How LabHome DZ handles personal and health data

LabHome DZ helps patients in supported Algerian service zones request home laboratory services, upload prescriptions, receive quotes, schedule visits, and access laboratory results. The app also helps authorized field professionals manage assigned visits and complete sample collection workflows.

LabHome DZ is not an emergency service and does not replace medical advice from a qualified healthcare professional.

We collect the data needed to provide and secure the service:

• Account data, including name, phone number, email address if provided, language, role, and authentication information.
• Health data, including prescription files, selected laboratory tests, medical notes needed for service delivery, visit records, sample collection records, and laboratory results.
• Family member data for profiles added by the account holder.
• Precise location used to set patient address pins, verify service coverage, and confirm field professional check-in geofences during assigned visits.
• Photos and files, including prescription images and other uploaded files required for review or visit completion.
• Appointment and payment workflow data, including bookings, quotes, payment status, receipts, cancellation or reschedule history, and support records.
• Device and technical data, including device identifiers, Firebase installation identifiers, push notification tokens, logs, diagnostics, and security or audit events.

Payment card details are handled by the payment provider and are not stored directly by LabHome DZ.

• Create and manage user accounts.
• Authenticate users and prevent unauthorized access.
• Review prescriptions and prepare service quotes.
• Schedule, dispatch, and complete home laboratory visits.
• Verify coverage zones, address accuracy, and visit check-in location.
• Deliver notifications, appointment updates, and laboratory results.
• Provide support and resolve operational issues.
• Maintain audit logs, security controls, backups, and service reliability.
• Meet legal, regulatory, accounting, and medical-record retention obligations.

Health data is used only for healthcare service coordination, medical or laboratory review, sample collection, result delivery, support, audit, and legally required retention. Access is limited by role.

Patient medical content is available only to the patient, authorized medical reviewers, assigned field professionals when needed for a visit, and authorized operations staff for supervision.

The Android app uses foreground precise location while the app is in use. Patients can use location to set an address pin and check whether the address is in a supported service zone. Field professionals can use location to confirm check-in near an assigned visit location.

The current Android app does not request background location permission.

We share data only when needed to operate the service, comply with law, or protect users and the platform:

• Authorized laboratory partners and healthcare professionals receive information needed to review prescriptions, perform visits, and deliver results.
• Cloud, authentication, storage, notification, mapping, payment, and infrastructure providers process data on our behalf.
• Regulators, courts, law enforcement, or public authorities may receive data if legally required.
• Support and operations personnel may access records only according to their role and business need.

We do not sell personal data.

Data is encrypted in transit using HTTPS/TLS. Production systems must enforce access controls, role-based permissions, audit logging, backups, and operational monitoring. Sensitive records are protected with stricter access scoping.

We keep data only as long as needed for service delivery, support, security, accounting, medical-record, audit, and legal obligations. Medical records, laboratory records, and audit logs may need to be retained even after account deletion where applicable law requires it.

Current product requirements define medical-document retention as 5 years and operational or audit log retention as 10 years, pending final legal validation.

Users may request account deletion and deletion of associated personal data by emailing privacy@labhome.app or using the account deletion request link.

We will delete or anonymize eligible data, unless retention is required for medical, legal, accounting, security, fraud-prevention, or audit reasons. When we must retain data, we limit further use to the required purpose.

LabHome DZ is not directed to children. Adults may manage family member profiles when they have the legal right to do so.

Data may be processed by infrastructure and service providers in locations where they operate, unless the operator configures local hosting or data residency controls. The final production architecture and cross-border processing position must be validated against applicable Algerian data protection and healthcare requirements before launch.

For privacy questions, access requests, or deletion requests, contact privacy@labhome.app.

We may update this policy when the service, legal requirements, or data practices change.