Privacy Policy

1. Who this applies to

LabTrack is an internal laboratory inventory management system used by authorized staff within the organization. It is not a public-facing consumer product and is not available for general signup — access is provisioned by an administrator.

2. What we collect

• Account data: username, department, role (user/admin), and a securely hashed password (bcrypt). Plaintext passwords are never stored.
• Activity data: every stock addition, usage, and quantity update is logged with the acting user's username, timestamp, and department, for audit and traceability purposes.
• Inventory data: reagent and consumable names, lot numbers, quantities, expiration dates, and unit information — laboratory operational data, not personal data about patients or the public.
• Session data: a session cookie identifying your logged-in user to the server. It is deleted when you log out or after 5 minutes of inactivity, and stops working after 12 hours regardless. See Cookies and browser storage for details.
• Camera access: if you use the QR/barcode scanner, your browser requests temporary access to your device camera. Frames are decoded entirely in your browser to read the code; nothing is sent anywhere and nothing is stored as a file.

3. Third parties we share data with

We keep this list short and specific, rather than a generic "we may share data with partners" clause:

• Supabase (our database provider) stores all account, inventory, and activity-log data described above.
• Resend (our email provider) sends low-stock, out-of-stock and expired-item alerts. For each alert it receives the recipient addresses an administrator set for that department, plus each item's name, lot number, department, current quantity and, for expiry alerts, expiration date.
• Sentry (error monitoring) receives error reports and performance timings so problems can be found and fixed. Reports about a failed login or a blocked action include the username involved. It does not record your screen or sessions.

We do not sell data, and we do not use it for advertising.

5. How long we keep it

Account and inventory data is retained for as long as your organization uses LabTrack. Activity logs are kept indefinitely for audit purposes, consistent with standard laboratory record-keeping practice. An administrator can remove a user account at any time; this does not retroactively delete that user's historical activity-log entries, since those form part of the inventory audit trail.

6. Security measures

• Passwords are hashed with bcrypt; we cannot see or recover your plaintext password.
• All traffic is served over HTTPS, with HSTS enforced.
• Sessions use HttpOnly, Secure cookies and expire automatically after inactivity.
• Admin-only actions are verified server-side against your session, never trusted from the client alone.
• A Content-Security-Policy and related browser security headers are enforced to reduce the risk of cross-site scripting and clickjacking.

7. Your choices

Camera-based QR/barcode scanning is entirely optional — every workflow in LabTrack that uses it also supports manual search/entry instead. You can decline camera permission in your browser and continue using the app normally.

8. Questions

For questions about this policy or your data, contact your LabTrack administrator or the person who provisioned your account.