This document is written in plain English. If anything is unclear, contact [email protected].
In short: Our website sets no cookies and runs no analytics or adverts. We collect only what we need to run accounts, answer messages, send the newsletter you ask for and record donations, and we never sell or mine data. Patient and laboratory data belongs to each laboratory: for that data we act only on the laboratory's instructions. Our servers are in Germany. Contact [email protected] about anything on this page.
Version 1.0. Effective date: 13 October 2026.
Evaluation period
VipLIMS is currently an evaluation service. Laboratories must not enter personal data about real patients until we announce the end of the evaluation period. The rest of this policy applies in full to the personal data we do handle now, such as account, contact and newsletter details.
1. Who we are
1.1 VipLIMS is operated by Visiopath Ltd, a company registered in England and Wales under company number 12096339, at 5 East Close, London W5 3HE, United Kingdom ("we", "us"). For the personal data described in sections 3 to 7, we are the controller under the UK GDPR, the Data Protection Act 2018 and, for people in the European Economic Area, the EU GDPR.
1.2 For data protection questions, or to exercise your rights, email [email protected]. You can also write to us at the address above or call 0800 111 4606.
2. Our two roles
| Data | Our role | Who decides how it is used |
|---|---|---|
| Patient, case, specimen, report and user data entered by a laboratory | Processor | The laboratory, as controller |
| Website request data, account holders' contact and sign-in details, contact messages, newsletter subscriptions, donation records, paid-service contacts, security reports | Controller | Visiopath Ltd |
2.1 If your data is held by a laboratory that uses VipLIMS
If you are a patient, or a clinician named in a request, your laboratory decides what data is recorded and why, and its own privacy notice applies. We process that data only on the laboratory's documented instructions, under our Data processing agreement. Please contact the laboratory to exercise your rights. If you contact us instead, we will pass your request to the laboratory where we can identify it, and help the laboratory to respond.
3. What we collect
3.1 Website visitors
Our website at viplims.com sets no cookies and loads no analytics, advertising or other third-party scripts. See our Cookie policy. To deliver pages and protect the service against attacks, our servers and our network provider, Cloudflare, process your IP address and basic request details (such as the page requested, browser type and time).
3.2 Account holders and users
When a laboratory signs up, or a user is invited, we collect:
- name, work email address and organisation name;
- country and laboratory type;
- password, stored only as an argon2id hash and never in readable form;
- two-step verification settings and, if you choose "remember this device", a record of that device;
- role, job title, qualifications and professional registration number, if the laboratory records them;
- sign-in records and security events, including IP address and browser details.
3.3 Contact messages
When you use our contact form or email us, we collect your name, email address, organisation if you give it, the topic and your message. To limit abuse, we store a keyed one-way code derived from your IP address, not the IP address itself. Please do not include patient data in messages.
3.4 Newsletter subscribers
If you sign up for our newsletter, we collect your email address and record when you confirmed it. We send nothing until you confirm by following the link in our confirmation email. Every newsletter contains an unsubscribe link.
3.5 Donors and supporters
Donations are taken on Stripe's or PayPal's own hosted pages. We never see or store your card or bank details. When you click a donation button, we count the click (provider, amount, currency and frequency) without recording your IP address, any cookie or who you are. After a donation, the provider gives us a record of it in our account with them: your name, email address, amount, currency, date, whether it is recurring and the provider's reference. If you agree to appear on our public supporter list, we also hold the name or logo you choose to show.
Stripe and PayPal act as independent controllers for the payment data they collect, and their own privacy notices apply.
3.6 Paid services and suppliers
If your organisation buys a paid service, we hold contact and billing details for the people we deal with, together with invoices and contract records.
3.7 Security researchers
If you report a vulnerability, we keep your name or alias, contact details and report so that we can investigate, reply and credit you if you wish.
4. Why we use it and our lawful bases
| Purpose | Lawful basis (Article 6 UK GDPR and EU GDPR) |
|---|---|
| Creating and running accounts; sending service emails such as verification links, sign-in codes and security notices | Contract with the laboratory; and our legitimate interest in providing the service to its users |
| Keeping VipLIMS secure: sign-in records, rate limits, attack protection, fraud prevention | Legitimate interests in protecting the service and its users' data |
| Telling administrators about important changes, such as changes to terms or sub-processors | Contract; and legitimate interests |
| Replying to contact messages | Legitimate interests in responding to enquiries |
| Sending the newsletter | Consent, which you can withdraw at any time |
| Recording donations, accounting and tax | Legal obligation; and legitimate interests in managing and thanking supporters |
| Showing your name or logo on the supporter list | Consent, which you can withdraw at any time |
| Paid services | Contract; and legal obligation for invoices |
| Handling vulnerability reports | Legitimate interests in keeping the service secure |
| Establishing, exercising or defending legal claims | Legitimate interests |
As controller, we do not intend to process special category data. If you include health information in a message to us, we use it only to deal with your message.
We do not use personal data for advertising or profiling, and we make no decisions based solely on automated processing that have legal or similarly significant effects on you.
5. Who we share it with
5.1 We share personal data only with:
- the service providers we use to run VipLIMS, listed on our Sub-processor list, under contracts that require them to protect it;
- Stripe and PayPal, when you choose to donate through them;
- our professional advisers, such as lawyers and accountants, under a duty of confidentiality;
- regulators, courts, law enforcement or other public authorities, where the law requires it;
- a buyer or successor, if VipLIMS or Visiopath Ltd is sold or reorganised, under the same protections.
5.2 We do not sell, rent, trade or mine personal data.
6. International transfers
6.1 Our servers and backups are hosted by Hetzner Online GmbH in Germany, in the European Union. The UK has adequacy regulations for the European Economic Area, so data can flow between the UK and Germany without extra safeguards.
6.2 Some providers process data outside the UK and EEA: Cloudflare (a global network, headquartered in the United States) and Google (which we currently use to send service emails). Where this happens, we rely on the EU Standard Contractual Clauses together with the UK International Data Transfer Addendum, or on the UK International Data Transfer Agreement, and where available on the EU–US Data Privacy Framework and its UK Extension, together with the providers' additional security measures. You can ask us for a copy of the relevant safeguards at [email protected].
7. How long we keep it
| Data | How long |
|---|---|
| Account holder and user details | While the account is open. When a laboratory closes its account, accounts that belonged only to that laboratory are anonymised at the end of the 30-day closure period |
| Sign-ups that are never confirmed | Password hash and sign-up link deleted 7 days after the link expires |
| Server and network security logs | Up to 90 days, unless needed longer to investigate a specific incident |
| Contact messages | 2 years after our last exchange with you |
| Newsletter subscriptions | Until you unsubscribe. We then keep only your email address on a suppression list so that we do not email you again |
| Donation records and accounting records | 6 years after the end of the financial year they relate to, as required for tax and company law |
| Supporter list entries | Until you withdraw your consent |
| Paid-service contracts and invoices | 6 years after the contract ends |
| Vulnerability reports | 3 years after the issue is closed |
| Encrypted backups | Deleted automatically as they reach the end of a rotation of 14 daily, 8 weekly and the 5 most recent pre-release copies |
8. How we protect it
Your connection to VipLIMS is encrypted with TLS 1.2 or higher. Patient identifiers, clinical details, report bodies, messages and uploaded files are encrypted at rest with AES-256-GCM. Every user must use two-step verification. Each laboratory's data is separated at database level by row-level security. Backups are encrypted. Read more on our Trust page.
9. Your rights
9.1 Under UK and EU data protection law you have the right to:
- be informed about how your data is used (this policy);
- access the personal data we hold about you;
- have inaccurate data corrected;
- have data erased, where there is no good reason for us to keep it;
- restrict how we use your data in some circumstances;
- object to processing based on legitimate interests, and to direct marketing at any time;
- receive data you gave us in a portable format, where processing is based on consent or contract;
- withdraw consent at any time, where we rely on consent, without affecting earlier processing.
9.2 To exercise a right, email [email protected]. It is free. We will respond within one month, which the law allows us to extend by up to two further months for complex requests; we will tell you if we need to. We may ask you to confirm your identity first.
10. Complaints
10.1 If you are unhappy with how we have handled your data, please tell us first at [email protected]. We will acknowledge your complaint within 30 days and respond without undue delay.
10.2 You also have the right to complain to the UK supervisory authority, the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, telephone 0303 123 1113, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. If you are in the European Economic Area, you can complain to the data protection authority in the country where you live or work.
11. Children
VipLIMS is a professional service and is not directed at children. Laboratories may record data about patients of any age; the laboratory is the controller of that data.
12. Changes to this policy
We will update this policy when our processing changes, and change the version number and date at the top. We announce significant changes in the changelog and, where they affect account holders, by email to laboratory administrators.