Exact LIMSExact LIMS

Privacy Policy

Last Updated: July 6, 2026

1. Introduction

Exact LIMS is a secure, multi-tenant Laboratory Information Management System (LIMS) designed for analytical, diagnostic, clinical, and quality control laboratories. We are committed to protecting the privacy and security of all laboratory data, user credentials, patient records, and testing results processed through our platform.

2. Scope

This Privacy Policy applies to the Exact LIMS software platform, including our database systems, REST API, platform-wide super-admin console, and tenant-scoped workspaces. It describes how we collect, store, transmit, and protect data on behalf of licensed laboratories (“Tenants”) who utilize our services to manage their operations, workflows, and diagnostics.

3. Information We Collect

We act as a data processor for laboratory-managed information. In the course of operation, our database stores:

  • Laboratory Profile & Settings: Legal name, brand prefix, business category (e.g. food, water, pharma), contact information, tax registry numbers (GST/PAN), NABL license numbers, and custom workflow policies.
  • User Accounts & Credentials: Names, work emails, and cryptographically hashed passwords (`passwordHash`) generated using `bcryptjs`. We do not store plaintext passwords.
  • Patient & Client Information (Customer): Details of diagnostic patients, corporate clients, or B2B accounts, including titles, full names, email addresses, phone numbers, genders, dates of birth (DOB), and billing addresses.
  • Sample & Test Information: Sample records containing per-lab sequence numbers, collection and receipt timestamps (`receivedAt`), tracking status (`PENDING`, `INPROGRESS`, `COMPLETED`), referring doctor names, barcode codes, parameters, and invoice records.
  • Diagnostic Reports & File Uploads: Dynamic pathological/testing reports created using `ResultTemplate` layouts, certificates, calibration documents, and attachments (`Media` table) uploaded directly to our cloud object storage.

4. Role-Based Access Control (RBAC)

Exact LIMS isolates and protects data using a strict Role-Based Access Control (RBAC) framework. Data is only accessible to users with active memberships who hold the correct permissions for their role (e.g., `LAB_ADMIN`, `HOD_REVIEWER`, `TECHNICIAN`, `FRONT_DESK`, `ACCOUNTANT`, `READ_ONLY`). We enforce tenant isolation at the database and middleware layers, ensuring users cannot view or mutate data belonging to other laboratories.

5. Cookies & Session Management

Our application does not use tracking cookies for marketing or advertising. We use security cookies solely to maintain secure user sessions:

  • el_access: A cryptographically signed HTTP-only JWT containing user identity and scoped permissions, used to authenticate request handlers.
  • el_refresh: A secure cookie containing cryptographic tokens to renew sessions automatically.
  • el_impersonating: A client-readable flag used exclusively to alert super-admins that they are in an active customer support impersonation session.

6. Security & Compliance

We implement industry-standard security protocols to protect sensitive data:

  • Encryption: All data in transit is encrypted using SSL/TLS protocols. Password hashing is enforced using `bcryptjs` with salt factors. JWTs are signed with a server-level JWT_SECRET.
  • Controlled Document Lifecycle: Tech procedures, SOPs, and methods require explicit user read-acknowledgement logs.
  • 21 CFR Part 11 Audit Trail: The platform maintains an append-only, immutable `AuditLog` database table tracking all mutations, including before/after values, user names, and cryptographic verification hashes. Sign-offs and critical workflow changes require dynamic electronic password confirmations.
  • Cloud Storage Isolation: Uploaded attachments and media are isolated in bucket paths and served via secure cloud storage presigned URLs.

7. Data Storage & Retention

Exact LIMS data is stored in secure, high-availability databases located in Indian hosting centers. Tenants own their database records. Personal and diagnostic information is retained as long as the tenant laboratory maintaining the account requires it for compliance and diagnostic history. Account deletion and records removal must be requested directly through your laboratory administrator.

8. Third-Party Services

Our application integrates with the following third-party infrastructure providers to run operational features:

  • SMTP Email: NodeMailer is utilized to dispatch user invitations, role updates, and system notices.
  • Cloudflare R2: Used as our secure, S3-compatible cloud storage provider for report templates and media attachments.

9. Regulatory Compliance

Exact LIMS provides configurable tools to assist laboratories in maintaining compliance with international laboratory standards (ISO 17025, NABL), pharma regulations (FDA 21 CFR Part 11 electronic records), and local privacy regulations including the Indian Information Technology Act (IT Act 2000) and the Digital Personal Data Protection Act (DPDP 2023).

10. Changes to this Policy

We reserve the right to modify this Privacy Policy to reflect updates in security standards or code implementations. Users and Tenant administrators will be notified of material changes.

11. Contact Information

If you have questions regarding this Privacy Policy, please contact our support team at info@quickintsolutions.com.