Privacy policy

Who we are

ZapLab ("we") provides a laboratory information system to diagnostic laboratories ("labs"). This policy covers this website and the accounts labs create on the platform. Contact: contact@zaplab.in.

Two kinds of data

Account data is what a lab gives us to run its account: the organisation name, staff names, emails, phone numbers and billing details. We are the data fiduciary for account data.

Patient data is what a lab enters into the platform about its patients: registrations, samples, results and reports. The lab is the data fiduciary for patient data and decides why it is collected and for how long it is kept. We process it only on the lab’s instructions to provide the service.

What we collect on this website

If you send a demo request we keep the details you enter (name, lab, email, phone, city, message) to respond to you. This site does not use advertising cookies. A theme preference may be stored in your browser’s local storage.

We measure how this site and the ZapLab app are used with Umami Cloud, which counts page views, which page or post a visit came from, and clicks on buttons such as Start free trial. It sets no cookies, stores nothing in your browser and does not identify you or profile you across sites. In the app it receives only the page address without anything after the question mark, with private links replaced by a placeholder, so it never sees patient details. If we ever move to a tool that does set cookies, we will say so here and ask you first.

The product video on the home page is hosted on YouTube. Nothing is loaded from YouTube until you press play: the preview image comes from this site. Once you press play, the video runs in YouTube’s privacy-enhanced mode, and YouTube (Google) receives your IP address and may store data in your browser under Google’s privacy policy.

Where data is stored

The platform and its databases are hosted in India. We do not transfer patient data outside India to provide the service.

Who else processes data for us

We use a small number of sub-processors. Each receives only the data its function needs, and none of them receives patient results. They are:

• Brevo — sends transactional email: sign-in and verification links, invitations, and reports a lab chooses to deliver by email. Receives the recipient address and the message.
• Dodo Payments — takes subscription payments from labs. Receives the lab’s billing details. Card details are entered on their hosted checkout and never reach us.
• Cloudflare — serves this website and the application, and runs the bot check on the forms here. Receives request metadata such as IP address.
• Supabase — hosts the database, in India.
• Amazon Web Services — hosts the application servers and stores report files, in India.

How long we keep it

Account data is kept while the account exists and for as long afterwards as tax and accounting law require.

Patient data is kept for a period the lab sets, which defaults to 8 years from the last encounter. That default is the longest duty likely to apply to a laboratory — the NHA Health Data Management Policy asks for 8 years, the Clinical Establishments Rules for 3 to 5, and the NMC’s conduct regulations for 3. The lab remains responsible for choosing a period that matches its own obligations.

An erasure request is honoured as far as the law allows. Contact details, portal access and delivery records are removed at once; the diagnostic record itself is kept until the retention period ends, because section 12(1) of the Digital Personal Data Protection Act preserves retention duties under other law. The person asking is told what was kept, under what duty, and the date it will be removed.

Your rights

Under the Digital Personal Data Protection Act 2023 you may ask for access to, correction of, or erasure of your personal data, and you may withdraw consent where processing is based on it.

For account data, write to us. For patient data, contact the lab that performed your test: the lab is the data fiduciary and decides, and the platform gives it the tools to answer — it can produce everything held about you and action an erasure from within the system. We support the lab in responding and do not act on patient data on our own initiative.

Grievances

If you are not satisfied with how a request was handled, write to grievance@zaplab.in. We acknowledge grievances within 72 hours and respond within 30 days.

If the grievance concerns patient data, raise it with the laboratory first, since it is the data fiduciary for that data. Where you remain unsatisfied, the Data Protection Board of India can be approached.

Security

Connections are encrypted with TLS. Each lab’s data is isolated from every other lab’s. Access inside a lab is permission-based, and an audit trail records changes to results and reports. See the Security page for detail.

Changes to this policy

We will post changes here and update the date above. Material changes will be announced to account holders by email.