mLAB LIMS Privacy Policy
Last Updated: February 24, 2026
Introduction
mLAB LIMS ("mLAB", "we", "us", or "our") is committed to protecting your privacy and ensuring the security of laboratory data and personal information processed through our Laboratory Information Management System. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our services, visit our website at www.mlablims.com, or interact with mLAB LIMS in any manner. Please read this Privacy Policy carefully. By accessing or using mLAB LIMS, you acknowledge that you have read, understood, and agree to be bound by all terms of this Privacy Policy. If you do not agree with our policies and practices, do not use our services. mLAB LIMS is a product of Mplus Systems. This Privacy Policy applies specifically to mLAB LIMS and supplements the Mplus Systems General Privacy Policy.
Information We Collect Through Laboratory Operations
As a Laboratory Information Management System, mLAB LIMS processes various types of data in the course of normal laboratory operations. This includes laboratory data such as sample identifiers and tracking information, test protocols and parameters, test results and calculations, quality control data, instrument readings and outputs, chain of custody records, and audit trails with electronic signatures. We also collect personal information including names, professional credentials, employee IDs, and contact information of laboratory personnel who use the system, as well as names, organizations, and contact information of individuals or entities submitting samples. When applicable for clinical or research purposes, we may process de-identified or coded patient/sample identifiers. Additionally, we collect connection information such as Internet Protocol (IP) addresses of devices accessing the system, date and time stamps of system access and actions, browser type and version, operating system information, and device identifiers.
Information Collected Through Our Website
When you visit our website, we may automatically collect log information including pages visited and time spent on each page, referring website addresses, search queries, download activity, and standard HTTP request headers such as user agent and language preferences. We use cookies and local storage to authenticate users and maintain session state, remember user preferences, analyze website traffic and usage patterns, and improve website functionality and user experience. You can control cookies through your browser settings, though disabling cookies may limit your ability to use certain features of our website.
Information You Provide Directly
When you register for mLAB LIMS, we collect account information including your name and job title, email address, organization name and laboratory details, phone number, and billing information which is processed securely through our payment partners. When you contact us for support or inquiries, we collect email correspondence, support tickets and chat logs, phone call recordings with notice and consent where required, and feedback and survey responses.
How We Use Your Information
We use the information we collect for laboratory operations including managing sample workflows and test processes, generating certificates of analysis and reports, maintaining chain of custody and audit trails, ensuring quality control and compliance, and integrating with laboratory instruments and systems. For regulatory compliance, we maintain records required for laboratory accreditation including NABL, ISO 15189, ISO 17025, CAP, and CLIA standards, support 21 CFR Part 11 compliance for electronic records and signatures, respond to regulatory inspections and audits, and preserve data integrity in accordance with ALCOA+ principles. We use your information for service delivery and improvement including providing, maintaining, and improving mLAB LIMS functionality, troubleshooting technical issues and bugs, monitoring system performance and security, developing new features and capabilities, and conducting data analysis to improve user experience. For communication purposes, we respond to inquiries and support requests, send service notifications and updates, provide training materials and documentation, inform you about new features or changes to our services, and send marketing communications with opt-out option. For legal and security purposes, we protect against unauthorized access and security threats, investigate and prevent fraud or misuse, comply with legal obligations, enforce our Terms of Service and other agreements, and establish, exercise, or defend legal claims.
Legal Basis for Processing (GDPR)
For users in the European Economic Area (EEA), we process personal information based on the following legal grounds. Laboratory operations and service delivery are based on performance of a contract with you. Regulatory compliance is based on compliance with legal obligations. System security and integrity is based on our legitimate interests. Communications with you may be based on consent or legitimate interests. Marketing activities are based on your consent. Research and analytics are based on our legitimate interests or your consent.
Data Sharing and Disclosure
Within your laboratory, you control access to your laboratory's data. You are responsible for defining user roles and permissions, managing user access to samples and tests, and ensuring proper training of laboratory personnel. We may share information with trusted third-party service providers who assist us in operating our services, including cloud infrastructure providers for data hosting, payment processors for subscription billing, customer support platforms, analytics providers, and email communication services. These providers are contractually obligated to protect your information and use it only for the services they provide to us. We may disclose information to comply with legal obligations, court orders, or regulatory requests, in response to lawful requests from public authorities, to enforce our rights or protect our property, and in connection with an audit or inspection of your laboratory by accrediting bodies including NABL or regulatory authorities with your authorization. In the event of a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change and ensure your information continues to be protected. We may share information for other purposes with your explicit consent.
Data Storage and Security
mLAB LIMS data is stored in secure data centers located in the United States for North American customers, the European Union for European customers, Singapore for Asia-Pacific customers, and Australia for Australian and New Zealand customers. You can choose your preferred data center region during account setup. We implement industry-standard security measures to protect your data including encryption in transit using TLS 1.2 and 1.3, encryption at rest using AES-256, multi-factor authentication, regular security assessments and penetration testing, access controls and audit logging, firewalls and intrusion detection systems, and employee security training and background checks. We maintain data integrity through automated backup systems, redundant infrastructure, regular disaster recovery testing, audit trails of all data modifications, and version control for records.
Data Retention
We retain your laboratory data for as long as your account is active or as needed to provide you services. You may export your data at any time. Upon termination of your account, we will retain your data for 30 days to allow for data export, after which it will be permanently deleted unless longer retention is required by law or regulation. If you are subject to specific regulatory retention requirements, including NABL accreditation requirements which typically mandate retention periods of 3 to 10 years depending on the type of records, you are responsible for configuring retention periods in accordance with applicable regulations, exporting and archiving data as required for long-term retention, and maintaining records for inspection purposes. System logs and analytics data are retained for security monitoring for 90 days, performance analysis for 1 year, and aggregated usage statistics are retained indefinitely in anonymized form.
Your Rights and Choices
You have the right to access and portability, meaning you can request a copy of your personal information, export your laboratory data in common formats including CSV, PDF, and XML, and receive information about how your data is processed. You may exercise correction and deletion rights by updating or correcting inaccurate information, requesting deletion of personal information subject to legal and regulatory retention requirements including NABL requirements, and anonymizing data where appropriate. You can restrict processing by objecting to certain processing activities, restricting how your information is used, and withdrawing consent at any time where processing is based on consent. You can manage communication preferences by opting out of marketing emails, choosing notification preferences, and managing email subscriptions. To exercise any of these rights, contact us at privacy@mlablims.com, through your account administrator, or using the data export feature in your mLAB LIMS dashboard. We will respond to your request within 30 days.
International Data Transfers
mLAB LIMS operates globally, and your information may be transferred to and processed in countries other than your own. When we transfer data from the European Economic Area (EEA) to countries with different data protection laws, we implement appropriate safeguards including Standard Contractual Clauses approved by the European Commission, Binding Corporate Rules, and verification that the recipient country ensures adequate level of protection. For laboratories operating under NABL accreditation in India, data localization requirements may apply, and we ensure that data from Indian laboratories can be stored in our Asia-Pacific data center in Singapore which meets the security and privacy requirements necessary for NABL compliance.
Children's Privacy
mLAB LIMS is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected information from a child without parental consent, we will take steps to delete that information.
Compliance with Specific Regulations
NABL (National Accreditation Board for Testing and Calibration Laboratories)
If you use mLAB LIMS in a laboratory seeking or maintaining NABL accreditation in India, we provide features and support to help you comply with NABL requirements under ISO 15189 and ISO 17025 standards. Our system supports the documentation and record-keeping requirements mandated by NABL including maintaining technical records for personnel, equipment, and methods, ensuring traceability of measurements and calibrations, documenting all quality control procedures and results, preserving audit trails of all modifications to records, and generating reports suitable for NABL assessment and inspection. You are responsible for validating the system for your specific NABL-accredited scope, implementing procedures that comply with NABL requirements, training personnel on proper system use for NABL compliance, and maintaining records for the periods specified by NABL which typically range from 3 to 10 years depending on record type. We offer validation support packages specifically designed for laboratories preparing for NABL accreditation.
HIPAA (Health Insurance Portability and Accountability Act)
If you use mLAB LIMS to process protected health information (PHI), we offer Business Associate Agreement (BAA) execution to help you comply with HIPAA requirements. This includes implementing appropriate administrative, physical, and technical safeguards for PHI, ensuring breach notification procedures are in place, maintaining required documentation, and supporting your HIPAA compliance efforts. Contact us for more information about executing a BAA.
GDPR (General Data Protection Regulation)
For users in the European Union, we comply with GDPR requirements regarding lawful basis for processing, data subject rights, data protection impact assessments, breach notification procedures, and data protection officer contact. Our Data Protection Officer can be reached at dpo@mlablims.com.
21 CFR Part 11
mLAB LIMS provides features to support compliance with FDA 21 CFR Part 11 for electronic records and signatures, including audit trails, signature manifestations, and system controls. You are responsible for validating the system for your specific use and maintaining compliant procedures.
CLIA, CAP, ISO 15189, ISO 17025
We support laboratory accreditation requirements through audit trail functionality, electronic signature capabilities, quality control features, and comprehensive reporting. For laboratories seeking or maintaining accreditation under any of these standards, mLAB LIMS provides the documentation and traceability features necessary for compliance.
Cookies and Tracking Technologies
We use essential cookies for authentication, security, and session management which may be session-based or persistent. Preference cookies are used to remember user settings and preferences and are retained for up to 1 year. Analytics cookies track usage patterns to help us improve our website and are retained for up to 2 years. Marketing cookies deliver relevant advertisements only when you have opted in and are retained for up to 90 days. We use Google Analytics and similar services to understand how visitors interact with our website. These services may collect pages visited, time on site, browser information, and approximate geographic location. You can learn about Google's privacy practices at policies.google.com/privacy. Our website does not currently respond to "Do Not Track" signals, as there is no consistent industry standard for DNT implementation.
Data Breach Notification
In the event of a data breach that affects your personal information, we will notify affected users without undue delay, provide details of the breach and potential impact, recommend steps to protect your information, cooperate with regulatory authorities including NABL and other accreditation bodies as required, and document the breach and our response. For laboratories operating under NABL accreditation, breach notification must also be handled in accordance with your laboratory's quality management system and any specific NABL requirements for incident reporting. Notification will be made via email or through the mLAB LIMS dashboard.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices and services, legal and regulatory requirements including changes to NABL standards, and industry standards and best practices. We will notify you of material changes through email to account administrators, in-app notification upon login, and notice on our website. The "Last Updated" date at the top of this policy will indicate when it was most recently revised. Your continued use of mLAB LIMS after any changes constitutes your acceptance of the revised policy.
Contact Information
For privacy inquiries or questions about this Privacy Policy or our data practices, contact the mLAB LIMS Privacy Team at privacy@mlablims.com. For GDPR-related inquiries or to contact our Data Protection Officer, email dpo@mlablims.com. For NABL accreditation and compliance questions, email nabl-compliance@mlablims.com. For general regulatory compliance questions, email compliance@mlablims.com. Our mailing address is mLAB LIMS, Attn: Privacy Officer, [Your Physical Address]. Our parent company is Mplus Systems, website at www.mplussystems.com.
Supervisory Authority
If you are in the European Economic Area and believe we have not adequately addressed your privacy concerns, you have the right to lodge a complaint with your local data protection authority. For users in the Netherlands, the supervisory authority is Autoriteit Persoonsgegevens at autoriteitpersoonsgegevens.nl. For users in India with concerns related to NABL-accredited activities, you may contact the National Accreditation Board for Testing and Calibration Laboratories at nabl.qci.org.in, though we encourage you to first contact us directly to resolve any issues.
Appendix A: Data Processing Terms
Controller and Processor Roles
mLAB LIMS acts as a data processor when processing laboratory data on your behalf. You, the laboratory, act as a data controller for the samples and data you manage, including responsibilities under NABL accreditation. mLAB LIMS acts as a data controller for account information, billing data, and website analytics.
Sub-processors
We use the following sub-processors to deliver mLAB LIMS: Amazon Web Services (AWS) for cloud infrastructure located in various regions, Stripe for payment processing in the USA, SendGrid for email communications in the USA, Zendesk for customer support in the USA, and Google Analytics for website analytics in the USA. Each sub-processor is contractually obligated to comply with applicable data protection requirements and security standards necessary for supporting NABL-accredited laboratory operations.
This document is for informational purposes only and does not constitute legal advice. mLAB LIMS is a product of Mplus Systems. Users should consult with their legal and privacy advisors, as well as their NABL accreditation body, to ensure compliance with all applicable laws, regulations, and accreditation requirements.
Last reviewed for regulatory compliance including NABL requirements: February 24, 2026
Last updated: February 24, 2026