Privacy Policy

We collect information you provide directly, such as when you request a demo, start a trial, make a payment or contact us. This may include:

• Contact details — name, lab name, email, phone and city.
• Billing details processed by our payment provider (we do not store full card numbers).
• Support correspondence and the contents of messages you send us.

The SamLab desktop application stores your lab’s operational data locally on your own machine. Where you enable cloud sync or backup, that data is transmitted securely to our cloud infrastructure on your behalf.

• To provide, operate, license and support the SamLab software.
• To process payments, subscriptions and trials.
• To respond to enquiries and provide customer support.
• To improve our products and communicate important updates.

SamLab is used by laboratories to process patient and diagnostic information. Under the EU General Data Protection Regulation and the UK GDPR, that data belongs to the laboratory, which is the Controller for it. We act only as its Processor for any data synced to our infrastructure, processing it on the laboratory’s documented instructions — we do not sell it, rent it, use it for advertising, or use it to train any model. Health data is a special category under Article 9, so the laboratory is responsible for identifying its lawful basis and Article 9 condition, for patient information and consent where required, and for answering data-subject requests. The terms required by Article 28 are in our Data Processing Addendum, and the same split is set out in Clause 11 of our Terms & Conditions.

The SamLab mobile app for iPhone and Android is for the staff of laboratories that use SamLab with SamLab Cloud and the Mobile app add-on. There is no sign-up in the app: each login is created, and removed, by the laboratory’s own administrator. To have a login removed, ask your laboratory’s administrator, or write to us at support@samlab.in.

What it shows and saves. The app shows and saves the laboratory’s own records — patients, bills, results, reports, accounts and suppliers — in the laboratory’s cloud data on our cloud infrastructure (clause 7), as far as the user’s role and branch allow. What is entered on a phone syncs to the laboratory’s desktops.

The laboratory remains the Controller of that data and we remain its Processor, exactly as clause 3 says, under the terms of our Data Processing Addendum. A patient exercising a data-subject right over that data should go to the laboratory, and we will help it answer.

What stays on the phone.

• A temporary copy of screens the user has already opened, so that they stay readable on a weak connection. It is cleared when the user signs out.
• The sign-in, only if the user chooses “Remember me”, kept in the phone’s own secure storage — the Keychain on iPhone, the Keystore on Android.

Camera. Used only to read the barcode on a sample tube or a requisition slip. No photo is taken, stored or sent.

Face ID and fingerprint. Optional, and used only to sign the same user in again. The phone’s operating system handles it: biometric data never leaves the device, and SamLab never receives it.

Device identifier. The app creates an identifier for the phone and sends it to our licensing service (clause 7), only to count the phones on the laboratory’s licence.

Update checks. The app asks Google Play or the App Store whether a newer version exists. No personal data is sent for this.

PDFs. Receipts and lab reports are made on the phone, and go only where the user downloads or shares them.

What the app does not do. It shows no advertising, carries no analytics or tracking SDKs, and sells nothing. Its error log stays on the phone unless the user chooses to share it.

SamLab can send a patient their report by e-mail from the laboratory’s own Google account. This is entirely optional: it does nothing until a laboratory connects an account in Lab Profile → Email sending, and it can be disconnected there at any time.

What we ask Google for. Exactly two things — the address of the account you choose (so the software can show you which account it is sending from), and permission to send mail on your behalf (gmail.send). We ask for the narrowest permission that does the job.

What SamLab cannot do. The send-only permission gives no ability to read, search, download, modify or delete anything in your mailbox, and SamLab never attempts to. We do not read your mail, your contacts or your labels, because we are not able to.

What is sent, and by whom. A message goes out only when an operator presses Send on a report in your own copy of SamLab. It carries the report PDF and the recipient address that operator chose. The message is composed on your machine and delivered straight to Google’s Gmail API — it does not pass through our servers, and we keep no copy of its contents.

Where the sign-in is kept. The credential Google returns is stored encrypted on that computer, in the operating system’s own secure store (DPAPI on Windows, Keychain on macOS). It is never written to our cloud, never synced between machines, and never transmitted to us.

Limited Use. SamLab’s use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Withdrawing access. Disconnect the account in Lab Profile, or remove SamLab yourself at myaccount.google.com/permissions. Either one stops all future sending immediately.

Online payments are processed by our third-party payment gateway (Razorpay). Your payment information is handled in accordance with the payment provider’s own privacy policy and PCI-DSS standards. We receive only transaction confirmation and limited billing metadata.

We do not sell your personal information. We share information only with the service providers below, who help us operate, and where required by law:

• Google Cloud — sign-in & cloud data storage (USA).
• Website hosting provider (USA).
• Razorpay — payment processing (India).
• Transactional email provider (EU).
• Rate-limiting provider (USA).
• Google reCAPTCHA — bot protection.
• File delivery network — report PDFs, where enabled by your lab.
• Meta WhatsApp Cloud API — messaging, where enabled by your lab.
• Our own licensing service — hosted in the USA.

Because these providers operate in the countries noted above, personal data is transferred outside the EEA and the United Kingdom. Each provider processes data only to deliver its service to us, under that provider’s own terms. We do not currently offer Standard Contractual Clauses or an equivalent transfer mechanism of our own, and we do not claim to — if your organisation requires one before it can use a cloud feature, tell us before you enable it. The same position is set out in clause 9 of our Data Processing Addendum.

We use cookies that are strictly necessary to run the site — authentication (keeping you signed in), security and rate-limiting, remembering which of our two sites you chose, and remembering your cookie choice itself. With your consent we also use Google Analytics 4 to count visits and see which pages are read, and one cookie of our own that remembers which campaign or search brought you here so a later enquiry can be attributed to it. We do not sell your data, we do not share it with advertising networks, and we do not track you across other websites.

Every cookie is listed individually, with its purpose and lifetime, in our Cookie Policy — including how to change or withdraw your choice at any time.

We use reasonable technical and organisational measures to protect information, including encryption in transit, access controls and signed software licensing. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

We keep personal data only as long as needed for the purpose it was collected, or as the law requires:

• Trial and contact enquiries (leads) — up to 24 months from your last interaction.
• Account and billing records — for as long as tax and accounting law requires us to keep them (currently 8 years).
• Shared report links — until the link’s expiry date, after which the files are deleted.
• Support emails — up to 24 months.

You may request earlier deletion of your data at any time (see “Your rights” below); we will honour it except where a legal retention obligation applies.

Where we are the controller of your personal data, the GDPR and UK GDPR give you the right to:

• access the personal data we hold about you, and receive a copy of it;
• have inaccurate data corrected, and incomplete data completed;
• have your data erased, where we have no overriding obligation to keep it;
• restrict or object to our processing, including any processing based on our legitimate interests;
• receive the data you gave us in a portable, machine-readable form; and
• withdraw consent at any time, without affecting processing already carried out.

Send your request to support@samlab.in with the subject line “Data Subject Request”. We will respond within one month, and will tell you if we need to extend that by up to two further months because the request is complex. We do not charge for this.

Where the data was synced by a laboratory using SamLab, that laboratory is the controller and we are its processor: send your request to the laboratory, and we will assist it in answering you.

If you have a concern about how we handle your personal data, write to the contact below. We will acknowledge it within 48 hours and aim to resolve it within 30 days.

Shashi Jain, Data Protection Contact
Sammed Technosol
1-JH-28, First Floor, Housing Board Colony, Dadabari, Kota, Rajasthan 324009, India
Email: sammedtechno@gmail.com
Phone: +91 9828400519

You also have the right to lodge a complaint with your own data protection supervisory authority — in the United Kingdom the Information Commissioner’s Office, and in the EEA the authority for the country where you live or work. You do not have to come to us first, though we would rather have the chance to put it right.

We may update this policy from time to time. The “last updated” date above reflects the latest revision.

Sammed Technosol
1-JH-28, First Floor, Housing Board Colony, Dadabari, Kota, Rajasthan 324009, India
Email: support@samlab.in
Phone: +91 98284 00519