Where your lab’s data lives, and who can reach it

Your data is on your machine, not on ours

SamLab is a Windows desktop application with a local database. Register a patient and the row is written to a SQLite file on that PC, under the machine’s application-support folder, in a directory named for your organisation. That file is the primary copy of your lab, not a cache of something living elsewhere — which is why registration, billing, result entry, report printing and barcodes all keep working when the line is down.

A cloud-only LIS asks you to accept that every patient record your lab has ever produced sits on somebody else’s infrastructure as a condition of use. SamLab does not ask that. The default posture is that your data has never left the building; everything below describes what changes when you decide otherwise.

What crosses to the cloud — and only when you switch it on

Cloud sync ships off: the setting that enables it is seeded to zero on a fresh install, so a lab that never opens that screen never synchronises anything. Turn it on — usually for a second PC, a branch, or the web dashboard — and the boundary is exactly this.

Backups, and who holds them

A backup is one file with a .samlab extension holding the whole database — patients, bills, results, masters, settings, letterhead and signatures — plus any report documents attached from disk. The write-ahead log is folded into the database before the snapshot, so the file includes the last few minutes of work rather than the last checkpoint.

It is a plain ZIP, and that is a decision rather than an oversight: an encrypted backup is only as good as its key, and a lab that has lost both its PC and its passphrase has lost its patients’ records permanently. A backup that always restores on click is worth more here. The trade is that the file deserves the care you give the paper register.

Backups run daily by default to a folder you choose. Connect Google Drive and they also upload to your own Google account, under a permission scope that lets SamLab touch only files SamLab created — it cannot read the rest of your Drive. We hold no copy of your backups.

Who can do what

Everyone works under their own login, and local passwords are stored as a PBKDF2-HMAC-SHA256 hash with a random per-user salt and 120,000 iterations — a figure chosen by measuring it on the kind of PC labs actually run, not copied off a blog. Permissions are per user and per menu, and each menu splits four ways, because "can open Billing" and "can delete a bill" are not the same decision.

• Named sign-in for every userPBKDF2-HMAC-SHA256, per-user random salt, 120,000 iterations. Not a reversible encoding, and not one shared salt.Settings → Users
• Per-user, per-menu permissionsEach menu splits into View, Add, Edit and Delete, so a receptionist can raise a bill without being able to delete one.Settings → Audit & Permissions
• Idle auto-lockBlanks the screen behind a password prompt after N idle minutes, without signing the user out. Off until you set a timeout.Settings → Audit & Permissions
• Result revision historyEvery result value versioned, with the previous value, the person, the time and the amendment reason.Sample Desk → Timeline
• Activity trailLogins, role and permission changes, deletions, overrides and refused actions, on the machine that produced them.Settings → Audit & Permissions
• Backups you holdDaily by default, to a folder you choose and — if you connect it — your own Google Drive. We keep no copy.Settings → Backup
• Tenant isolation in the cloudDefault-deny rules scope every read and write to your own organisation, with an append-only audit log and no client hard-deletes.firestore.rules, deployed with the backend

The trail: what happened, and who did it

Two records run underneath everyday work. The activity trail captures logins, role and permission changes, staff added and removed, deletions, overrides, and actions refused because a limit was hit — written on the machine that produced them, complete whether or not you ever enable the cloud.

The second is result revision history, and it is the one an assessor asks about. Version 1 is the original entry; every value after it is stored with the value it replaced, the person, the timestamp, whether the replaced value had already been verified, and the amendment reason. A verified result locks: it can still be corrected, but the correction is a new version, never an overwrite. That history is not synced, and it travels inside your backup.

If you do use the cloud

Synced data lives in Google Firestore, reached over TLS, under a per-organisation path. Access is governed by security rules deployed with the backend rather than by application code alone — a distinction that matters, because a rule holds even against a client that has been tampered with.

Those rules default-deny, so a collection with no explicit block is readable and writable by nobody. Every business write must carry a server-set timestamp, which stops a machine with a wrong clock from overwriting newer records. Clients cannot hard-delete; deletion is a flag another device can still see. The cloud audit log is append-only — no client, including yours, can alter a row in it. On Google’s side, Firestore encrypts data at rest by default: a property of the platform we build on, not a control we operate.

DPDP: what is yours and what is ours

Under India’s Digital Personal Data Protection Act, 2023, your laboratory is the Data Fiduciary for the patient data it holds. We are your Data Processor for anything you sync to our infrastructure, and we process it only on your instructions. Our Terms and Privacy Policy say the same thing, because a buyer who finds those three documents disagreeing is right to stop reading.

The Act’s implementing Rules were notified in November 2025 and phase in over eighteen months, with the substantive obligations — notice, security safeguards, breach reporting within 72 hours — landing at the end of that window. Nothing here is legal advice; the sources we relied on are linked at the foot of the page so you can check them rather than take our word.