Privacy Policy

This policy explains how Salman Hayat (Sole Proprietor) ("Lab Management", "we", "us") handles personal data on labmanagment.com, our web application and our mobile app (together, the "Service"). It is written to follow India's Digital Personal Data Protection Act, 2023 ("DPDP Act"), the DPDP Rules, 2025 and the Information Technology Act, 2000.

1. Who is responsible for which data

• Patient data (patient details, test orders and results) is entered by the laboratory that uses our Service. That laboratory is the Data Fiduciary — it decides why and how the data is used. We are its Data Processor: we store and process that data only to run the Service for the laboratory, under our agreement with it.
• For lab staff accounts, doctors with logins and website visitors, we are the Data Fiduciary.

If you are a patient, please contact the laboratory that did your tests first for any request about your report. We will help the laboratory answer you.

2. What data we process

• Patients: name, title, age, gender, mobile number, email (optional), referring doctor, tests ordered, test results, remarks, invoice and payment amounts.
• Lab staff and doctors: name, username / email, role, lab, hashed password (we never store passwords in readable form), login times, IP address and an activity log of actions taken.
• Laboratories: lab name, address, contact person, phone, email, logo, pathologist name, qualification and registration number, signature image, registration numbers.
• Website visitors: details you send us on WhatsApp when registering or asking for help, and basic technical logs (IP address, browser type) kept for security.

3. Why we use it

• To let laboratories register patients, enter results, create, print and share reports, and bill.
• To keep the Service secure: login checks, keeping each lab's data separate, activity logs, fraud and misuse detection.
• To provide support and to tell lab customers about service changes.
• To meet legal duties (for example, record keeping, breach reporting, lawful requests from authorities).

We do not sell personal data, do not use patient data for advertising or marketing, and do not use it to train any AI or analytics product.

4. Consent and notice (duty of laboratories)

Each laboratory must, before entering a patient's data, tell the patient what data is collected and why, and obtain the patient's consent where the law requires it — including consent before sending a report on WhatsApp or by email. For a patient below 18 years, the parent or lawful guardian acts for the child. A patient may withdraw consent at any time by contacting the laboratory; this does not affect processing already done or records the law requires the laboratory to keep.

5. Who we share data with

• Hosting and database providers that run the Service for us (cloud database / storage and website hosting), bound by confidentiality and security terms.
• WhatsApp (Meta) or email providers — only when the laboratory chooses to send a report or link to a patient.
• Government or courts — only when required by law.

Online report links: each report link / QR code contains a long random secret code. Anyone who has the link can open that one report, so it should be shared only with the patient or someone the patient trusts.

6. Where data is stored

Data is stored with our cloud providers, whose servers may be in India or abroad. Any transfer outside India follows the DPDP Act and any restrictions notified by the Government of India.

7. How we protect data

• All traffic is encrypted with HTTPS.
• Passwords are stored only as one-way hashes; sessions expire automatically.
• Every request is checked on the server so a lab can only see its own patients, reports, tests and settings.
• Database access keys are kept only on our servers; direct public access to tables is blocked.
• An activity log records logins and who viewed, created, changed or shared records and reports.

8. How long we keep data

• Patient records are kept for as long as the laboratory's account is active, or as long as the laboratory instructs, subject to laws that require medical records to be kept.
• Activity logs and security logs are kept for at least one year.
• When a laboratory closes its account, we give it a chance to export its data and then delete it within 90 days, unless the law requires us to keep it longer.

9. Your rights

Under the DPDP Act you can ask to:

• get a summary of your personal data and how it is used,
• correct or complete wrong data,
• erase data that is no longer needed (subject to legal record-keeping),
• withdraw consent,
• nominate another person to act for you in case of death or incapacity,
• raise a grievance with us, and then with the Data Protection Board of India if you are not satisfied.

Patients should send requests to their laboratory first. Lab staff, doctors and visitors can contact us directly (see section 13).

10. Data breaches

If a personal data breach happens, we will inform the affected laboratories without delay so they can inform patients, and we will report to the Data Protection Board of India and CERT-In as the law requires.

11. Cookies

We use only the cookies needed to keep you logged in and the app working. We do not use advertising or third-party tracking cookies.

12. Children

The Service is used by laboratories and is not meant for children to use directly. Children's test data is entered by laboratories with the consent of a parent or guardian.

13. Grievance Officer and contact

Grievance Officer: Salman Hayat
Salman Hayat (Sole Proprietor)
Godhra, Gujarat, India
Email: hayatsalman0326@gmail.com
WhatsApp: +91 9638212926

We acknowledge requests within 7 days and aim to resolve them within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India.

14. Changes to this policy

We may update this policy. The date at the top shows the latest version. Important changes will be announced inside the app.