Data Processing Agreement

• "Controller" — your organization, which determines the purposes and means of processing personal data within LabMatix.
• "Processor" — LabMatix, which processes personal data on behalf of and under the instructions of the Controller.
• "Personal Data" — any information relating to an identified or identifiable natural person (e.g., analyst names, client contact details, user accounts).
• "Processing" — any operation performed on Personal Data, including storage, retrieval, alteration, disclosure, or deletion.
• "Sub-processor" — any third party engaged by LabMatix to process Personal Data as part of delivering the Service.
• "Applicable Law" — UU No. 27 Tahun 2022 (UU PDP) and, where applicable, the EU General Data Protection Regulation (GDPR) Regulation 2016/679.

LabMatix processes Personal Data solely to provide the Laboratory Information Management System service as described in the Terms of Service. The processing includes:

The Controller (your organization) agrees to:

• Ensure there is a lawful basis for processing Personal Data within LabMatix (e.g., employment contract, legitimate interest, or consent)
• Provide accurate and up-to-date personal data and promptly notify LabMatix of corrections
• Obtain any necessary consents from data subjects (clients, analysts) before entering their data into the platform
• Ensure that users invited to your organization have been informed of this DPA and the LabMatix Privacy Policy
• Not use LabMatix to process special categories of data (health records, biometrics) without appropriate safeguards and notification to LabMatix

LabMatix, as Processor, agrees to:

• Process Personal Data only on documented instructions from the Controller (as set out in the Terms of Service and this DPA), unless required to do so by applicable law
• Ensure personnel authorized to process Personal Data are bound by confidentiality obligations
• Implement appropriate technical and organizational security measures as described in Section 6
• Not engage a new Sub-processor without prior written notification to the Controller (see Section 7)
• Assist the Controller in responding to data subject rights requests (access, correction, deletion, portability) within the timelines required by Applicable Law
• Notify the Controller without undue delay (and no later than 72 hours) after becoming aware of a Personal Data breach affecting the Controller's data
• Delete or return all Personal Data upon termination of the Service, at the Controller's choice, within 30 days
• Make available to the Controller all information reasonably necessary to demonstrate compliance with this DPA

LabMatix provides self-service tools for Controllers to fulfil data subject requests:

• Access & Portability: Settings → Billing → Export Organisation Data allows export of all organizational data in JSON format; sample, test and audit lists export as CSV
• Rectification: Administrators can update user profiles and correct records directly in the platform
• Erasure: Settings → Profile → Delete Account anonymizes personal user data. Settings → Billing → Delete Organization locks the organization immediately and permanently removes all organizational data after a 30-day grace period, during which any administrator can cancel
• Restriction / Objection: Contact privacy@labmatix.app — we will respond within 72 hours

LabMatix implements the following technical and organizational measures (TOMs):

Technical Measures

• AES-256 field-level encryption for sensitive personal data (contact details, e-signature metadata), with support for key rotation; database infrastructure encrypted at rest; TLS for all data in transit
• Multi-tenant data isolation enforced at the data layer by a global organisation scope on every database query — architecturally prevents cross-tenant data access
• Role-based access control (RBAC) with per-resource policies and principle of least privilege, enforced at the API layer across lab workflow, compliance, and business records
• Optional two-factor authentication (TOTP) with an organization-wide enforcement setting; short-lived session tokens that are invalidated for all other devices on password change or 2FA changes
• Hash-chained audit logs covering all 36 core record types, with actor identity, timestamp, and before/after values — both tampering and record deletion are detectable
• Support-staff access to a Controller's account requires either the Controller's own request or the Controller's explicit, time-limited approval of a specific access request — no standing or unilateral access exists. All such access is logged.
• Standard HTTP security headers and a restrictive Content-Security-Policy on all application responses
• Login and password-reset endpoints are rate-limited against brute-force attempts
• Automated vulnerability scanning in CI/CD pipeline; dependency security audits

Organizational Measures

• Access to production systems limited to authorized personnel only, with MFA required
• Incident response procedure with defined escalation path and 72-hour breach notification commitment
• Annual review of security policies and sub-processor contracts
• Staff training on data protection obligations upon onboarding

LabMatix currently engages the following sub-processors to deliver the Service. All sub-processors are contractually bound to process data only as instructed and to maintain appropriate security standards:

LabMatix will provide at least 14 days written notice (via email and in-app notification) before adding or replacing a sub-processor. Controllers who object to a new sub-processor may terminate their subscription within that notice period for a pro-rated refund.

Data is primarily stored in Singapore (DigitalOcean SGP1 region). Some sub-processors (Resend, Stripe) are located in the United States. For transfers outside Indonesia or the EEA, LabMatix relies on:

• Standard Contractual Clauses (SCCs) adopted by the European Commission (for EU data subjects)
• Adequacy decisions where applicable
• Contractual data processing agreements with all sub-processors that include appropriate transfer safeguards

Controllers with strict data residency requirements should contact privacy@labmatix.app to discuss dedicated regional hosting options (available on Enterprise plan).

In the event of a Personal Data breach involving Controller data, LabMatix will:

• Notify the Controller by email within 72 hours of becoming aware of the breach
• Provide: nature of the breach, categories and approximate number of records affected, likely consequences, and measures taken or proposed to address the breach
• Cooperate with the Controller in fulfilling any regulatory notification obligations to the relevant supervisory authority (e.g., BSSN in Indonesia, relevant DPA for EU data)

This DPA is effective for the duration of your LabMatix subscription. Upon termination:

• Export your data first via Settings → Billing → Export Organisation Data
• Deleting the organization (Settings → Billing → Delete Organization) locks it immediately; 30 days later LabMatix securely deletes all Personal Data from production systems
• Records of payments to LabMatix are retained for 10 years as required by Indonesian tax law
• Backup copies will be purged within 180 days of production deletion
• LabMatix will provide written confirmation of deletion upon request

This DPA is governed by the laws of the Republic of Indonesia. For data protection inquiries or to exercise Controller rights under this DPA: