Privacy Policy

We collect information you provide directly, such as when you request a demo, start a trial, make a payment or contact us. This may include:

• Contact details — name, lab name, email, phone and city.
• Billing details processed by our payment provider (we do not store full card numbers).
• Support correspondence and the contents of messages you send us.

The SamLab desktop application stores your lab’s operational data locally on your own machine. Where you enable cloud sync or backup, that data is transmitted securely to our cloud infrastructure on your behalf.

• To provide, operate, license and support the SamLab software.
• To process payments, subscriptions and trials.
• To respond to enquiries and provide customer support.
• To improve our products and communicate important updates.

SamLab is used by laboratories to process patient and diagnostic information. Under India’s Digital Personal Data Protection Act, 2023, that data belongs to the laboratory, which is the Data Fiduciary for it. We act only as its Data Processor for any data synced to our infrastructure, processing it on the laboratory’s instructions — we do not sell it, rent it, use it for advertising, or use it to train any model. Laboratories are responsible for patient notice and consent, for responding to data-principal requests, and for the lawfulness of what they collect (including, where relevant, ABDM guidelines). The same split is set out in Clause 11 of our Terms & Conditions.

The SamLab mobile app for iPhone and Android is for the staff of laboratories that use SamLab with SamLab Cloud and the Mobile app add-on. There is no sign-up in the app: each login is created, and removed, by the laboratory’s own administrator. To have a login removed, ask your laboratory’s administrator, or write to us at support@samlab.in.

What it shows and saves. The app shows and saves the laboratory’s own records — patients, bills, results, reports, accounts and suppliers — in the laboratory’s cloud data on our cloud infrastructure (clause 7), as far as the user’s role and branch allow. What is entered on a phone syncs to the laboratory’s desktops.

The laboratory remains the Data Fiduciary for that data and we remain its Data Processor, exactly as clause 3 says: a patient who wants to see, correct or erase what the laboratory holds about them should ask the laboratory.

What stays on the phone.

• A temporary copy of screens the user has already opened, so that they stay readable on a weak connection. It is cleared when the user signs out.
• The sign-in, only if the user chooses “Remember me”, kept in the phone’s own secure storage — the Keychain on iPhone, the Keystore on Android.

Camera. Used only to read the barcode on a sample tube or a requisition slip. No photo is taken, stored or sent.

Face ID and fingerprint. Optional, and used only to sign the same user in again. The phone’s operating system handles it: biometric data never leaves the device, and SamLab never receives it.

Device identifier. The app creates an identifier for the phone and sends it to our licensing service (clause 7), only to count the phones on the laboratory’s licence.

Update checks. The app asks Google Play or the App Store whether a newer version exists. No personal data is sent for this.

PDFs. Receipts and lab reports are made on the phone, and go only where the user downloads or shares them.

What the app does not do. It shows no advertising, carries no analytics or tracking SDKs, and sells nothing. Its error log stays on the phone unless the user chooses to share it.

SamLab can send a patient their report by e-mail from the laboratory’s own Google account. This is entirely optional: it does nothing until a laboratory connects an account in Lab Profile → Email sending, and it can be disconnected there at any time.

What we ask Google for. Exactly two things — the address of the account you choose (so the software can show you which account it is sending from), and permission to send mail on your behalf (gmail.send). We ask for the narrowest permission that does the job.

What SamLab cannot do. The send-only permission gives no ability to read, search, download, modify or delete anything in your mailbox, and SamLab never attempts to. We do not read your mail, your contacts or your labels, because we are not able to.

What is sent, and by whom. A message goes out only when an operator presses Send on a report in your own copy of SamLab. It carries the report PDF and the recipient address that operator chose. The message is composed on your machine and delivered straight to Google’s Gmail API — it does not pass through our servers, and we keep no copy of its contents.

Where the sign-in is kept. The credential Google returns is stored encrypted on that computer, in the operating system’s own secure store (DPAPI on Windows, Keychain on macOS). It is never written to our cloud, never synced between machines, and never transmitted to us.

Limited Use. SamLab’s use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Withdrawing access. Disconnect the account in Lab Profile, or remove SamLab yourself at myaccount.google.com/permissions. Either one stops all future sending immediately.

Online payments are processed by our third-party payment gateway (Razorpay). Your payment information is handled in accordance with the payment provider’s own privacy policy and PCI-DSS standards. We receive only transaction confirmation and limited billing metadata.

We do not sell your personal information. We share information only with the service providers below, who help us operate, and where required by law:

• Google Cloud — sign-in & cloud data storage (USA).
• Website hosting provider (USA).
• Razorpay — payment processing (India).
• Transactional email provider (EU).
• Rate-limiting provider (USA).
• Google reCAPTCHA — bot protection.
• File delivery network — report PDFs, where enabled by your lab.
• Meta WhatsApp Cloud API — messaging, where enabled by your lab.
• Our own licensing service — hosted in the USA.

Because some of these providers operate outside India, cross-border transfers of personal data occur to the countries noted above. Each provider processes data only to deliver its service to us.

We use cookies that are strictly necessary to run the site — authentication (keeping you signed in), security and rate-limiting, remembering which of our two sites you chose, and remembering your cookie choice itself. With your consent we also use Google Analytics 4 to count visits and see which pages are read, and one cookie of our own that remembers which campaign or search brought you here so a later enquiry can be attributed to it. We do not sell your data, we do not share it with advertising networks, and we do not track you across other websites.

Every cookie is listed individually, with its purpose and lifetime, in our Cookie Policy — including how to change or withdraw your choice at any time.

We use reasonable technical and organisational measures to protect information, including encryption in transit, access controls and signed software licensing. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

We keep personal data only as long as needed for the purpose it was collected, or as the law requires:

• Trial and contact enquiries (leads) — up to 24 months from your last interaction.
• Account and billing records — for as long as tax and accounting law requires us to keep them (currently 8 years).
• Shared report links — until the link’s expiry date, after which the files are deleted.
• Support emails — up to 24 months.

You may request earlier deletion of your data at any time (see “Your rights” below); we will honour it except where a legal retention obligation applies.

You may request access to, correction of, or deletion of your personal information. Send your request to support@samlab.in with the subject line “Data Deletion Request” (or “Data Access Request” / “Data Correction Request” as applicable). We will honour verified requests within 30 days, subject to any legal retention obligations described above.

In line with the Digital Personal Data Protection Act, 2023, we have designated a Grievance Officer to address your concerns about how your personal data is handled:

Shashi Jain, Grievance Officer
Sammed Technosol
1-JH-28, First Floor, Housing Board Colony, Dadabari, Kota, Rajasthan 324009, India
Email: sammedtechno@gmail.com
Phone: +91 9828400519

We will acknowledge your grievance within 48 hours and aim to resolve it within 30 days. Full details, including how to escalate, are on our Grievance Redressal page.

We may update this policy from time to time. The “last updated” date above reflects the latest revision.

Sammed Technosol
1-JH-28, First Floor, Housing Board Colony, Dadabari, Kota, Rajasthan 324009, India
Email: support@samlab.in
Phone: +91 98284 00519