Data processing agreement

What we do with personal data on your laboratory's behalf, what we do with it for our own purposes, and the difference between the two.

Last updated 2026-08-07

Version 2026-08-11. This version has its own address and will not be edited in place — a contract term that can be changed silently is not a term you agreed to. It forms part of the Terms of Service and applies to laboratories in the UAE, Malaysia and elsewhere outside India.

1. We are not simply your processor, and it matters

Most agreements like this one open by declaring the vendor a data processor acting only on the customer's instructions. We are not going to write that, because for part of what we hold it would be false.

AssetLab is free because it finds customers for CrelioHealth, a paid laboratory information system sold by the same company. We create a sales lead when you sign up and we score it from what your laboratory does in the product. That is our own purpose, not yours— and under Malaysia's Personal Data Protection Act a data processor is one who processes solely on behalf of the controller and not for any of his own purposes. So for that data we are the controller, and we say so.

The roles therefore split by dataset. Everything we hold falls into one of these two columns, and nothing sits outside the table:

Data	Our role	Why
Your instrument register, maintenance, calibration, QC, breakdowns, suppliers and spares	Processorfor your lab	Your lab decides what goes in and how long to keep it. We hold it and do what your lab's users tell us.
Your staff accounts — names, work emails, roles, phone numbers	Processorfor your lab	Your lab creates and removes these. We do not decide who works at your laboratory.
The audit trail	Processorfor your lab	It exists because your lab needs a traceable history for its own accreditation. We cannot edit it and neither can you.
Sign-in and password-reset throttling — email addresses and network addresses	Processorfor your lab	Security telemetry kept to protect your accounts. We use it for nothing else and it ages out on its own.
The sales lead record — contact name, work email, lab name, how you arrived	Controllerour own purpose	We decided to collect this, and we decided what it is for: finding laboratories that may want CrelioHealth. That is our own commercial purpose, not yours.
The behavioural score and the activity events behind it	Controllerour own purpose	We generate this from your lab's use of the product, for our own sales purposes. This is the reason we cannot describe ourselves as a processor across the board.
Which version of our home page a visitor was shown	Controllerour own purpose	Our own measurement of our own marketing. It holds a single letter and identifies nobody.

Where we are your processor, sections 2 to 9 apply and your laboratory decides what happens to the data. Where we are the controller, the privacy policy governs and the individual deals with us directly — including the right to stop it, which in this product stops the scoring and not merely the email.

2. What we do with data we process for you

Only what running the service requires, and only on the instructions your laboratory's own users give through the product. We do not read your breakdown notes, QC results or calibration certificates for our own purposes, we do not sell your records, and we do not use them to train anything.

We do count certain actions — that an instrument was added, that a register was exported — to produce the lead score described above. The count is of the action, not of its contents.

3. The people who can reach it

Access is limited to those in our team who need it to run or support the service, and they are bound to keep it confidential. Section 5 is specific about the one route that reaches further than you might assume.

4. Security, described as it actually is

What follows is what the software does, not a list of aspirations. Where a control is weaker than a reader might assume, it says so — a laboratory doing its own vendor due diligence is entitled to that, and finding out later is worse for both of us.

Measure	What it actually is
Tenant separation	Every table carrying your data has a lab identifier, and every query filters on it. That filter is in our application code, not in the database — all labs share one database file and SQLite has no row-level security, so there is no second net beneath us. We test for it; it depends on us writing every query correctly.
Credentials	Passwords are stored as scrypt hashes and are never recoverable. Password-reset links are stored hashed, expire in one hour, work once, and end every existing session when used. Sign-in and reset attempts are rate limited by email address and by network address.
Transport	HTTPS, with HTTP Strict Transport Security sent on every response. Security headers include X-Frame-Options, nosniff and a referrer policy. State-changing requests are checked against the origin they came from.
Access within our team	The internal sales console is disabled unless a key is set, and it exposes only the lead tables — not your equipment records. Be aware that the same key can issue a password-reset link for any account; that exists so a locked-out sole administrator can be helped, it requires a written note of how the caller's identity was confirmed, and that note is written into your lab's own audit trail where you will see it.
Backups	The database is snapshotted on a schedule using SQLite's own online backup, each snapshot is verified to open cleanly, and copies are retained for a set period then overwritten. This is disaster recovery for the service, not a per-customer restore service.
What we do not have	We hold no security certification. We are not ISO 27001 certified and we have not had a third-party penetration test or security audit. We do not currently log who inside our team viewed or exported a lead record, so after a hypothetical exposure there we could not reconstruct exactly who saw what. We would rather you knew that than discovered it.

5. Sub-processors

Others who process personal data on our behalf in order to run the service. We remain responsible to you for what they do.

Not yet named. Our hosting provider and outbound email provider will be listed here, with their country and what each receives, before the service opens. We are not going to list a provider we have not chosen — and you should not accept a sub-processor list that names nobody.

We will update this list before adding a new sub-processor, and the page carries the date of its current version so you can tell when it last changed.

6. Where the data sits

[PLACEHOLDER: hosting country — must be named, see note in the README]

On UAE health data.Federal Law No. 2 of 2019 restricts storing health data outside the UAE. Our position is that it does not reach what AssetLab holds: an instrument's service history, calibration certificate and maintenance schedule are operational records of a machine, not information about a patient. No part of this product asks for, stores or is designed for patient data.

What keeps that position true is the thing we ask of you: do not type patient names, identifiers or results into free-text fields. The terms say so, and if it happens we will remove it on request — including from the audit trail, where an ordinary correction does not reach. A record that never contains patient information is not health data; one that does is a different question, and the answer is to keep it out rather than to argue about it afterwards.

7. If there is a breach

We will tell your laboratory without undue delay and in any event within 24 hours of becoming aware of a personal data breach affecting data we process for you, with what we know at the time and updates as we learn more.

Twenty-four hours is deliberate rather than generous: where your laboratory has its own notification duty — Malaysia expects notification to the Commissioner as soon as practicable, and within 72 hours in the ordinary case — a slower promise from us would make yours impossible to keep. Our clock has to be shorter than yours.

We keep a written record of breaches and of what we did about them. Where we are the controller — the lead data — we notify the regulator and affected individuals ourselves.

8. When someone asks about their data

If an individual approaches us about data we process for your laboratory, we will not answer for you: we will pass the request to your administrators and help you respond within the time your law allows, which for access and correction under Malaysian law is 21 days.

Two exceptions where the person deals with us directly, because you have no way to help: anything about our own sales lead record, and anyone named in your records who never had an account here — an invited colleague who did not accept, or an external calibration engineer.

9. Return and deletion

An administrator can download everything at any time from Settings → Your data — one file, no row caps, built from the same list of tables a deletion sweeps, so what you take away and what we remove are the same set.

On request we delete the workspace and everything in it in a single transaction. Two honest limits: it cannot be undone, and data stays in database backups until those roll off, after which anything restored is re-deleted. Full detail on Your data & deletion.

Before we delete, we will ask whether you have exported. Your equipment records may be records your laboratory is required to retain for accreditation — deleting them here with no copy elsewhere may destroy evidence you need. We would rather be the awkward supplier who asked twice.

10. Checking up on us

Ask and we will answer questions about how we handle your data, in writing, including anything on this page you want expanded. We are a small team running a free product, so we cannot host on-site audits — if your own obligations require one, tell us before you commit to the product rather than after.

11. Contact

privacy@creliohealth.com

Terms · Privacy policy · Your data & deletion · Personal data notice (BM/EN)