Privacy Policy

LabMatix ("we", "our", or "us") is committed to protecting the privacy and security of your laboratory data. This Privacy Policy explains how we collect, use, store, and safeguard information when you use our Laboratory Information Management System (LIMS) platform, accessible at app.labmatix.app and its associated mobile applications.

By creating an account or using LabMatix, you agree to the collection and use of information in accordance with this policy. If you do not agree, please discontinue use of the service.

We collect the following categories of information:

Account & Identity Data

• Full name, email address, job title, and password (hashed — never stored in plain text)
• Organization name, address, and contact details entered during registration
• Profile information you choose to add (e.g., professional certifications)

Laboratory & Operational Data

• Sample records: identifiers, collection dates, descriptions, storage locations, and chain-of-custody logs
• Test results, protocol parameters, analyst notes, and approval decisions
• Client and contact records you enter into the system
• Documents, SOPs, CAPA records, and training logs uploaded to the compliance suite
• Instrument booking records and reagent lot information
• Invoice and billing data for clients managed within the platform

Usage & Technical Data

• IP addresses, browser type, operating system, and device identifiers
• Pages visited, features used, and time spent within the application
• API request logs and error reports (used for debugging and improving reliability)
• Push notification tokens for mobile apps (stored only if you grant notification permission)

We use the information we collect to:

• Provide, operate, and maintain the LabMatix platform and its features
• Authenticate your identity and authorize access to organization-specific data
• Generate and deliver test result reports, certificates of analysis, and dispatch notifications
• Send transactional emails (account verification, password resets, approval notifications)
• Process subscription billing and issue invoices
• Detect, investigate, and prevent fraudulent or unauthorized access attempts
• Improve the platform based on aggregate usage analytics (non-personally identifiable)
• Comply with applicable Indonesian and international legal obligations

We do not sell, rent, or trade your laboratory data or personal information to any third party for advertising or marketing purposes.

Your data is stored on servers located in Southeast Asia (currently Singapore). We implement the following security measures:

• AES-256 field-level encryption for sensitive personal data (contact details, e-signature metadata), with support for key rotation; database infrastructure encrypted at rest; TLS for all data in transit
• Multi-tenant isolation enforced at the database query layer by a global organisation scope — one lab cannot access another's records by architecture, not just policy
• Role-based access control (RBAC) with per-resource policies ensuring each user sees and acts only on what their role permits, across lab workflow, compliance, and business records
• Optional two-factor authentication (TOTP), which an organization administrator may require for every user in that organization
• Hash-chained audit trail logging every create, update, and delete action across all 36 core record types, with actor identity and timestamp — tampering and deletion are both detectable
• Vulnerability scanning and dependency auditing as part of our CI/CD pipeline

LabMatix staff cannot access your organization's account on their own. Support access only happens two ways: you submit a support-access request yourself, which is self-authorising since asking for help is the consent — or a LabMatix team member requests access and your organization's administrator must explicitly approve it first. Every approved grant is time-limited and usable once, and the access itself, along with anything done during it, is recorded in your audit trail and attributed to the real person who acted.

While we take all reasonable precautions, no method of transmission over the internet or electronic storage is 100% secure. We encourage you to use strong passwords and enable two-factor authentication when available.

We do not share your personally identifiable information or laboratory data with third parties except in the following limited circumstances:

• Service providers: We use trusted sub-processors (cloud hosting, email delivery, payment gateway) who are contractually bound to process data only on our behalf and under strict confidentiality obligations.
• Legal requirements: We may disclose information if required by Indonesian law, court order, or to protect the rights, property, or safety of LabMatix, our users, or the public.
• Business transfers: In the event of a merger or acquisition, user data may be transferred to the successor entity, and you will be notified in advance.
• With your consent: We will share data with third parties only when you explicitly authorize it (e.g., granting a client access to their sample results via the portal).

We retain your data for as long as your account is active or as needed to provide our services. Specifically:

• Active account data is retained indefinitely while your subscription is in good standing
• If a subscription or trial ends without renewal, your data is kept — first read-only, then locked — until it is renewed or an administrator deletes the organization
• When an administrator deletes the organization, it is locked immediately and all of its data — including its audit log, users and uploaded files — is permanently deleted from production systems 30 days later. Any administrator can cancel the deletion during those 30 days
• Records of payments made to LabMatix are retained for 10 years, as Indonesian tax law requires for bookkeeping records (UU KUP Article 28(11))
• Backups containing your data are purged within 180 days of the production deletion

You may request early deletion of your data by contacting us at privacy@labmatix.app.

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Rectification: Correct inaccurate or incomplete personal data
• Erasure: Request deletion of your personal data (subject to legal retention obligations)
• Portability: Export your laboratory data in a machine-readable format (CSV/JSON) from Settings → Billing → Export Organisation Data
• Objection: Object to processing of your data in certain circumstances
• Restriction: Request that we restrict processing of your data pending resolution of a dispute

To exercise any of these rights, contact us at privacy@labmatix.app. We will respond within 30 days.

LabMatix uses only strictly necessary cookies and browser storage:

• Authentication JWT tokens stored in browser localStorage (cleared on sign-out)
• Theme and UI preference settings stored in localStorage (no personal data)
• Session analytics via privacy-respecting, self-hosted tooling — no third-party tracking pixels, no Facebook/Google advertising cookies

We do not use cross-site tracking cookies or behavioral advertising technology.

LabMatix is a professional laboratory software platform intended for adults (18+) in laboratory and scientific settings. We do not knowingly collect personal information from individuals under 18 years of age. If you believe a minor has provided us with personal data, please contact us immediately.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you via email and display a notice within the application at least 14 days before the changes take effect. Continued use of LabMatix after the effective date constitutes acceptance of the revised policy.

If you are located in the European Union or European Economic Area, the General Data Protection Regulation (GDPR) provides you with additional protections:

• Legal basis: We process your personal data under the following lawful bases — (a) performance of our contract with you (providing the Service), (b) our legitimate interest in improving and securing the platform, and (c) compliance with legal obligations.
• Right to lodge a complaint: You have the right to lodge a complaint with your local supervisory authority (e.g., your national Data Protection Authority) if you believe we are not processing your data lawfully.
• 72-hour breach notification: In the event of a data breach affecting your personal data, we will notify you and (where required) the relevant supervisory authority within 72 hours of becoming aware.
• Data transfers: When personal data is transferred outside the EEA (e.g., to our US-based sub-processors), we rely on Standard Contractual Clauses (SCCs) approved by the European Commission to ensure adequate protection.
• EU Representative: For the purposes of GDPR Article 27, while we are not yet formally established in the EU, we can be contacted directly at privacy@labmatix.app for any data protection matters. Enterprise customers requiring a formal EU representative arrangement should contact us.
• Data Processing Agreement: A full GDPR-compliant DPA is available at labmatix.app/dpa and is incorporated into our Terms of Service for all subscribers.

If you have questions, concerns, or requests relating to this Privacy Policy or our data practices, please contact our Data Protection team: