Last updated: 22 September 2026
1. Who processes whose data
Labmetra runs in two forms. On the hosted edition (the server operated by Labmetra), the organization that opened the account on the laboratory's behalf is the controller of the account data and the laboratory's records; the operator of Labmetra acts as a processor on its behalf. In a laboratory's own installation (self-hosted) every byte stays on the laboratory's infrastructure; the operator of Labmetra has no access and is not a processor.
This notice describes what the software collects in either form; a self-hosting laboratory completes it with its own institutional notice.
2. What is processed
Account data: full name, e-mail address, role (administrator, researcher, technician, student), the laboratory you belong to, sign-in times.
Laboratory records: samples, tests, heat treatments, micrographs, stock, instruments, documents, reports and the files attached to them. The only personal data in these records is the name of the person who acted and when (chain of custody, audit trail), which ISO/IEC 17025 requires.
Technical data: request time, IP address and browser type in server logs; error records. These logs are deleted within 30 days.
Assistant: the questions you ask about a record and the answers are kept in your laboratory's record. In the default installation answers come from a language model running on your server and nothing leaves it. If an administrator opts into an external provider (Anthropic), the text you ask and the record shown are sent to that provider; the option says so where it is switched on.
3. Cookies and browser storage
Labmetra uses only the cookies it needs to work: the session cookies (starting sb-…, which carry your identity) and the labmetra-remember cookie holding your "remember me" choice. There are no advertising, tracking or third-party analytics cookies, so no cookie banner is shown.
The browser's local storage keeps your language and theme, and — if you choose — the e-mail address to put back in the login form. None of it is sent to the server.
4. Purpose and legal basis
Account and record data are processed to provide the service, on the basis of the contract (KVKK art. 5/2-c, GDPR art. 6(1)(b)). The audit trail and chain of custody are kept under the laboratory's legal obligation and legitimate interest (KVKK art. 5/2-ç and f, GDPR art. 6(1)(c) and (f)). Technical logs are processed for the security of the service, a legitimate interest. Nothing is processed on the basis of consent.
5. Retention and deletion
Account data is kept while the account is open. When a member leaves, the administrator anonymises that person's name in the records under Settings → Privacy; the records themselves remain, as the laboratory's record-keeping duties require. The administrator can export the laboratory's entire data, machine-readable, from the same page.
On the hosted edition, a closed laboratory account is deleted within 30 days; removal from backups may take up to 90 days.
6. Transfers and sub-processors
On the hosted edition the database, authentication and file storage run on Supabase infrastructure inside the European Union (Ireland). There is no other sub-processor. A self-hosting laboratory chooses its own infrastructure.
Data is not sold, not shared for advertising, and not passed to third parties except where the law requires.
7. Security
Each laboratory's data is separated from every other's at the database level (row-level security); every table feeds the audit trail; connections are encrypted with TLS; passwords are stored only as hashes; files sit in private, per-laboratory storage.
8. Your rights
Under KVKK art. 11 and GDPR arts. 15-22 you may access your data, have it corrected or deleted, restrict or object to its processing, and receive it in a portable form. Address requests first to your laboratory's administrator and, on the hosted edition, also to the contact below. Requests are answered within 30 days. You may also complain to the Personal Data Protection Authority.
9. Changes
When this notice changes the date is updated and material changes are announced at sign-in.
Contact address: not yet stated by the operator of this installation (NEXT_PUBLIC_LEGAL_CONTACT).