Seven documents, each one written rather than assembled.

LabFlow is built and operated by the LabFlow team and served from labflow.aoneahsan.com; the provider in law is Ahsan Mahmood, an independent developer. There is no company behind it and no support rota. That is stated first because several answers below only make sense once you know it.

On the public pages you are reading now, and on the laboratory directory, we decide what is collected and why. In data-protection language we are the controller, and you deal with us.

Inside a laboratory's tenant, we decide nothing. The laboratory that runs the tenant chooses which patients exist, which tests are ordered, which results are entered and who may see them. It is the controller; we are its processor, acting on its instructions. If you are a patient whose record is in a LabFlow tenant, your relationship is with that laboratory, and its own privacy notice governs it.

That split is not a formality. It is the reason clause 06 can reserve a right over some content and cannot reserve it over clinical records.

Grouping matters more than listing, because the three groups are treated differently at every point below.

Clinical content is the laboratory's, held on its behalf. We do not read it, mine it, sample it or move it anywhere the laboratory has not asked for.

A privacy policy that says "trusted partners" has told you nothing. These are all of them, with what each one actually receives.

Google is one company across three rows, Firebase Hosting, Google Maps and Google Analytics, which is why the heading counts eleven.

Google Analytics, Amplitude and Microsoft Clarity measure how LabFlow is used, so it can be made better. They are on for everyone, and the short notice shown on your first visit says so. Sentry reports errors, because an error nobody hears about is an error nobody fixes.

AI in LabFlow is for staff: drafting a procedure and asking how the product works. It is not given patient records, and anything typed or said into it is sent as written, so leave patient names and identifiers out. A draft becomes a procedure draft only when a person keeps it.

Payments for a plan are not refunded. The Terms of Service say how a paid plan renews and ends.

Push is switched off entirely when its configuration key is empty, which is the state a self-hosted deployment starts in. When it is off, OneSignal receives nothing at all.

Where these run is a per-deployment fact. A laboratory is told which region its tenant is created in before it is created, and that answer is part of the tenant record rather than a sentence on this page.

Patient information does not go into a web address, an analytics event, a log line, an error report or a text message. That is enforced at the point where data leaves the product, not by asking developers to remember it at each place they write code, because a convention has no failure mode anybody notices.

Product measurement, where it is switched on, receives event names and route patterns only. It does not receive a patient identifier, an accession number, a result value, a free-text note or the contents of any record. Those are dropped at the boundary by an allowed-list, so a field nobody anticipated is dropped rather than forwarded.

If a session-replay tool, a heatmap, or an advertising or attribution service is ever added, it will appear in the table in clause 03 and in the table on the cookies page before it is switched on, and it will be blocked from every signed-in clinical route. That commitment is written this way on purpose: a flat promise never to measure anything is the kind of sentence that quietly becomes false, and a privacy policy contradicting its own cookies page is the cheapest false statement a site can make.

One such tool is now in use. Microsoft Clarity records how the public pages are scrolled and clicked. It is in both tables, it is not loaded on any signed-in page, and anything that could show a record is masked before it is recorded.

Advertising is named in that sentence rather than denied elsewhere on the page, because LabFlow expects to carry it. The Android app already declares the advertising identifier permission for that reason, which the app permissions page sets out in clause 05. None of it changes clause 04: an advert is a thing that can appear beside marketing pages and non-clinical screens, and never beside a patient record.

We may use non-clinical content from free accounts, meaning support messages, product feedback and bug reports, together with aggregate, de-identified usage statistics, to improve the features we build. Patient records, orders, results and any clinical content are never used this way, on any plan. Nor is anything a patient writes in a satisfaction answer — clause 09. Content in a paid plan is not used to improve features without your explicit consent. What is sent to AI is not used by us to improve the product either.

The reason clinical content is carved out is the split in clause 01. Inside a tenant we are a processor acting on the laboratory's instructions, and a processor using its controller's data for its own purposes is not permitted under data-protection law regardless of which plan the tenant is on. The same holds under United States health-privacy law, where a business associate may only use protected health information for the purposes its agreement sets out.

One word in that clause is doing specific work. Aggregate means a count across all tenants with no tenant, laboratory or person identifiable in it: how many result entries happen per session, not which laboratory made them. So the statement made elsewhere on this site, that a tenant's data never leaves its own boundary, stays true beside this clause rather than in tension with it. Nothing that could be traced back to a tenant is used for anything.

You can object to the non-clinical use at any time by writing to us, and moving to a paid plan stops it as well. Objecting does not reduce anything about the product you can use.

Clinical retention is not a preference. Results and reports are kept for at least two years, pathology material and slides for ten, the audit trail for six, and specimen movement records for two. A laboratory can extend any of these for its own tenant; it cannot shorten them below the floor its accreditation requires.

Clinical records are archived rather than erased, which is the honest consequence of those floors: a request to delete a patient record does not delete the laboratory's obligation to be able to produce it. Everything else, including your account and anything you sent through the contact form, is deleted on request.

A Speak recording, its transcripts and the draft made from it are deleted within 24 hours of the recording; the person who made it can delete it sooner. A draft somebody keeps becomes an ordinary procedure draft and is kept like one. For each AI request LabFlow keeps who asked, which feature, the level and model it ran at and how much it used, and never the request or the reply.

The full table, with what each window is anchored to and what a deletion request actually does, is on the data deletion page.

You can ask for a copy of what is held about you, ask for it to be corrected, ask for it to be deleted, object to a particular use, and ask for it in a portable form. Which door you knock on depends on the group from clause 02.

If you ask us for something that belongs to a laboratory, we will tell you which laboratory holds it and pass the request on, rather than leaving you without an answer.

A laboratory may send you a link asking how a particular episode went. Answering is optional, and nothing about your care depends on whether you do. The link opens one page with a score from one to five and a box you may leave empty; it does not sign you in, it shows you no results, and it cannot be used to look anything up.

The laboratory can see which episode an answer belongs to, because an answer nobody can place is not useful to it. What it publishes from those answers are counts and a mean — no answer is republished with a person beside it, and no comment is quoted into a report.

The box is not a clinical channel and nobody replies to it. It reaches the laboratory's quality team, not a clinician, and nobody reading it can act on a symptom. That is said on the page itself, above the box, rather than only here — a warning that lives in a policy is one nobody reads before typing.

The link expires after ninety days and closes once it has been answered. Both limits exist for the same reason: a link that never expires keeps working after it has been forwarded, printed, or left in an old inbox, and an answer that can be quietly changed later is not worth reading.

These answers belong to the laboratory, not to us, and clause 06 does not reach them. A satisfaction comment is content a patient wrote to their laboratory; it is never used to improve this product, on any plan, with or without consent — that decision is not ours to offer.

LabFlow accounts are for laboratory staff and are not offered to children. A patient record inside a tenant may of course concern a child, and that record belongs to the laboratory under the same terms as any other. We do not knowingly create an account for anyone under sixteen, and we delete one if we find it.

It does not cover what a laboratory does with your data once it has it, which is that laboratory's own notice. It does not cover a system LabFlow sends a result to, such as a hospital record system, once the result has arrived there. It does not cover the sites linked from these pages. And it is not a business associate agreement, which is a separate document and is discussed on the HIPAA statement.

Every revision of this document is dated at the top and published as an entry in the site feed, so a change is a thing you can subscribe to rather than a thing you have to notice. A change that materially affects what is handled or who sees it is also sent to account holders by email.

Questions about anything above go through the contact page. The LabFlow team reads it, with no rota, which is stated there as well.