How your study records are stored, shared and protected.

LabRuns saves each study's measurements, settings, limits, mapped import columns, calculations and reports. Use de-identified results with coded specimen IDs, and keep the key that links codes to patients inside your laboratory. Read the permitted data terms for details.

The import dialog reads the whole uploaded file. LabRuns clears that upload when the import succeeds, or after one hour if it does not. It keeps only the columns you mapped for the study. If the specimen ID column is headed as an accession or order number, you choose how to handle those IDs. The default replaces them with study codes. Download the code key once, immediately after saving. LabRuns does not store the key.

Everyone signs in with a single-use code sent to their email. Institution administrators assign plan membership. Each member can create a private workspace and invite current members of the same plan. Workspace Owners and Administrators assign roles. Editors set up and run studies. Viewers can read and download reports and sign them off. LabRuns checks current institutional membership and workspace permission on every request. The database returns records only from the workspace that the request belongs to. An Owner can transfer ownership to a current Administrator.

In Settings, Owners and Administrators can look through the workspace's activity: membership changes, administrative actions, exports and Trash. Under Account, you can see your recent sign-ins and sign out of all devices at once. A session lasts up to seven days.

Saved revisions, calculations, signed reports and their stored PDFs cannot be edited. A correction creates a new version. History shows each original value next to its correction and records every exclusion reason. Each sign-off records the signer's account email and, if provided, their name. LabRuns checks SHA-256 hashes when saved content is opened, exported or restored to detect any change.

LabRuns and its database run in US East (Virginia), and imports, calculations, reports and backups are stored only in the United States. Infrastructure providers host the application and its database, secure the public connections, and store the private backups and the continuous database archive. Your browser connects over HTTPS, the private network between the application and the database is encrypted, and the database and backups are encrypted at rest. Study data stays inside LabRuns' hosting and backup systems.

The operator may access records for support, maintenance, security or recovery, and each time that happens a private log notes the date, the reason and the workspace involved.

LabRuns archives the database continuously for recovery to a recent point in time. It also makes a daily backup and keeps the latest 14 verified copies. To verify a copy, LabRuns downloads it from private storage, checks its file hash and restores it into a separate database. It then opens the saved records and checks their hashes. When a release changes the database schema, LabRuns keeps verified copies for both the previous and the new schema.

The recovery instructions and verified restore evidence are available for your review.

Every five minutes, an independent monitor checks that the service is healthy, that PDFs print, that backups are on time and that there is capacity left to send sign-in emails. It emails the operator after consecutive service failures, when a backup is late, or when sign-in email use reaches 80% of its allowance. The public status responses it reads contain no counts, keys, addresses or workspace data.

The institution retains its license, workspaces and saved laboratory records when an employee leaves. Removing someone's institutional membership ends their online access to its workspaces. A private workspace is visible to its creator and invited current members. An institution administrator can transfer it to another current member. Its history records the recipient and reason.

An institution can appoint several administrators so someone can manage access and billing when another is away. If no administrator can sign in, email hello@labruns.com. LabRuns verifies the institutional request and the replacement's sign-in email, then records the recovery. The workspace recovery guide describes the steps.

Owners and Administrators can download the workspace's records from Settings → Storage and records as one ZIP. Along with the study data, saved calculations, reports and stored PDFs, it holds the QC workups, analyzer profiles, schedules, lot and shipment events, panel comparisons, binders, imports and history, a copy of the database, file checksums and record counts. The export guide lists everything in it.

Projects and studies moved to Trash stay there for 30 days, and an Owner or Administrator can empty it sooner. Deleting a personal account leaves the institution's saved workspace records and subscription in place. Deleted records stay in the backup copies until those copies rotate out.

We may update LabRuns, change features or suspend access for maintenance, security or operational reasons. Before any planned permanent closure, every account holder gets at least 30 days' notice by email, which leaves time to download your records. The Terms of Service set this out.

If you spot a security problem, email security@labruns.com. We investigate every report. If we confirm unauthorized access, we promptly notify the affected workspace owners and account holders and tell them what happened, what was affected and how we are responding. We also meet any legal notice duties that apply.