Privacy policy

1. Who we are and what Rezulto does

Rezulto is a platform that allows medical laboratories to send test results to patients securely. The platform is provided by REZULTO SH.P.K. (në themelim), NUI registration in progress, located at Rruga Bajram Kelmendi 29, 70000 Ferizaj, Kosovë.

The laboratory uploads the final result as a PDF, or the laboratory’s software sends it automatically through an API. You receive an SMS, a WhatsApp message or an email with a personal link. To open the result, you enter a 6-digit one-time code sent to the phone number or email address registered by the laboratory.

2. Who is responsible for your data

The laboratory that performed the tests is the controller of your results: it produces the results and decides to send them to you. Rezulto acts as a processor on the laboratory’s behalf, under a data processing agreement signed with each laboratory.

Rezulto is the controller only for your account on the platform (your lifelong identifier, the contact you use to sign in and the security logs) and for the security of the website.

For questions about the content of your results (errors, corrections, missing tests), please contact your laboratory. For any other privacy question, write to us at privacy@rezulto.app.

3. What data we process

Test results are health data, a special category of personal data that enjoys enhanced protection under the law.

• Identity data: first name, last name, parent’s name, personal number, date of birth, sex.
• Contact data: phone number, email address, preferred language.
• Results and related data: result PDFs, laboratory, request number, test names, dates.
• Technical and security data: IP address, browser user agent, access logs, one-time code attempts.
• Laboratory staff account data: name, email, role, sign-in and two-factor authentication data.

4. How access to results works

• After you click your personal link, a 6-digit one-time code is sent to the phone or email registered by the laboratory. The code is valid for 10 minutes and allows up to 5 attempts.
• You can also sign in with your Kosovo personal number or your Rezulto ID (RZ-XXXX-XXXX) together with your date of birth, followed by a one-time code.
• A patient session lasts at most 12 hours.
• In your account you see all your results from all laboratories that use Rezulto, for life.
• If the laboratory chooses this option, the PDF may be attached to the email, protected by a password: the first 3 letters of your surname followed by your date of birth in DDMMYYYY format.
• Every opening of a result and every change of a patient’s phone number or email is logged. The laboratory can see whether you have opened the result.

5. Legal bases

Processing complies with Law No. 06/L-082 on the Protection of Personal Data of the Republic of Kosovo, which is aligned with the EU General Data Protection Regulation (GDPR). For patients living in the European Union, the GDPR also applies.

• Sending results: the consent you give to the laboratory at reception, the provision of healthcare and the laboratory’s legal obligations.
• Your platform account: providing the service you requested, namely lifelong access to your results.
• Security and access logs: our legitimate interest in protecting your data and the platform against unauthorised access.

6. Where data is stored and who processes it

Data is stored in the European Union only. We use the following sub-processors:

• Supabase (database, file storage, server functions), on AWS servers in Frankfurt, Germany (eu-central-1).
• Cloudflare (website hosting, DNS, email routing and the Turnstile anti-bot check): global network, data processed under EU standard contractual clauses.
• Brevo (Sendinblue SAS), Paris, France: sending emails.
• Prelude (Ding SAS, Paris, France): sending SMS and WhatsApp messages.
• Meta Platforms Ireland Ltd (WhatsApp): only when a code or a notification is sent via WhatsApp.

7. How long we keep data

• Results: as long as required by the laboratory’s contract and by the legal obligations for keeping medical records, and as long as your account exists, since lifelong access is the purpose of the service.
• You can ask for your account to be deleted. Results that the laboratory is legally required to keep remain with the laboratory.
• One-time codes, sessions and failed sign-in attempts: deleted after 30 days.
• Security and access logs: 5 years.
• Laboratory staff accounts: deleted 90 days after the end of the laboratory’s contract.

8. Your rights

Send your requests to privacy@rezulto.app. For the content of your results (errors, corrections), contact your laboratory. We reply within 30 days. We may ask you to verify your identity before handling a request, so that your data is never disclosed to someone else.

• Right of access to your data.
• Right to rectification of inaccurate data.
• Right to erasure.
• Right to restriction of processing.
• Right to data portability.
• Right to object.
• Right to withdraw your consent, for future sendings.
• Right to lodge a complaint with the Information and Privacy Agency (Agjencia për Informim dhe Privatësi, AIP), Prishtina, https://aip.rks-gov.net, or with the data protection authority of your EU country.

9. Security

The measures we take to protect your data are described on the Security page: encryption in transit and at rest, one-time codes, two-factor authentication for staff, full isolation between laboratories and logging of every access.

10. Changes to this policy

This policy may be updated. The date of the last update is shown at the top of the page. Significant changes are announced on the website.