Data protection terms

Last updated 21 October 2026. Labsite is operated by LabCanvas.

These terms form part of the Terms of Service and apply when a lab’s website includes personal data — for example names, photos, emails and biographies of lab members, or applications sent through its application form. For that data the lab (the site owner, or the institution it belongs to) is the controller (“data fiduciary” under India’s DPDP Act), and LabCanvas is its processor. They meet Article 28 of the GDPR and UK GDPR and the DPDP Act’s requirements for processors. No signature is needed; if your institution needs a signed copy, contact the contact address on this page (being set up; until then, write to us from your dashboard account email).

The lab’s responsibilities

• Only publish personal data you are allowed to, with the person’s agreement or another lawful basis, and keep it accurate.
• Update or remove someone’s details when they ask (any editor can do this in the dashboard).
• Give people on your site a way to contact the lab (the Contact page does this).

Our commitments as processor

1. We process the lab’s personal data only to host, display, back up and support its website, and to follow the lab’s documented instructions (the settings and content in its dashboard).
2. Everyone at LabCanvas with access is bound by confidentiality.
3. We keep appropriate security measures: encryption in transit and at rest, isolation of each lab’s data, hashed passwords, rate-limited sign-in, least-privilege access and regular updates.
4. We use the sub-processors listed in our Privacy Policy, under written terms with the same protections. We will announce new sub-processors on that page at least 30 days before using them; the lab may object and, if we can’t address the objection, cancel with a pro-rata refund.
5. We help the lab respond to requests from people exercising their rights, mostly through self-service in the dashboard, and with security, breach notification and impact assessments.
6. We notify the lab without undue delay, and within 48 hours of becoming aware, of a personal-data breach affecting its site.
7. When the lab deletes its site or account, we delete its personal data from live systems at once and from backups within 30 days, after the lab has had the chance to download it (Download everything).
8. We make available the information needed to show compliance and allow reasonable audits, normally by answering questionnaires and providing documentation.
9. Transfers outside the EU, UK or India rely on the legally required safeguards, including the European Commission’s Standard Contractual Clauses (Module 3, processor to processor) with our sub-processors.

Details of the processing