information. Their tags do not load on our quiz, checkout, sign-in, or account pages, or in the patient portal. See section 7 for how to turn these tools off.

Laboratory test results and the intake information directly supporting a lab order are Protected Health Information (PHI) as defined by the Health Insurance Portability and Accountability Act of 1996 (HIPAA), as amended. We treat this information accordingly.

  • Our laboratory partners (Quest Diagnostics) are covered entities under HIPAA.
  • EllaDx operates as a Business Associate with respect to PHI processed on behalf of those covered entities, and operates under BAAs with its own downstream subprocessors who handle PHI.
  • We do not disclose PHI to Klaviyo, SendGrid, Google Places, or any other non-BAA processor. Marketing systems receive only non-health identifiers (name, email, whether you completed the onboarding quiz).
  • Because EllaDx is an educational and wellness service and not a covered healthcare provider, we do not generate the HIPAA “Notice of Privacy Practices” that a clinician would issue. Your rights with respect to PHI held by Quest Diagnostics and other covered entities are governed by their notices.

6.1 Access, correction, and deletion

You may access, correct, or delete account information through your account dashboard. You can start account deletion in the mobile app under Account help or deletion, even before finishing account setup. You can also contact Hello@elladx.com for help. Some information — for example, records we are required to retain for lab, tax, or legal-compliance purposes — may be retained after account deletion.

6.2 Marketing communications

Every marketing email includes an unsubscribe link. You may also contact us to opt out of marketing communications. Transactional messages (order receipts, results notifications, account security) will continue because they are required to deliver the Service.

6.3 California residents (CCPA / CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act, including the right to know what personal information we collect about you, the right to delete personal information, the right to correct inaccurate information, the right to limit use of sensitive personal information, and the right to opt out of sale or sharing of personal information (the analytics and advertising cookies and pixels described in section 4.5 may be considered selling or sharing under the CCPA/CPRA; you can opt out with “Cookie settings” on our website, and we treat a Global Privacy Control signal from your browser as a request to opt out). To exercise these rights, email us at Hello@elladx.com with subject line “California Privacy Request.” We will verify your identity before acting on your request.

6.4 Other U.S. state residents

Residents of states with comprehensive consumer privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and others as they come into effect) may have similar rights. Use the same contact path as above to exercise them.

6.5 Authorized agents

You may designate an authorized agent to submit requests on your behalf. We may require proof of the agent's authority and independent verification of your identity.

We use essential cookies for authentication, cart state, and security. They are always on.

On our public website pages and the order confirmation page, we also use analytics and advertising cookies and pixels: Google Analytics, Google Ads, and Google Tag Manager from Google; the Meta pixel from Meta; and Microsoft Clarity from Microsoft, which records how pages are used, such as clicks, scrolling, and mouse movement. They load when you visit unless you have turned them off. We use them to understand how our website is used and to measure and improve our advertising, including showing our ads to people who have visited our website. We do not load them on our quiz, checkout, sign-in, or account pages, or in the patient portal.

You can turn analytics and advertising cookies off at any time with “Cookie settings” at the bottom of our website pages. Your choice applies to the browser where you make it. We also turn them off when your browser sends a Do Not Track or Global Privacy Control signal. You can also control cookies through your browser settings. Disabling essential cookies will break core Service functionality, such as signing in and placing an order. Google, Meta, and Microsoft handle the information they receive under their own privacy policies, and you can also manage your advertising preferences with them directly.

We use administrative, technical, and physical safeguards designed to protect your information. These include encrypted transport (TLS 1.2+), encrypted storage for sensitive fields, access controls and audit logging on production systems, and vendor security assessments. No system is perfectly secure, so we cannot guarantee absolute security.

We retain your information for as long as your account is active and for a reasonable period afterwards to support legal, regulatory, accounting, and dispute-resolution obligations. Specifically:

  • Lab-test records and supporting intake data are retained in accordance with applicable state laboratory retention rules (typically a minimum of two years; some states require longer).
  • Financial records (invoices, payment receipts) are retained for at least seven years for tax and audit purposes.
  • Marketing records are retained until you opt out or request deletion.
  • De-identified, aggregated data may be retained indefinitely.

The Service is not directed to individuals under 18, and we do not knowingly collect information from anyone under 18. If you believe a child has provided us personal information, please contact us and we will delete the information.

The Service is offered only in the United States. If you access the Service from outside the U.S., you understand your information is processed in the U.S. under U.S. law.

We may update this Policy from time to time. If we make material changes, we will notify you by email (if we have your email) or by posting a prominent notice on the Service before the change takes effect. The “Last updated” date at the top of this Policy reflects the current version.

Questions, requests, or concerns about this Policy or our information practices:

EllaDx LLC
Attn: Privacy
1630 W Prosper Trail, #620
Prosper, Texas 75078
Hello@elladx.com

During account setup, we record your agreement to a specific version of the Terms of Use and your acknowledgement of the Privacy Policy, together with your account identifier, the document versions, and the time of your choice. Signing in through Apple or Google does not by itself record acceptance of EllaDx terms. We receive the account identifiers and contact information the sign-in provider makes available to us through Amazon Cognito.

Optional AI processing

If you give separate permission, EllaDx uses a Claude model through Amazon Web Services (AWS) Bedrock to produce optional quiz suggestions and plain-language laboratory summaries. Quiz requests may include your selected symptoms and answers, age group, sex assigned at birth, and life stage. Laboratory-summary requests may include your numeric laboratory results, units, reference ranges, sex assigned at birth, life stage, and cycle phase. For structured laboratory-summary and quiz-suggestion prompts, we do not include your name, email, street address, or account identifier. This statement does not apply to uploaded PDF extraction, which transmits the complete report as described below. The information remains sensitive health information even when direct identifiers are omitted.

AI processing is optional. You can decline it and continue to order tests and read ordinary laboratory results. You can withdraw permission in the app's AI preferences. Withdrawal stops future AI requests, including queued work that has not begun; it cannot undo a request already transmitted. Generated text is educational, may contain mistakes, and is not medical advice or a substitute for a qualified clinician. Marketing permission, laboratory-order authorization, and AI permission are separate choices.

Notifications and diagnostics

With notification permission, we use Apple's Push Notification service and AWS Simple Notification Service to deliver generic account-update alerts. We associate a device-token hash and a delivery endpoint with your account. Health details remain inside the authenticated app. You may turn off notifications in device settings; sign-out removes the current device registration and account deletion removes account-associated registrations.

When crash reporting is enabled, Sentry receives technical error and device/software information to help diagnose failures. The app filters identifiers, health details, authentication tokens, and payment secrets from diagnostic events and does not enable performance tracing. Face ID or device biometrics are used by the operating system to authorize secure account access; EllaDx does not receive your biometric template. Stripe handles payment entry, and we retain payment references and transaction information needed to provide your orders and receipts.

Account deletion

You can start an account-deletion request inside the app, including before finishing your health profile or accepting updated terms. A request disables ordinary account access and starts removal of account credentials, notification registrations, and personal data that we do not need to retain. Some requests require review of clinical, financial, security, or other records that must be retained for applicable obligations. We restrict retained records and do not describe a pending request as completed deletion. Keep your request reference and contact Hello@elladx.com for status, retained-record details, or help with a third-party account connection. Required clinical or financial retention does not mean that all account data is kept indefinitely.

AI processing is a separate, optional choice. With your explicit permission for the current disclosure, EllaDx uses Claude models through Amazon Web Services (AWS) Bedrock to produce educational laboratory summaries and optional quiz suggestions, and to read outside laboratory reports you choose to upload.

Structured laboratory-summary requests include laboratory values, units, reference ranges, biomarker names and lab flags, sex assigned at birth, life stage, and cycle phase. Optional quiz requests include selected symptoms and answers, age group, sex assigned at birth, life stage, and panel test names. We omit your name, email, street address, account identifier, and collection dates from these structured prompts. This is still sensitive health information.

If you choose to upload an outside lab report for AI extraction, we send the complete PDF to Claude through AWS Bedrock to extract laboratory values and check the report name. That file is not de-identified and may include names, dates of birth, addresses, collection dates, patient identifiers, and other information printed on the report. EllaDx does not save the PDF in this extraction flow. Only reports you choose to upload are sent.

You can keep AI off and continue to order tests and read ordinary laboratory results. Uploading an outside report for AI extraction requires separate AI permission before the file is sent. Acknowledging this Privacy Policy, accepting Terms of Use, authorizing a laboratory order, or allowing marketing does not grant AI permission. Permission for an earlier disclosure does not authorize a newly disclosed use; we ask you to review and explicitly allow the current disclosure.

You can withdraw permission in the mobile app under “Optional AI features” or through “Withdraw AI permission” in the portal's outside-report upload controls. Withdrawal stops future AI requests and removes existing AI insights. Unfinished report extractions are cancelled and their partial output and detected names are erased. Laboratory results already imported into your account are retained as ordinary results and remain subject to the account's deletion and retention controls. A request already transmitted cannot be recalled, but its response will not be saved or published after withdrawal.

AI output is educational, may contain mistakes, and is not a diagnosis or a substitute for a qualified clinician. Review imported values against your original report and discuss medical decisions with your clinician.