Privacy policy

DRAFT v0.1, LAST UPDATED 24 SEP 2026

Draft for review by data-protection counsel before launch. Bracketed items and the registered entity details must be completed, and the whole document reviewed against the NDPA and NDPC guidance, before this page goes live.

1. Who we are

LabTaaS ("we", "us") is operated by [registered company name, RC number], of [registered address], Lagos, Nigeria. We provide laboratory management software to medical diagnostic laboratories in Nigeria. You can reach us at hello@labtaas.com.

2. Two roles, two kinds of data

We handle personal data in two distinct capacities under the Nigeria Data Protection Act, 2023 (NDPA):

As a data controller for this website and for the accounts of the labs that subscribe: visitor analytics, contact details you send us when booking a demo, and the names, emails and licence details of laboratory staff who use the platform.
As a data processor for patient data. Each laboratory that uses LabTaaS is the data controller of its patients' records. We process those records only on the lab's documented instructions, under a signed Data Processing Agreement, and we never use patient data for our own purposes. Patients should direct privacy questions to their laboratory first; we support every lab in answering them.

3. What we collect as a controller

Demo and contact requests: your name, phone number and lab details when you write to us on WhatsApp or email.
Staff accounts: name, work email, role, and for signing scientists the MLSCN licence number and expiry, provided by your lab's director.
Technical logs: IP address, browser type and pages visited, kept for security and troubleshooting.

4. Lawful bases and purposes

We process controller data to perform our contract with your lab, to comply with legal obligations, and for our legitimate interest in securing and improving the service. We do not sell personal data and we do not run third-party advertising.

5. How patient data is protected

Patient records live in an isolated tenancy per laboratory. Result links sent to patients expire after 72 hours. Delivery messages are only sent on channels the patient has consented to, and every consent has a numbered record with immediate effect on withdrawal. Every clinically relevant action is written to an append-only audit log. Our own operations staff can see billing metadata only, never clinical data.

6. Sharing and processors

We use a small set of sub-processors to run the service: cloud hosting [provider, region], WhatsApp message delivery (Twilio), and email delivery [provider]. Each is bound by contract to protect the data it handles. The current sub-processor list is available on request and forms part of the Data Processing Agreement signed with each lab.

7. Retention

Contact requests are kept for [12 months]. Staff account data is kept while the account is active and for [12 months] after closure. Patient data retention is set by each laboratory as controller, consistent with Nigerian medical record-keeping requirements; when a lab leaves LabTaaS, its data is exported to the lab and then deleted from our systems within [90 days].

8. Your rights

Under the NDPA you may request access to, correction of, or deletion of your personal data, object to processing, and lodge a complaint with the Nigeria Data Protection Commission (NDPC). Write to hello@labtaas.com and we will respond within [30 days]. For patient records, we will refer your request to the laboratory that controls them and assist it in responding.

9. Changes

We will post any changes to this policy on this page and, for material changes, notify subscribing labs by email before they take effect.