1. Controller and roles of the parties
Labspace is developed by Strefabadań.pl – Łukasz Szemiako, Wały Jagiellońskie 28/30 lok. 2, 80-853 Gdańsk, Poland, tax ID 9571090805, REGON 366301057, email: info@strefabadan.pl, phone: +48 512 303 100.
Strefabadań.pl may act as controller for employee account and technical data. Patient, order, sample and result data are generally processed on behalf of the laboratory or partner using Labspace. The parties’ roles and legal bases follow the agreement with the relevant organization and applicable law.
2. Data processed
The scope depends on the application, user role and permissions assigned by the organization.
- Account and authentication data: name, email address, user identifier, organization or team, role, permissions, sign-in events and two-factor verification events.
- Laboratory and medical data: order data, patient identifiers (including the Polish PESEL number when required), contact and address details, sample codes, specimen type, tests, results, PDF reports, diagnostic notes, authorization status and timestamps.
- Technical and security data: IP address, request and device information provided by the operating system, error and security event logs, and a session token stored in the device’s secure storage.
- Labspace 4 Partners stores on the device a history of up to 10 recent searches for the active account, including sample code, PESEL and date. The history is removed on sign-out or at the user’s request.
3. Purposes and legal bases
- authenticating users, protecting accounts and enforcing permissions;
- providing functions ordered by the organization: managing orders and samples, entering and authorizing results, and sharing approved reports;
- maintaining security, service continuity, operational audit and support;
- performing contracts, meeting legal obligations and pursuing the legitimate interest of protecting the service. Health data is processed only within the authorization and legal basis applicable to the organization using Labspace.
4. Data recipients
Data is available only to authorized users of the relevant organization and team. It may be entrusted to hosting, sign-in email, infrastructure maintenance and technical support providers only to the extent necessary to operate the service.
The applications do not sell data, display advertising or use medical data for marketing profiles. Apple receives technical information related to app distribution under its own terms and privacy policy.
5. Retention and deletion
Server data is retained for periods arising from the agreement with the organization, laboratory and medical documentation duties, billing, security and legal claims. The session token and active account data remain in secure device storage until sign-out, session revocation or app removal.
A downloaded PDF report is written temporarily to the app cache while it is handed to the system share sheet and is then removed by the app. Copies saved by the user outside the app are governed by device settings and the user organization’s policies.
6. Security
The applications use encrypted HTTPS connections, operating-system secure storage, two-factor authentication and access control based on the account, team and role. Users should protect devices with a screen lock, install updates and never share credentials.
7. Individual rights
Depending on the legal basis, individuals may have rights of access, correction, deletion, restriction, portability and objection, and may lodge a complaint with the Polish Personal Data Protection Office. For patient or employee data, contact the laboratory or organization that issued the account first.
8. Children and intended use
The applications are professional tools for authorized laboratory staff and medical partners. They are not directed to children or intended for independent patient use and do not provide medical advice.
9. Changes to this policy
This policy may be updated when functions, providers or laws change. The current version and revision date are published on this page.