Legal documents

Seven documents, each one written rather than assembled.

A legal page that could belong to any product tells you nothing about this one. These say what LabFlow handles, who is responsible for it, how long it is kept, which companies see it, and what has not been done yet.

Open the documents Delete your data

The setseven documents

Documents7

Last reviewed6 August 2026, all seven

Written byThe LabFlow team, not a template

Law firm reviewNone. This is not legal advice

The HIPAA wordConscious, never compliant

Named processors5

Every document is on this page. Choosing one changes the address bar, so the link you copy is the link to that document.

Terms of service

The same agreement, at the second address it is indexed under.

Last reviewed2026-08-06

Canonical/terms

URL/terms-of-service

DifferencesNone

There is only ever one agreement. If you have arrived here from a search result or an old link, you have the right document.

Why two addresses exist at all. They were both published years ago, both were crawled, and both accumulated inbound links. The rebuild keeps them because a live URL that has been indexed is a promise to whoever linked to it. What it will not do is let them hold different text: one component renders both, so a change to the agreement reaches both addresses in the same deployment or neither.

Four things no document on this page can do for you.

Legal pages are usually written to close questions. These are here to open the four that a careful buyer should ask next, because a page that leaves you feeling reassured has probably done you a disservice.

They are not legal advice, and no lawyer has read them

They are written to be accurate rather than to be defensible. Your counsel should read the terms and the HIPAA statement and expect to negotiate.

They are not a contract you can rely on for production

The governing-law clause is open and there is no business associate agreement. Both are named in the documents rather than left for you to discover.

They cannot describe your laboratory's obligations

Risk analysis, training, access review, physical safeguards and a tested contingency plan stay yours whichever system you run.

They are not evidence that any of it is implemented

A document describing a safeguard reads exactly like a document describing an intention. Ask to see the audit trail and ask to be refused a tenant that is not yours.

One page owns each fact, and the rest point at it.

Seven documents that each state a retention window are seven chances for six of them to be out of date. So each fact has a single home, and everywhere else is a link.

Retention

The four windows, and what each is anchored to

Results and reports, pathology material, the audit trail, specimen movement. The numbers live in one place and every other mention links to it.

Owned by /data-deletion

Processors

Which companies see anything, and what each receives

Four named, with the specific thing each one gets. The cookies page describes what reaches your browser; this describes what reaches somebody else's server.

Owned by /privacy-policy, clause 03

Measurement

What analytics receives, and the commitment about session replay

Deliberately stated in identical words on two pages, so that changing one without the other is visible rather than quiet.

Stated twice: privacy clause 05, cookies clause 04

Permissions

Every Android permission, with the four-way agreement rule

The manifest, this page, the privacy policy and the store declaration must say the same thing before a build is released.

Owned by /app-permissions

Gaps

What is missing, listed rather than omitted

No business associate agreement, no external audit, no penetration test, no tested restore, no governing-law clause, no availability commitment.

HIPAA clause 04, security clause 11

If a clause is wrong, that is worth an email.

These were written by the team that built the product, which makes them accurate about the software and untested as law. A correction, a challenge, or a question about how a specific safeguard actually works will be answered by a person who can check the code rather than by somebody reading from the same page you are.

Ask about a clause Delete your data

Revision historypublished

All seven documents were rewritten in one pass on 6 August 2026. Every future revision is dated and published as an entry in the feed, so a change to a policy is something you can subscribe to.

See document revisions