Privacy Policy

1. Who We Are

Labstronaut is operated by Ben Nicholson, trading as Labstronaut, based in the United Kingdom. We are the data controller for personal data collected through this platform.

Contact: ben@labstronaut.com

2. What Data We Collect

We collect the following categories of data:

Account data:

• Email address (used for login and notifications)
• Laboratory name and NHS region
• Contact email address for your laboratory

Content data:

• Test information uploaded by your laboratory (test names, sample requirements, turnaround times, referral details etc.)
• Messages sent between laboratories through the platform
• Forum posts and replies

Usage data:

• Search queries made on the platform (not linked to individuals for public searches)
• Analytics events such as test views and referral downloads (used to provide dashboard metrics to labs)
• Login timestamps and audit log entries for security and accountability

Access request data:

• If you submit a request for access, we collect your name, laboratory name, and email address

3. What We Do Not Collect

Labstronaut does not collect, store, or process any patient data. The platform is not designed for patient-identifiable information and users are explicitly prohibited from sharing patient data through the platform.

We do not use cookies for tracking or advertising purposes. We do not share data with advertisers or third-party marketing platforms.

4. How We Use Your Data

We use your data solely to:

• Provide and operate the Labstronaut platform
• Authenticate your account and maintain security
• Send you notifications related to your account and platform activity (e.g. new messages, test updates)
• Provide you with usage analytics and dashboard metrics relating to your laboratory's listings
• Respond to support requests and access enquiries
• Improve the platform based on usage patterns

5. Legal Basis for Processing

We process your personal data under the following legal bases:

• Contract — processing your account data is necessary to provide the service you have registered for
• Legitimate interests — usage analytics and security logging are necessary for the safe and effective operation of the platform
• Consent — where we send optional communications, this is based on your consent which can be withdrawn at any time

6. Data Sharing

We do not sell your personal data. We share data only with the following third-party service providers who help us operate the platform:

• Supabase — database and authentication hosting (data stored in EU region)
• Netlify — website hosting
• Zoho / EmailJS — email delivery for notifications and support

All service providers are contractually required to process data only for the purpose of providing their service and in accordance with applicable data protection law.

Your laboratory's test information (test names, sample requirements, referral details) is visible to all registered users of the platform — this is the core function of the service and you consent to this by uploading the information.

7. Data Retention

• Account data — retained for as long as your account is active, then deleted within 30 days of account closure
• Test data — retained for as long as your account is active; deleted when you remove tests or close your account
• Messages — retained for as long as both accounts involved are active
• Analytics events — retained for 24 months then deleted
• Audit logs — retained for 12 months for security purposes
• Access request data — deleted within 90 days of the request being processed

8. Your Rights

Under UK GDPR, you have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — request correction of inaccurate data
• Erasure — request deletion of your personal data
• Portability — request your data in a machine-readable format
• Restriction — request that we restrict processing of your data in certain circumstances
• Objection — object to processing based on legitimate interests

To exercise any of these rights, contact us at ben@labstronaut.com. We will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe your data has been handled unlawfully.

9. Security

We take reasonable technical and organisational measures to protect your data, including encrypted data storage, secure authentication, and access controls. However, no system is completely secure and we cannot guarantee absolute security.

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the ICO in accordance with our legal obligations.

10. International Transfers

Your data is primarily stored within the European Economic Area (EEA). Where data is transferred outside the EEA, we ensure appropriate safeguards are in place in accordance with UK GDPR requirements.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of significant changes via the platform or email. The date at the top of this page reflects when the policy was last updated.

12. Contact

For any questions about this Privacy Policy or how we handle your data, please contact:

Ben Nicholson
Labstronaut
ben@labstronaut.com
labstronaut.com