This document is written in plain English. If anything is unclear, contact [email protected].
In short: We use three providers to host and deliver VipLIMS. Laboratory data is stored on servers in Germany. We give at least 30 days' notice before adding or replacing a provider that processes laboratory data, and you can object.
Version 1.0. Effective date: 13 October 2026.
1. What a sub-processor is
When a laboratory uses VipLIMS, it is the controller of its patient and laboratory data, and Visiopath Ltd is its processor. A sub-processor is a third party we engage to help us process that data. Under our Data processing agreement, each sub-processor must be bound by data protection obligations no less protective than ours, and we remain responsible for them.
2. Current sub-processors
| Name | Purpose | Location | Data processed | Transfer safeguard |
|---|---|---|---|---|
| Hetzner Online GmbH | Servers, database and file storage, encrypted backups | Data centres in Germany (EU) | All laboratory data, encrypted at rest as described on our Trust page | None needed within the EEA; UK adequacy regulations for UK laboratories |
| Cloudflare, Inc. | DNS, TLS, content delivery and attack protection | Global network; traffic passes through Cloudflare's data centre nearest the user | Data in transit between users and VipLIMS, including IP addresses and request details | EU Standard Contractual Clauses with the UK International Data Transfer Addendum, or the UK IDTA; EU–US Data Privacy Framework and UK Extension where applicable |
| Google LLC | Sending service emails, such as verification links, sign-in codes and notifications (interim arrangement) | Global infrastructure, including the United States | Recipient names and email addresses, and the content of service emails | EU Standard Contractual Clauses with the UK International Data Transfer Addendum, or the UK IDTA; EU–US Data Privacy Framework and UK Extension where applicable |
Service emails never contain patient identifiers or report text. They carry at most a case number and a link to sign in to VipLIMS.
We intend to replace Google with a dedicated email delivery provider. We will announce that change with the notice described in section 4.
3. Donation providers
Stripe and PayPal process donations made through their own hosted pages. They have no access to laboratory data and do not process it on our behalf. For donors' payment data they act as independent controllers under their own privacy notices, so they are not sub-processors. VipLIMS never sees card or bank details.
| Name | Purpose | Role |
|---|---|---|
| Stripe | One-off and recurring donations | Independent controller for payment data |
| PayPal | One-off and recurring donations | Independent controller for payment data |
4. How we tell you about changes
4.1 We will give at least 30 days' notice before adding or replacing a sub-processor that processes laboratory data. We will:
- update this page with the new provider and the date the change takes effect;
- announce the change in the changelog;
- email every laboratory administrator.
4.2 If you have a reasonable data protection objection, write to [email protected] within the notice period. We will discuss it with you in good faith. If we cannot resolve it, you can export your data and close your account before the change takes effect.
4.3 In an emergency, for example if a provider suddenly stops operating, we may need to replace it with less notice. If that happens, we will tell you as soon as possible and explain why.
5. Questions
For a copy of a sub-processor's data protection terms, or any other question about this list, email [email protected].