1. Information We Collect
TestWell collects personal information you provide when creating an account, placing an order, or contacting us. This may include your name, email address, date of birth, biological sex, phone number, mailing address, and payment information.
We also collect health-related information necessary to process your lab orders, including test results reviewed by licensed physicians.
2. How We Use Your Information
We use your information to process lab orders, deliver results, communicate with you about your account, and improve our services. We do not sell your personal or health information to third parties. Advertising cookies, which are off unless you turn them on, count as “sharing” under California law — Section 6 explains exactly what they do and how to opt out.
3. Data Security
Your data is encrypted in transit and at rest. We implement industry-standard security measures and comply with all applicable HIPAA requirements to protect your health information.
4. Developer API and AI Assistant Connectors
TestWell publishes a public, read-only developer surface — a catalog API, an MCP server at test-well.com/mcp, and an OpenAPI description — that lets AI assistants (Claude, ChatGPT and others) and third-party software look up tests, prices, draw locations and educational reference ranges. These endpoints require no account and never access orders, results or any patient record. When a tool is called we log the tool name, whether it succeeded, response time, a coarse summary of the request (for example a US state or the first three digits of a ZIP code), the calling software's user-agent string, and a one-way hash of the caller's IP address that changes daily. Full request arguments are not stored; for the results-explainer tool, which accepts lab values you choose to paste, nothing about the values is logged at all. This usage data is kept for aggregate reporting and abuse prevention and is not sold or shared. If you reach TestWell through an AI assistant, that assistant's own privacy policy governs what it retains from your conversation.
5. Your Rights
You may request access to, correction of, or deletion of your personal information at any time by contacting us at support@test-well.com.
6. Cookies, Tracking, and Your Choices
When you first visit, a short banner asks what TestWell may use. Nothing beyond the essentials runs until you answer, and you can change your answer at any time from the Cookie Preferences link in the footer. Your choice is stored for 12 months in the tw_consent cookie.
Essential — always on
These make the site work and are not used for tracking: your sign-in session (set by our authentication provider), your cart (stored in your browser), checkout-flow cookies (tw_checkout_v2, tw_checkout_v2_pin), partner co-branding and referral attribution when you arrive through a partner page (tw_partner, tw_partner_visual, tw_wl_brand — session only), and your cookie choice itself. We also keep a first-party record of how you found us — the referring site and any campaign tags in the link (tw_acq, 90 days; tw_ses, session only). That record stays with us and is never sent to an advertising platform.
Analytics — only with your permission
Google Analytics 4 tells us which pages help people and which don't. Cookies: _ga and _ga_* (Google, up to 2 years) and tw_cid(ours, a random visitor id that lets us report a completed order to Analytics, 2 years). What Google receives: pages viewed on our public site and order totals. What it never receives: your name, email, test names, results, or anything from your account. If you decline, Google Analytics still gets anonymous, cookieless page counts — no identifier is stored on your device.
Advertising — only with your permission
Lets the ad platforms that brought you here learn that an ad led to an order. Google Ads: the _gcl_* cookies (90 days) and the click identifier from the ad link; after an order we report the order id, the total, and a one-way hash of your email address so Google can match the conversion to the click. OpenAI (ChatGPT ads): the __opprefcookie holding the ad-click reference, and an order id plus total after purchase. Neither platform ever receives which test you bought or any health information. When Advertising is off, none of these cookies are set and we do not send your order to either platform — not from your browser and not from our servers.
Your account and results are never tracked
No analytics or advertising code loads on signed-in pages — your account, orders, results, trends, the provider portal, or the partner portal — whatever you chose on the banner. Vercel, our hosting provider, collects cookieless, aggregate performance measurements on every page; those contain no identifiers.
Do Not Sell or Share, and Global Privacy Control
We do not sell personal information. Under the California Consumer Privacy Act, the advertising cookies and conversion reports described above are “sharing” for cross-context behavioral advertising, and similar state laws call them “targeted advertising.” Leaving Advertising off is your opt-out; the Do Not Sell or Share My Personal Information link in the footer opens the same setting. If your browser sends a Global Privacy Control signal, we treat it as that opt-out automatically: Advertising is turned off and cannot be turned on while the signal is present.
You can also clear or block cookies in your browser settings. Blocking essential cookies will prevent sign-in and checkout from working. Turning a category off removes the cookies in that category from your browser at that moment.