Data processing agreement
What we do with personal data on your laboratory's behalf, what we do with it for our own purposes, and the difference between the two.
Last updated 2026-08-07
Version 2026-08-11. This version has its own address and will not be edited in place — a contract term that can be changed silently is not a term you agreed to. It forms part of the Terms of Service and applies to laboratories in India.
1. We are not simply your processor, and it matters
Most agreements like this one open by declaring the vendor a data processor acting only on the customer's instructions. We are not going to write that, because for part of what we hold it would be false.
The roles therefore split by dataset. Everything we hold falls into one of these two columns, and nothing sits outside the table:
| Data | Our role | Why |
|---|---|---|
| Your instrument register, maintenance, calibration, QC, breakdowns, suppliers and spares | Processorfor your lab | Your lab decides what goes in and how long to keep it. We hold it and do what your lab's users tell us. |
| Your staff accounts — names, work emails, roles, phone numbers | Processorfor your lab | Your lab creates and removes these. We do not decide who works at your laboratory. |
| The audit trail | Processorfor your lab | It exists because your lab needs a traceable history for its own accreditation. We cannot edit it and neither can you. |
| Sign-in and password-reset throttling — email addresses and network addresses | Processorfor your lab | Security telemetry kept to protect your accounts. We use it for nothing else and it ages out on its own. |
| The sales lead record — contact name, work email, lab name, how you arrived | Controllerour own purpose | We decided to collect this, and we decided what it is for: finding laboratories that may want CrelioHealth. That is our own commercial purpose, not yours. |
| The behavioural score and the activity events behind it | Controllerour own purpose | We generate this from your lab's use of the product, for our own sales purposes. This is the reason we cannot describe ourselves as a processor across the board. |
| Which version of our home page a visitor was shown | Controllerour own purpose | Our own measurement of our own marketing. It holds a single letter and identifies nobody. |
Where we are your processor, sections 2 to 9 apply and your laboratory decides what happens to the data. Where we are the controller, the privacy policy governs and the individual deals with us directly — including the right to stop it, which in this product stops the scoring and not merely the email.
2. What we do with data we process for you
Only what running the service requires, and only on the instructions your laboratory's own users give through the product. We do not read your breakdown notes, QC results or calibration certificates for our own purposes, we do not sell your records, and we do not use them to train anything.
We do count certain actions — that an instrument was added, that a register was exported — to produce the lead score described above. The count is of the action, not of its contents.
3. The people who can reach it
Access is limited to those in our team who need it to run or support the service, and they are bound to keep it confidential. Section 5 is specific about the one route that reaches further than you might assume.
4. Security, described as it actually is
What follows is what the software does, not a list of aspirations. Where a control is weaker than a reader might assume, it says so — a laboratory doing its own vendor due diligence is entitled to that, and finding out later is worse for both of us.
| Measure | What it actually is |
|---|---|
| Tenant separation | Every table carrying your data has a lab identifier, and every query filters on it. That filter is in our application code, not in the database — all labs share one database file and SQLite has no row-level security, so there is no second net beneath us. We test for it; it depends on us writing every query correctly. |
| Credentials | Passwords are stored as scrypt hashes and are never recoverable. Password-reset links are stored hashed, expire in one hour, work once, and end every existing session when used. Sign-in and reset attempts are rate limited by email address and by network address. |
| Transport | HTTPS, with HTTP Strict Transport Security sent on every response. Security headers include X-Frame-Options, nosniff and a referrer policy. State-changing requests are checked against the origin they came from. |
| Access within our team | The internal sales console is disabled unless a key is set, and it exposes only the lead tables — not your equipment records. Be aware that the same key can issue a password-reset link for any account; that exists so a locked-out sole administrator can be helped, it requires a written note of how the caller's identity was confirmed, and that note is written into your lab's own audit trail where you will see it. |
| Backups | The database is snapshotted on a schedule using SQLite's own online backup, each snapshot is verified to open cleanly, and copies are retained for a set period then overwritten. This is disaster recovery for the service, not a per-customer restore service. |
| What we do not have | We hold no security certification. We are not ISO 27001 certified and we have not had a third-party penetration test or security audit. We do not currently log who inside our team viewed or exported a lead record, so after a hypothetical exposure there we could not reconstruct exactly who saw what. We would rather you knew that than discovered it. |
5. Sub-processors
Others who process personal data on our behalf in order to run the service. We remain responsible to you for what they do.
We will update this list before adding a new sub-processor, and the page carries the date of its current version so you can tell when it last changed.
6. Where the data sits
Your data is stored on servers in India. If that changes we will update this page before it does.
7. If there is a breach
We will tell your laboratory without undue delay and in any event within 24 hours of becoming aware of a personal data breach affecting data we process for you, with what we know at the time and updates as we learn more.
Twenty-four hours is deliberate rather than generous: where your laboratory has its own notification duty — Malaysia expects notification to the Commissioner as soon as practicable, and within 72 hours in the ordinary case — a slower promise from us would make yours impossible to keep. Our clock has to be shorter than yours.
We keep a written record of breaches and of what we did about them. Where we are the controller — the lead data — we notify the regulator and affected individuals ourselves.
8. When someone asks about their data
If an individual approaches us about data we process for your laboratory, we will not answer for you: we will pass the request to your administrators and help you respond within the time your law allows, which for access and correction under Malaysian law is 30 days.
Two exceptions where the person deals with us directly, because you have no way to help: anything about our own sales lead record, and anyone named in your records who never had an account here — an invited colleague who did not accept, or an external calibration engineer.
9. Return and deletion
An administrator can download everything at any time from Settings → Your data — one file, no row caps, built from the same list of tables a deletion sweeps, so what you take away and what we remove are the same set.
On request we delete the workspace and everything in it in a single transaction. Two honest limits: it cannot be undone, and data stays in database backups until those roll off, after which anything restored is re-deleted. Full detail on Your data & deletion.
10. Checking up on us
Ask and we will answer questions about how we handle your data, in writing, including anything on this page you want expanded. We are a small team running a free product, so we cannot host on-site audits — if your own obligations require one, tell us before you commit to the product rather than after.
11. Contact
privacy@creliohealth.com