Privacy Policy

1. About this policy

LabOS is a cloud laboratory information system for diagnostic labs in India, provided by MedOS (“we”, “us”). This policy explains what personal data LabOS handles, why, where it is kept, who else receives it, how long it is kept and what rights people have over it.

The laws that apply: the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025. The Rules were notified in November 2025, and most of the Act's duties (notice, consent, rights, security, breaches, transfers outside India) take effect 18 months later, in May 2027. Until then, the Information Technology Act, 2000 (section 43A) and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“2011 Rules”) apply. We already follow the DPDP Act and Rules, and the 2011 Rules for as long as they apply. Health information, such as test results, is sensitive personal data under the 2011 Rules, and we treat it that way.

2. Who is responsible for what

Patient data: the lab decides, LabOS processes

Each lab that uses LabOS is the Data Fiduciary for the data of its patients and of the people it deals with about them (for example referring doctors and the contacts of its business clients). The lab decides why and how that data is used. MedOS is the lab's Data Processor: we process that data only to provide LabOS to the lab, on the lab's instructions and under our Terms of Service (section 8 sets out our duties as processor). We do not use it for our own purposes, sell it, use it for advertising, or use it to train AI models. Our team looks at a lab's data only when the lab asks for help, when it is needed to keep the service running or secure, or when the law requires it.

Account data: LabOS decides

MedOS is the Data Fiduciary for the data of the people who use LabOS itself: lab owners and staff, users of the doctor portal and the business-client portal, and people who sign up or write to us.

3. What data LabOS handles

Patient data entered by a lab

• Identity and contact: name, salutation, age or date of birth, sex, mobile number, email, address and pincode.
• ID numbers, if the lab records them: ABHA number or address, Aadhaar number (only the last 4 digits are ever shown), the lab's patient or UHID number, passport and insurance numbers.
• Health data: tests ordered, clinical notes, samples, results, reports and interpretations, height and weight, and documents the lab uploads (such as prescriptions and ID proofs).
• Visits and bills: orders, bills, payments and refunds, the referring doctor, the business client, the patient's company if the lab records it, and home-collection visits.
• Price estimates (quotations): the name, mobile number, age and sex typed on them, and the tests quoted.
• Consent and requests: what the patient agreed to (the exact words and their version), when, how and who recorded it; requests to withdraw consent, see or erase data.
• Messages and report links: which report, bill or reminder was sent, on which channel and when (with the number or address masked); for each report link, when it was created and opened, the number of wrong password attempts, and a check value made from the patient's date of birth or the last 4 digits of their mobile.

Account data

• The lab: name, addresses, branches, registration and NABL numbers, GST and PAN, logos, letterheads, and the signatures of the people who sign reports.
• Owners and staff: name, mobile number, email, role, branches, and professional registration details for those who sign reports.
• Portal users (referring doctors, business clients): name, mobile number and email.
• Sign-in and activity: sign-in times, IP address and browser, and an audit trail of actions in the lab's account.
• Acceptance of these terms: which versions of the Terms and this policy the owner accepted at signup, when, and from which IP address and browser.
• Subscriptions: plan, period and amount, and Razorpay's order and payment numbers. Card, UPI and bank details go directly to Razorpay; LabOS never receives them.

Request logs

Cloudflare, which runs LabOS, handles every request (the web address, the time, and the IP address and browser) to deliver it and to block attacks, and keeps a record of requests it blocks or flags as suspicious. A web address can include what staff typed into a search box (which may be a patient's name or mobile number) or the code of a report link. LabOS does not keep a log of every request: it keeps only error messages, which do not include web addresses, to find faults. See sections 6 and 9 for where these are kept and for how long.

LabOS does not read your device's location, and does not use analytics, advertising or social-media trackers.

4. Why it is used, and on what basis

Patient data (decided by the lab)

• Registering the patient, testing, reporting and billing (including quality control and the printed report): the patient gives their details for this purpose, which is a legitimate use under section 7(a) of the DPDP Act, and the lab keeps the medical and billing records the law and its accreditation require. Under the 2011 Rules, a lab must take the patient's written consent before collecting health information, which labs usually do on their registration or test-request form (Terms, section 7).
• The referring doctor or business client: the doctor, hospital or organisation that sent the patient sees the reports of the tests it referred in its LabOS portal, as part of that referral (section 7(a)). This does not depend on the patient's consent for messages, and withdrawing that consent does not stop it. Where the organisation is the patient's employer, the lab must make sure the patient knows it will see the results (Terms, section 7).
• Messages, only with the patient's consent (section 6 of the Act): sending reports, bills and payment reminders to the patient by WhatsApp, SMS or email. The box at registration is never ticked in advance, and LabOS keeps the exact words agreed to, their version, the time, how consent was given (explained in person, signed on paper) and who recorded it. LabOS also sends a report to the referring doctor or business client by message only while the patient's consent is on file. Consent given before 12 Nov 2026 used older words (reports by WhatsApp or SMS); LabOS holds back email, bills and payment reminders to that patient until the lab records consent in the current words.
• Other legitimate uses in section 7 of the Act, only where they truly apply: for example responding to a medical emergency, or a legal duty to report a notifiable disease to the government.

The lab must give its patients a notice explaining this. Ours is at /privacy/patients; links to it from inside a lab's account and from its patients' report pages name the lab and give its contact details.

Account data (decided by us)

We use account data to open and run your lab's account, sign you in with one-time codes, keep the service secure and prevent misuse, provide support, bill your subscription, and send you service messages (such as the welcome email and notices about these terms). The basis:

• Owners: the details you give to open and run the account, for that purpose (section 7(a)), and the contract in our Terms. Owners who opened an account from 12 Nov 2026 tick a box accepting the Terms and this policy, and LabOS records which versions and when; that is a record of the contract, not a separate consent.
• Staff: the lab adds its staff and decides their access; as their employer, the lab tells them how their details are used (section 7(i) covers employment). We use those details only to sign the person in, keep the account secure and show who did what.
• Portal users: the lab adds its referring doctors and business clients; they give their mobile number to sign in (section 7(a)).
• Our legal duties, for example keeping tax invoices and reporting security incidents.

You can tell us at any time that you object to a use. We do not send marketing messages.

5. AI features

Some optional features use AI models run by Cloudflare Workers AI. Before anything is sent, LabOS removes who the patient is: a prompt never contains the patient's name, mobile number, email, address, ABHA or Aadhaar number, or patient or order number, and text staff type is scrubbed of the patient's name and of anything that looks like a mobile number, email or ID number. The one exception is analyser message recovery, below. LabOS does not store prompts; it counts AI use for plan limits. What each feature sends:

• Report summary (English or Hindi) and Smart Report advice: the patient's sex and age and their released results (test, value, unit, range, flag); text results are scrubbed as above.
• Interpretation drafts for a pathologist: the test, sample type and method, the values with units, flags and ranges, the previous value (“about 3 months earlier”, never a date), and sex and age. A draft is saved only if staff save it, and reaches a report only when the lab approves and releases that test.
• A test's standard interpretation in the catalogue: the test and its parameters; no patient data.
• Test suggestions at registration: the symptoms or reason staff type, scrubbed as above.
• Analytics observations: the lab's totals for a period (counts and amounts) and the names of its top referring doctors or hospitals and departments; no patient data.
• Analyser message recovery: when an analyser sends a message LabOS can't read, the message without its patient section. It still contains the sample (barcode) number and the results, because LabOS needs the number to match the results to the sample.

Cloudflare may run these models in a data centre outside India (see section 6). AI output is a draft or a suggestion; it is never a diagnosis, and the lab stays responsible for what it reports.

6. Where data is stored and processed

• The application runs on Cloudflare Workers, set to run next to our database in Mumbai. Your connection first reaches the Cloudflare data centre nearest to you, which passes it on to the application.
• The database (all LabOS records) is hosted by Turso in Mumbai (AWS ap-south-1).
• Uploaded files (patient documents, result attachments, lab letterheads, logos and signatures) are kept in Cloudflare R2 storage in its Asia-Pacific region. That region is not limited to India, so files may be stored outside India.
• Error logs and Cloudflare's records of blocked or suspicious requests (section 3) are kept by Cloudflare, which may store them outside India.
• AI features run on Cloudflare's network, which may be outside India; prompts are de-identified (section 5).
• Messages and email are delivered by the providers in section 7, which may process them outside India.

Until the DPDP Act's rules on transfers apply, the 2011 Rules (rule 7) allow health information to go outside India only where it is needed to perform the lawful contract (here, to provide the service the lab signed up for) or the person consented, and only to a provider that protects it to the same standard as the Rules require. We use these providers on that basis. From May 2027, section 16 of the DPDP Act allows processing outside India except in countries the Central Government restricts by notification; if a place we use is restricted, we will stop using it for personal data.

7. Who else receives data

These providers process data for us (our sub-processors). Each gets only what its job needs:

• Cloudflare — hosting and network protection (all traffic passes through it, and it keeps the request logs in section 3), file storage (R2) and AI models (Workers AI, de-identified prompts only).
• Turso — the database that holds all LabOS records.
• MSG91 — sign-in codes by SMS for owners, staff and portal users (mobile number). On the LabOS sign-in and signup pages, the code window is MSG91's own code: it loads hCaptcha, a check that tells people from bots, which sees your IP address and browser details. MSG91 also sends a lab's SMS messages to patients, doctors and business clients when the lab switches SMS on (mobile number, patient's name, lab's name, a report or bill link), through the lab's own MSG91 account or ours.
• Meta (WhatsApp) — WhatsApp messages, only when a lab connects its own WhatsApp Business number (mobile number, patient's name, lab's name, a report or bill link).
• Resend — email: our welcome and service emails to owners, and a lab's report, bill and reminder emails when the lab switches email on (email address, names, a link; no report is attached).
• Razorpay — payments for subscriptions and for business-client top-ups (amount, order number, and what the payer enters on Razorpay's checkout).

Data also goes where a lab sends it:

• the patient, their referring doctor or business client (by message, and in their portal), and anyone the lab gives a report link to;
• integrations the lab switches on: MedOS clinic software (orders in, results back), its analysers, and its own WhatsApp or MSG91 accounts;
• WhatsApp on a staff member's phone, when the lab sends a report that way by hand (outside LabOS);
• Google, when collection staff open directions to a patient's address in Google Maps (the address goes to Google).

We disclose data to government authorities only when the law requires it, for example under a court order, and then only what is required. LabOS pages and reports use fonts served by LabOS itself, not by Google.

8. How data is protected

• All connections use HTTPS (TLS), with HSTS, a Content Security Policy, and protection against other sites framing LabOS.
• Everyone signs in with a one-time code sent to their own mobile; there are no passwords to steal or share. Lab sessions last at most 12 hours.
• On the patient record, the name, mobile number, date of birth, address, email, ABHA, Aadhaar, ID and insurance numbers, and the clinical notes on a visit are encrypted in the database with AES-256-GCM. Mobile numbers are matched through a hashed copy, so finding a patient doesn't need the number in readable form.
• A few copies outside the patient record are not encrypted: the name and mobile number on a price estimate, the mobile number a report link was sent to (cleared when the link expires, and on withdrawal or erasure), the address of a home-collection visit, and the company name on a visit. Access to them is controlled like everything else below.
• Every record belongs to one lab. LabOS checks each request against the signed-in person's lab and role and, for someone limited to some branches, those branches.
• Each lab has an audit trail of sign-ins and of changes to patients, results, reports and bills, chained so that later tampering shows.
• Files and reports are served only to someone signed in to the lab's account or to its doctor or business-client portal, or after a report link's password is checked; never from a public address. A deleted file is never served again, even before it is removed from storage. A report link locks after 5 wrong passwords, expires after the time the lab sets, and stops working if the patient withdraws consent. Report PDFs that patients download are password-protected.

No system is perfectly secure. Each lab must also protect its own devices and give access only to people who need it.

9. How long data is kept, and deletion

• Patient records (patients, orders, results, report data, bills, consent records and the audit trail) are kept for as long as the lab's account is open. LabOS does not delete them on a timer, because labs must keep medical and billing records for periods set by law and by their accreditation. The lab decides how long to keep them.
• Erasure on a patient's request (done by the lab's owner or admin in LabOS) removes the patient's name, contact details, date of birth, address, ID numbers and uploaded documents, takes them out of search, and stops their report links. Their past orders, results, reports and bills stay, without those details, as records the lab must keep.
• Withdrawal of consent stops every message LabOS sends about the patient (to them, their doctor or business client), stops report links already sent, and removes the patient's email address, which was kept only to send them messages. It does not delete records the lab must keep, and the referring doctor or business client can still see the reports of tests it referred in its portal; the patient can also ask for erasure.
• Deleted files (a document, an attachment, the files of an erasure) are deleted from storage at once; if that fails, a daily clean-up at 03:00 IST deletes them. They are never served once deleted.
• Report links stop working when they expire. The daily clean-up then clears the mobile number and password check value they held. The rest of the link's record (when it was made and opened, wrong attempts) is the lab's log of access to the report, kept for one year after expiry and then deleted.
• Unlocked report pages stay open in that browser for at most 6 hours.
• Error logs (section 3) are kept for up to 7 days. Cloudflare keeps its records of blocked or suspicious requests under its own retention rules.
• Copies for recovery: where our database provider keeps restore copies (point-in-time history), deleted or erased data stays in them until that history expires; they are used only to recover from a failure.
• Account data is kept while the account is open. Our invoices and payment records are kept for as long as tax law requires, and the record of which Terms and policy were accepted is kept as a record of the contract.
• Closing an account: LabOS has no self-service closure yet. The owner writes to support@med-os.in; we confirm the request with them, provide an export of the lab's data on request for 30 days after closure, and then delete the lab's data from LabOS, except what the law requires us to keep. Before closing, the lab must make sure it keeps any records it is legally required to keep.

10. If there is a data breach

For patient data (we are the processor): we tell the affected lab without undue delay after we become aware of a breach, with what we know — what happened and when, what data and which patients are affected, the likely consequences, what we have done and what we recommend, and who to contact — and keep the lab updated, so it can inform the Data Protection Board of India and the affected patients as the DPDP Rules require.

For account data (we are the fiduciary): we inform the affected people without delay, in plain language, with what happened, the likely consequences, what we are doing and what they can do; and we inform the Data Protection Board of India, with a detailed report within 72 hours of becoming aware, as the DPDP Rules require.

We also report cyber security incidents to CERT-In as Indian law requires.

11. Your rights and how to use them

Under the DPDP Act you can ask for a summary of your personal data and how it is used (and who it has been shared with), have it corrected, completed or updated, have it erased when it is no longer needed for the purpose or a legal duty, withdraw your consent as easily as you gave it, nominate someone to use these rights for you if you die or cannot act, and have your grievances answered.

Patients

Contact the lab you visited: it decides on your request. In LabOS the lab corrects details by editing your record, and its owner or admin can record a withdrawal of consent, erase your details from your patient record, or download a copy of your data for you: your details, your visits with their tests and released results, your consent history, and who your data went to (your doctor or organisation, messages and report links, and the services LabOS uses). Report PDFs are given separately. If you write to us instead, we will tell you which lab to contact or, with your permission, pass your request to the lab. See the notice for patients.

Lab owners, staff and portal users

Write to privacy@med-os.in from your registered email, or say which mobile number your account uses; we may ask you to confirm it is you. Staff can also ask their lab's owner or admin to correct their details. To stop us using your account data, ask us to close your access (LabOS can't be used without it); records the lab or we must keep by law stay. To nominate someone, send us their name and contact details. We reply within one month.

12. Children, and people with a guardian

LabOS accounts are for adults (18 or over). When a patient is under 18, or is a person with a disability who has a lawful guardian, the lab must take consent from the parent or lawful guardian, who can also use the patient's rights. The DPDP Rules, 2025 relax the verifiable-consent requirement for children for clinical establishments and healthcare professionals only as far as needed to provide health services to the child; outside that, the lab must follow the Act's rules for children's data. LabOS does not track or profile children, and never uses their data for advertising.

13. Cookies and browser storage

LabOS uses only cookies and browser storage it needs to work, so it does not ask for cookie consent. None is used for analytics or advertising.

• Sign-in: labos_session and labos_csrf (named __Host-labos_session and __Host-labos_csrf on app.labos.in and lms.med-os.in), up to 12 hours; the session cookie is HttpOnly, Secure and SameSite=Strict.
• Portals: labos_ref_session (doctor portal) and labos_b2b_session (business-client portal), up to 12 hours.
• Report links: one cookie per unlocked link (labos_share_…), up to 6 hours, so the patient isn't asked for the password again.
• Preference: labos_sidebar_collapsed, whether the menu is collapsed (1 year).
• Cloudflare may set its own security cookies (such as __cf_bm) to tell people from bots.
• Local storage on your device keeps settings and little else: menu layout, the last “What's new” seen, counter and printer settings, the time of your last activity (for automatic sign-out), the branch chosen at registration, your lab's form settings, today's scan count with the last sample number scanned, a dismissed checklist, the last lab used on the business-client portal, and whether this computer's settings were brought over from LabOS's old address. Each web address (app.labos.in, lms.med-os.in) has its own local storage; settings move from one to the other only when you choose “Bring settings”, and only on your own device.
• Session storage keeps an unsaved registration form (which can include the patient's details) in that browser tab for up to 30 minutes, so a reload doesn't lose it; it is cleared when the registration is saved and when the tab is closed. It also keeps a dismissed demo banner, the total shown at checkout, and a one-time code while settings are brought over from LabOS's old address.

14. Contact and grievance officer

Questions, requests and grievances about privacy: our Grievance Officer at privacy@med-os.in. We acknowledge grievances and resolve them within one month of receiving them. Postal correspondence: MedOS, Mumbai, Maharashtra, India.

Patients with a grievance about how a lab used their data should first raise it with that lab; the lab must answer it.

15. Complaints to the Data Protection Board

If you are not satisfied with how your grievance was answered (by us, or by the lab for patient data), you can complain to the Data Protection Board of India, the authority set up under the DPDP Act, in the way the Board publishes.

16. Changes to this policy

When we change this policy, the version date at the top changes. A change that only describes more accurately what LabOS does applies from that date. A change that reduces what we do for a lab, or adds to what a lab must do, applies to an existing account only after we have emailed its owner at least 30 days ahead. In this version, the earlier promise to delete a closed lab's data within 30 days continues to apply to accounts opened before 12 Nov 2026 until 12 Dec 2026. Earlier versions are available on request from privacy@med-os.in.