Privacy Policy

Last updated: 25 October 2026

This Privacy Policy explains how Qbitlabs collects, uses, shares and protects personal data when you visit qibitlabs.com or use our laboratory information system (the “Services”). It is written in line with the Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000 and the rules made under them.

1. Scope and our role

For information about our customers and their staff — account, contact and billing details — Qbitlabs decides how it is used and acts as the Data Fiduciary.

For patient information that laboratories enter into the Services, the laboratory is the Data Fiduciary and Qbitlabs acts as its Data Processor, processing that data only on the laboratory’s instructions. Patients should direct requests about their data to the laboratory that tested them; we will help the laboratory respond.

2. Information we collect

Identity and contact data — name, email address, phone number and role of account holders and staff.
Laboratory data — laboratory name, address, registration details, logo, letterhead and signatures.
Billing data — plan, amount, date and transaction reference. Card, UPI and bank details are entered directly with our payment partner and are never seen or stored by us.
Patient and health data — patient details, test orders, results and reports entered by laboratories.
Technical data — IP address, browser and device type, login sessions and error logs.
Communications — messages you send to our support team.

3. How we collect information

Directly from you when you sign up, use the Services or contact us; automatically through cookies and logs when you use the website and application; and from connected services you choose to use, such as our payment partner and laboratory analyzers.

4. Legal basis for processing

We process personal data with your consent, to perform our contract with you, to comply with legal obligations such as tax and accounting rules, and for other legitimate uses permitted by the Digital Personal Data Protection Act, 2023.

5. How we use information

to provide, operate and maintain the Services, including generating and sharing reports;
to process payments and activate Subscriptions;
to send service messages such as verification codes, password resets and plan reminders;
to provide customer support;
to improve the Services, and to detect and prevent fraud and misuse;
to send product updates and offers, which you can opt out of at any time.

We do not use patient data for marketing.

6. Information security

We protect data with encryption in transit (HTTPS) and at rest, database-level isolation between laboratories, role-based access for staff within a laboratory, and regular backups. No system is completely secure, but we work continuously to protect the data entrusted to us.

7. Sharing with third parties

We do not sell personal data. We share it only with:

service providers that host, store, secure and deliver the Services (cloud hosting, database, email and messaging providers), under obligations to protect it;
our payment partner, to process payments;
recipients a laboratory chooses, such as patients or referring doctors to whom it sends reports;
government or law-enforcement authorities when required by law.

8. Data storage and international transfers

Some of our service providers may store or process data on servers outside India. Where this happens, we rely on providers that maintain strong security and contractual safeguards, and we comply with any transfer restrictions notified under Indian law.

9. Data retention

We keep account and laboratory data while the account is active, including while access is paused after a trial or Subscription ends, so that customers can resume without losing records. When a customer asks us to delete its data, we do so within 30 days, except records we must keep for legal, tax or accounting purposes.

10. Your rights

You may request access to, correction of, or erasure of your personal data, withdraw consent, nominate another person to exercise your rights, and raise a grievance. Write to adityakalmekh@qibitlabs.com. Many account details can also be edited directly in the application.

11. Cookies and tracking technologies

We use only the cookies needed to keep you signed in, remember your selected laboratory branch and protect the Services against misuse. We do not use advertising cookies. You can block cookies in your browser, but the application will not work without them.

12. Children’s privacy

The Services are meant for laboratories and their staff, not for anyone under 18. Where a laboratory enters health data of a child, it is responsible for obtaining verifiable consent from the child’s parent or lawful guardian.

13. Data breach notification

If a personal data breach occurs, we will inform affected customers without undue delay and notify the Data Protection Board of India, CERT-In and other authorities as required by law.

14. Updates to this policy

We may update this Privacy Policy. The date at the top of this page shows the current version. We will notify you of material changes in the application or by email.

15. Grievance officer and contact

For any question, request or complaint about your personal data, contact our Grievance Officer at adityakalmekh@qibitlabs.com. We acknowledge grievances within 48 hours and aim to resolve them within 30 days.