Privacy & Data Notice

This notice explains how Sorus Labs — a diagnostics laboratory operating in Surat and across Gujarat, India — collects, uses, stores and shares personal data as an employer, for its own employees, and as a service provider, for visitors booking a home sample collection or a lab visit. It is written to meet the Digital Personal Data Protection Act, 2023 ("DPDP Act") and describes our practices as they actually are, not as a template.

For employees, we collect and process:

• Identity and contact details — name, date of birth, gender, phone, address, photo, emergency contact.
• Government identifiers — Aadhaar, PAN, and where applicable UAN/PF and ESI numbers, for statutory compliance and payroll.
• Bank details — account number and IFSC, to pay salary.
• Employment records — department, designation, compensation, attendance, leave, performance and disciplinary history.
• Health-surveillance and safety records — biohazard/needle-stick exposure incidents, post-exposure follow-up, and where relevant professional registration/council details for clinical staff.
• Attendance verification data — punch-in selfies and, where used, device/location information captured at the moment of a punch, to confirm a shift was actually worked at the stated place.
• Device and access logs — sign-in activity, for account security.

For patients (and visitors booking a home sample collection or a lab visit), we collect the name, age, gender, mobile number, email (optional), address and map location, and test details needed to schedule and carry out the collection, and the sample/report data generated by processing that sample. See the patient section below for how the mobile number, address lookups and reports are handled.

Added 1 October 2026

• Mobile verification. When you book or sign in to My reports, we send a 6-digit one-time code to your mobile number on WhatsApp through our messaging provider, Gallabox, which delivers it over Meta's WhatsApp Business platform. We store only a keyed hash of the code, never the code itself. A code expires after 10 minutes, works only once, and stops working after 5 wrong tries — you then ask for a new one.
• Abuse prevention. With each code request we record the mobile number, the time and the IP address it came from, to limit how many codes can be requested. These records are used only for that, and are regularly cleared out once they are 7 days old.
• Your patient account. A verified number becomes your account: we keep the number, the name and email you give us, when the account was opened and when you last signed in, so you can see your bookings and reports.
• Sign-in. Signing in sets one cookie on this site (sorus_patient). It is HTTP-only, so no script on the page can read it, and it keeps you signed in on that device for up to 30 days. You can sign out at any time, and “Sign out of all devices” ends every session opened with your number at once.
• Reports. Report PDFs are kept in private cloud storage (Cloudflare R2), never on a public link. You can download one only after you sign in with the mobile number the booking was made with, and only once the lab has released the report. Each download uses a link that expires after 120 seconds.
• Bookings made before verification. If a booking was made without the mobile number being verified by a code (for example, before verification was switched on), its report cannot be downloaded from My reports — the number was only typed, so we cannot be sure it is yours. Contact the lab for it.
• Address search and maps. To place your collection address on the map, the text you type in the address search — or your device's location, if you choose “Use my location” — is looked up with Google Maps and/or OpenStreetMap (Nominatim), and the chosen spot is shown on an embedded Google map. These services receive the search text or map coordinates, not your name or mobile number.
• Messages. We may message you on WhatsApp about your booking (for example, a confirmation or “your report is ready”). We do not send marketing messages without your consent.

We process this data to run payroll and statutory compliance (EPFO, ESIC, income tax), to manage attendance, leave and performance, to keep the workplace safe (biohazard/needle-stick incident recording and follow-up under NABL/ISO 15189 expectations), to verify identity for security and access, and to deliver diagnostic services booked by a visitor.

Our legal basis under the DPDP Act is, depending on the record: performance of the employment contract, compliance with a legal obligation (labour, tax and social-security law), and — for anything collected beyond what those require — your consent, which you may withdraw for that specific purpose without affecting the rest of the employment relationship.

Records are kept only as long as needed for the purpose collected, or as long as statutory and accreditation rules require — for example, payroll and statutory filings are commonly retained for the periods EPFO/ESIC/income-tax rules set, and safety/incident records are kept for the period NABL/ISO 15189 expects. Sorus Labs' specific retention schedule is maintained as retention rules inside the HR platform and is available to employees on request through HR.

For patients: code-request records (number, time, IP address) are cleared out once they are 7 days old. Your patient account is kept while you use it; you can ask us to close it at any time. Booking records and lab reports are kept for as long as medical-record and laboratory-accreditation (NABL/ISO 15189) rules require — when the lab replaces a report, the earlier file is kept too, as part of the lab's audit trail. Once that period ends they are deleted.

We do not sell personal data. It is shared only with:

• Infrastructure processors who host and run this platform on our behalf under a data-processing arrangement — currently Supabase (database), Cloudflare (network, and R2 private storage for report PDFs) and Vercel (hosting) — who act only on our instructions and do not use the data for their own purposes.
• Statutory and regulatory bodies where the law requires it — EPFO, ESIC, the Income Tax Department, and accreditation bodies such as NABL, for the records they are entitled to.
• Our WhatsApp messaging provider (Gallabox, over Meta's WhatsApp Business platform), only to deliver verification codes and booking/report messages to your number.
• Map services — Google Maps and OpenStreetMap (Nominatim) — which receive the address text or map coordinates you look up while booking, to find and show the collection location.
• The lab or partner processing a patient's sample, and the care team providing results or counselling.

Under the DPDP Act, you may:

• Access the personal data we hold about you.
• Ask us to correct inaccurate or incomplete data.
• Ask us to erase data we are no longer required to keep.
• Withdraw consent for any processing that relies on it.
• Raise a grievance about how your data has been handled, using the contact below.

An employee may also download a copy of the profile, leave and payslip data their own account can see, from "Download my data" on the My Profile page inside the HR console.

We use reasonable technical and organisational safeguards — encryption in transit, access restricted by role, and audit logging of platform actions — to protect this data. No method of transmission or storage is perfectly secure, and we review our practices on an ongoing basis.

Send any data-related grievance to contact@soruslabs.com or call +91 96388 38894. It is routed to the person responsible for data protection at Sorus Labs, who will respond to you.

Questions about this notice, or a request under any of the rights above, can be sent to contact@soruslabs.com or +91 96388 38894.