Privacy Policy

Information we collect

• Account information: your phone number, full name, and optionally an email address. If you sign in with Google, we receive your name, email, and a Google account identifier from Google instead of a password.
• Password: if you create an account with a password, we store only a salted, hashed version of it — never the password itself.
• Phone verification: when you verify a phone number, we send a one-time code over WhatsApp or SMS and record that the number was verified. We do not store the code itself after it expires or is used.
• Family members ("dependents"): names, relationship labels, and optionally a separate phone number for any dependent you add to your account (e.g. a spouse, child, or parent).
• Lab reports: when a lab uploads a report against your phone number, we store the report file(s) (PDFs), test names, prices, and any notes attached to it, and associate it with your account or a dependent's profile once you confirm it's yours.
• Location: if you use the "Find a lab" search, your device's location is sent to us to calculate distances to nearby labs and is stored on your account so the app doesn't need to ask again every time. This is only ever used to power that search feature.
• Reviews: star ratings and written comments you submit about a lab you've received a report from.
• Usage & device data: standard technical information such as IP address and request metadata, used for security purposes like rate-limiting login attempts.

How we use this information

• To verify you're the rightful owner of a phone number before any report or notification is attached to it.
• To deliver verification codes, lab reports, and notifications over WhatsApp or SMS.
• To let you search for labs near you, compare prices for a specific test, and read/leave reviews.
• To operate account security features such as sign-in, session refresh, and rate-limiting against abuse.
• To let a lab you interact with see the reports it has itself uploaded, and the phone number/patient name needed to route that report correctly.

We do not sell your personal information. Clinical report contents and test results are not used to target promotional offers.

Research and improving TibbSync

We may use report content — test names, results, reference ranges, and similar data — for research purposes and to develop and improve TibbSync, including training or evaluating AI/machine-learning models. Before a report is used this way, we remove the personal details that could identify you: your name and phone number. What's used doesn't include those details and isn't linked back to you or any specific patient.

Who we share information with

• Labs on the platform: a lab can see the reports it uploads and the phone number/patient name it uploaded them against. Labs cannot see your other reports, dependents, or reviews unless those reports were uploaded by that same lab.
• WhatsApp: we use a WhatsApp Business API gateway to deliver verification codes and report notifications. The phone number and message content (including report PDFs) pass through this channel to reach you.
• SMS delivery: our SMS relay receives the destination phone number and message text. When bulk promotional SMS is configured, it also receives the selected recipients' names to personalize the lab's message.
• Google: if you choose "Continue with Google," Google verifies your identity for us per its own privacy policy; we only receive the profile information described above.

We do not share your data with any other third party for their own marketing purposes.

Lab promotional SMS

When an administrator enables marketing for a lab and bulk SMS delivery is configured, authorized lab staff can send an offer to patients recorded in that lab's own order history. The lab chooses the message and recipients; it can search and select using recorded names, phone numbers, order counts, and last-order dates. Clinical results and reports from other labs are not included in this selection.

A campaign is limited to one SMS per selected phone number, an administrator-set patient cap (50 by default), and one campaign per lab every seven days. Shared numbers receive one copy. Each message includes a TibbSync app download footer. Messages are initiated by lab staff, not sent on an automatic schedule.

We store the campaign's message, selected names and phone numbers, initiating staff account, timestamps, submission identifier, and outcome to show campaign history, enforce limits, and prevent duplicate submissions. The SMS delivery service receives the template and selected names and phone numbers to deliver the offer. These records remain part of the lab's operational records. Contact the sending lab about its promotional messages.

TibbSync WhatsApp Helper browser extension

The helper connects a lab's TibbSync portal to WhatsApp Web so staff can prepare or send patient order updates and report messages. It is for labs configured for manual WhatsApp sending and uses the WhatsApp account already signed in to the same browser profile.

Information the helper handles

• Recipient and message data: the recipient's phone number and the message requested by the lab portal. Messages may include patient names, order identifiers, test names, order totals, and receipt or report links. This can include personally identifiable, health, financial, communication, and website-content data.
• Chat and sending state: whether WhatsApp is signed in, the target chat's identifier, and any existing draft in that chat, to avoid overwriting it without confirmation. The helper returns success or error information to the lab portal, including a message identifier when WhatsApp confirms sending.
• Browser access: the helper detects and reuses a WhatsApp Web tab, or opens one when needed. It receives requests from supported TibbSync lab pages; local development lab pages are also supported. It does not request access to your browser's history, location services, or passwords, and it does not inspect unrelated browser tabs.

How messages are used and shared

Recipient and message data are passed within your browser to WhatsApp Web to prepare a draft or send the requested message. Draft mode is the default and leaves sending to you. If the lab enables direct sending in TibbSync settings, the helper sends the requested message immediately. Messages sent through WhatsApp are shared with WhatsApp and the recipient under WhatsApp's own terms and privacy practices. The helper prepares or sends text and links; it does not itself download or attach the report PDFs.

The helper does not maintain a separate message archive or upload copies of your chats to TibbSync. WhatsApp may retain drafts and messages in its own storage. TibbSync's existing orders, reports, and notification records remain subject to the app and website practices described elsewhere in this policy. The helper does not sell message data or use it for advertising, credit or lending decisions, or AI-model training. The research section above describes data held by the TibbSync platform, not additional collection by the extension.

Update checks and library privacy from version 1.1.3

From version 1.1.3, the helper disables the bundled library's Google Analytics telemetry and disables link-preview generation for messages it sends directly. The helper does not send report or receipt URLs to the library's external preview services. WhatsApp's own handling of messages and links still applies.

The helper automatically requests the latest available version from TibbSync on browser startup and daily, and also checks when its popup is opened or you request a check. This request sends no recipient phone number, message text, or chat content. Our server receives the request's IP address and standard HTTP metadata as described in the usage and device-data section above. The response contains version and installation information, not executable code. Install the helper through its official Chrome Web Store listing to receive approved updates through your browser. Older installations made from a folder can show an update notice; replace that copy with the store version to receive automatic updates.

Earlier version 1.1.2

Version 1.1.2 includes the WA-JS library, whose Google Analytics telemetry is enabled by default. When the library runs in WhatsApp Web, it can send technical and usage information to Google Analytics: browser language, screen size, the current page URL, referrer and title, generated client and session identifiers, WhatsApp and library versions, and session, engagement or diagnostic events. The library stores analytics identifiers and counters in the WhatsApp page's browser storage. The receiving service can also see the IP address of these requests. These requests are separate from sending your message. After upgrading, refresh WhatsApp Web once to unload the earlier library and its running telemetry. The updated helper requests this refresh before operating on an older telemetry-enabled page.

Direct sending in this version also uses the library's default link-preview feature. For messages containing a link, preview generation may share that URL with WhatsApp or the library's external preview services at cobrancas.uppermesh.com.br, wajsapi.titanchat.com.br, and wppc-linkpreview.cloudtrix.com.br. A URL can contain private report or receipt access information. These services receive requests to generate a preview, rather than to deliver the message itself.

Your controls and retention

You can leave direct sending disabled, stop using the helper, revoke its browser permissions, or uninstall it. Revoking permissions or uninstalling stops future helper operations; it does not recall messages already sent or delete WhatsApp drafts, messages, or browser storage. Those can be managed through WhatsApp and your browser's site-data controls. For questions about extension data or deletion requests, contact support@faybers.com.

How long we keep your information

We retain your account, dependents, and reports for as long as your account exists, so your family's report history stays available to you. You can remove individual reports from within the app. To request deletion of your entire account and all associated data, email us at support@faybers.com.

Security

Passwords are hashed, not stored in plain text. Phone numbers are verified before any report can be attached to them, and no report is considered "yours" until you confirm it in the app. Access to the app and lab portal is protected by expiring, signed authentication tokens, and login endpoints are rate-limited against automated guessing.

Your choices

• You can confirm or reject any report a lab uploads against your number before it's added to your history.
• You can add, view, and manage dependents from your profile at any time.
• You can stop using the "Find a lab" search at any time; your stored location is only ever used for that feature.
• You can request a copy or deletion of your data by contacting us at support@faybers.com.

Children's data

TibbSync is intended for use by adults managing their own and their family's lab reports. A dependent's profile (including a minor's) is managed entirely by the guardian's account; TibbSync does not knowingly allow a child to create their own independent account.

Changes to this policy

If we make material changes to this policy, we'll update the "Last updated" date above. Continued use of TibbSync after a change means you accept the updated policy.

Contact us

Questions about this policy or your data? Email support@faybers.com.