Information follows the work you ask us to do.
This privacy statement applies to the public website, enquiry process and signed-in Lab Excellence platform. The information involved depends on whether you are exploring a service, administering an account or using an operational workspace.
A client organisation may also control information entered by its authorised users. In that situation, the client's internal notices, access decisions and contractual terms may apply alongside this statement.
Three contexts, with different data needs.
Project and contact details
Name, organisation, work contact details, project location, laboratory profile, site and asset scale, timing, service interests and anything you choose to add to the brief.
Identity and access data
Name, email, account status, assigned roles, organisation memberships, session records and authentication events needed to provide and secure portal access.
Workspace records
Asset, facility, maintenance, inspection, service request and document information, including the people associated with recorded actions.
Technical context
User-agent information, session activity and keyed hashes derived from IP addresses may be retained to limit abuse, investigate events and protect accounts.
We use information to deliver, protect and improve the service.
- Respond to an enquiry and prepare a relevant scope or proposal.
- Create and administer accounts, invitations, roles and organisation access.
- Operate laboratory workflows and display the records users are authorised to access.
- Store documents, maintain audit context and investigate reliability or security issues.
- Meet contractual, accounting, dispute-resolution and legal requirements where they apply.
We do not need ownership of client operational content to provide the service. Any broader use, data migration or project-specific processing should be addressed in the agreed scope.
The portal uses an essential session cookie.
When you sign in, the platform sets a secure session cookie so it can recognise your authenticated session. It is marked Secure, HttpOnly and SameSite=Lax. Blocking or deleting it will prevent or end signed-in access.
Requests to the service may also generate infrastructure and application records needed for delivery, diagnostics and abuse prevention. IP addresses used for authentication context are converted to keyed hashes when the required security secret is configured; the hash supports comparison without retaining the plain address in that record.
The public homepage and enquiry page also create a first-party anonymous visit record so Lab Excellence can understand visit volume, whether the enquiry page was viewed and the approximate time spent on those pages. It uses a random browser visit identifier and does not store a visitor's name, email address or IP address.
Access is limited by role, purpose and service need.
Information may be accessible to authorised people within the relevant client organisation, authorised Lab Excellence personnel, and infrastructure or professional service providers involved in operating or supporting the service. It may also be disclosed where required by law or with appropriate authority.
The platform uses third-party infrastructure. Unless a written agreement expressly says otherwise, do not assume that information is stored or processed only in Australia. Project-specific residency, transfer or subcontractor requirements should be raised before engagement.
Retained for need, contract and law—not by default forever.
Retention depends on the type of record, the client agreement, active service needs, security and dispute requirements, and any applicable legal obligation. When information is no longer needed, the appropriate outcome may be deletion, secure destruction or de-identification, subject to technical and contractual constraints.
Clients are responsible for setting appropriate operational record periods and telling us about laboratory-specific obligations. Backups and immutable records may follow a controlled expiry process rather than immediate deletion.
The OAIC's external APP 11 guidance explains reasonable technical and organisational steps, including destruction or de-identification when information is no longer needed, for entities to which that principle applies. The appropriate legal position depends on the circumstances.
Ask, correct or raise a concern.
You can use the enquiry form to ask what personal information we hold about you, request a correction or deletion, withdraw an enquiry, or raise a privacy concern. Rights and available outcomes depend on the circumstances, applicable Australian law and any client organisation that controls the relevant workspace.
We may need to verify your identity and authority before acting. If another organisation controls the information, we may direct the request to that organisation or work with it to respond.
Start a privacy conversation.
Choose the privacy or governance context in your brief and avoid including sensitive data in the first message.