Unofficial English translation - the French version is legally binding under Swiss law.
LAB2LAB.CH PLATFORM
Version in force as of 29 July 2026
PREAMBLE
The company LABGENE SCIENTIFIC SA (hereinafter "LABGENE" or "the Data Controller") attaches paramount importance to the protection of the personality, privacy and fundamental rights of the users of the Lab2Lab.ch platform (hereinafter the "Platform").
This Privacy Policy describes the manner in which LABGENE collects, stores, uses, protects and transmits the personal data of natural and legal persons browsing the Platform or using its services, in accordance with the requirements of the new Swiss Federal Data Protection Act (nLPD) of 25 September 2020 (entered into force on 1 September 2023) [1469, 1572], as well as the Swiss Code of Obligations (CO) [420].
Any browsing of the Platform or use of its services (account creation, listing submissions, interest requests "Inquiries") implies knowledge and unreserved acceptance of this Privacy Policy.
ARTICLE 1. DEFINITIONS AND CONTRACTUAL FRAMEWORK
The key terms used in this policy have the meaning attributed to them by Art. 5 of the nLPD [1474] :
- Personal data : All information relating to an identified or identifiable natural person (e.g.: name, email address, telephone number, anonymised IP address) [1474].
- Sensitive data : Data that is particularly protected within the meaning of Art. 5 let. c nLPD [1475], in particular data relating to criminal proceedings or social assistance measures, as well as data relating to health.
- Processing : Any operation relating to personal data, irrespective of the means and procedures used, in particular collection, recording, storage, use, modification, communication, archiving, erasure or destruction [1476].
- Data Controller : The entity that, alone or jointly with others, determines the purposes and means of processing personal data. In the context of the Platform, this is LABGENE SCIENTIFIC SA [1478].
- Processor : The private person or organisation that processes personal data on behalf of and on instructions from the Data Controller. For Lab2Lab, the main technical Processor is Tandem Labs (Clément Lamy) [156, 158, 1478].
- Data subject : The natural person whose personal data is subjected to processing [1475].
ARTICLE 2. IDENTITY OF THE DATA CONTROLLER AND PROCESSORS
2.1. Data Controller (Publisher)
The Data Controller of the personal data collected on the Platform is : LABGENE SCIENTIFIC SA Swiss public limited company (SA), registered under the IDE number CHE-114.391.261 Registered office address : ZI, Route de Pra de Plan 35, 1618 Châtel-Saint-Denis, Switzerland [155] Telephone : +41 (0) 21 948 77 15 Email : info@labgene.ch / privacy@lab2lab.ch [155]
2.2. Technical Provider and Processor (Tandem Labs)
The technical design, application development, level 3 support and maintenance of the Platform are delegated to : Clément Lamy, operating under the trade name Tandem Labs Independent technical provider based in Switzerland Email : clement@tandem-labs.ch [156, 158]
In accordance with Art. 9 of the nLPD, LABGENE has ensured that the Technical Provider presents all the organisational and technical guarantees required to preserve the security, integrity and confidentiality of the processed data [1483].
2.3. Application and Storage Hosting Provider
The entire software infrastructure (Next.js server, PostgreSQL database) and storage (S3) is hosted in Switzerland [1, 6, 7] : Infomaniak Network SA Rue Eugène-Marziano 25, 1227 Les Acacias (Geneva), Switzerland No server or infrastructure resource is located outside Switzerland, guaranteeing absolute legal sovereignty over the entire application scope.
ARTICLE 3. PERSONAL DATA PROCESSED AND THEIR SOURCES
LABGENE undertakes to limit the collection of personal data to what is strictly necessary (principle of data minimisation and proportionality of Art. 6 LPD) [1479, 1482]. The following types of data are processed :
3.1. Data provided during Registration (Buyers, Sellers, Partners)
Upon registration on the Platform, the User mandatorily provides the following data [105, 106, 109] :
- Identity data : Last name, first name, professional email address, direct telephone number.
- Professional data : Registered trade name of the affiliated entity, entity type (biotech, pharma, university, hospital, distributor, etc.), business sector, function, department, institutional website.
- Legal identification data : IDE number (Swiss enterprise identification number) or VAT number.
- Financial data (for commission payments) : Bank details (IBAN, name of the financial institution) of the third-party seller for the transfer of funds after expiry of the 14-day security period.
3.2. Data related to Listings and Health Passport
When a Seller lists an equipment on the Platform, specific traceability data is required [150, 151] :
- Exact model, year of commissioning and mandatory unique serial number (enabling identification of the machine from an operational safety perspective) [150, 151].
- Health Passport (Decontamination Certificate) : PDF file signed by the qualified laboratory manager, attesting to the disinfection and decontamination of the equipment prior to any shipment. This document is stored under a secure and encrypted access regime.
- Equipment photographs : Images intended for the illustration of the used product listing.
3.3. Data related to Interest Requests (Inquiries / CRM)
When a Buyer wishes to reserve an equipment or ask a question, they fill out an interest form generating [50] :
- The free-text content of the purchase request.
- A technical CRM link connecting the Buyer's account, the relevant Listing record and the Labgene Operator assigned to the case.
ARTICLE 4. PURPOSES AND LEGAL BASES OF PROCESSING
The processing of personal data by LABGENE pursues exclusive, legitimate and proportionate purposes, based on contractual performance (Art. 31 al. 2 let. a LPD) or the overriding interest of the Data Controller (Art. 31 al. 1 LPD) [1520, 1521] :
- Performance of Intermediation Services : Management of account creation, review, curation, validation and publishing of used equipment listings on Lab2Lab.ch [19, 50].
- Commercial Management and Offline Invoicing : Manual issuance and sending of Swiss QR-bills via the accounting software Bexio, and payment of funds to third-party sellers by mutual agreement after expiry of the 14-day retention period [164, 165].
- Health Traceability and Laboratory Safety : Mandatory validation of decontamination certificates and serial numbers to ensure that no instrument contaminated by chemical, biological or radiological agents is put into circulation [150, 151].
- Notifications and Platform Automations : Automated sending of monthly audience reports (D+30), price adjustment emails at D+90 and depublication alerts before the 12-month listing activity deadline [12, 19].
- System Security and Auditability : Retention of technical logs (AuditLogs) describing in an immutable manner the history of listing modifications, accesses and actions carried out by LABGENE administrators and technicians [16, 18].
- User Support : Routing of support requests to a human communication channel (integration of WhatsApp exchange links with pre-filled messages related to the product) [299, 394].
ARTICLE 5. SECURITY AND DATA PROTECTION MEASURES
LABGENE and its Technical Provider implement technical and organisational security measures compliant with Art. 8 of the nLPD and state of the art to protect the data [1482, 1483] :
5.1. Encryption and Secure Network Traffic
- Systematic TLS/SSL encryption on all pages of the Platform (HTTPS).
- Database Isolation : The PostgreSQL database runs in an isolated docker container on an internal private network. It is not exposed to the internet and communicates only with the local Next.js API, without any public HTTP roundtrip [2, 7].
- Encryption at rest : Data encrypted on Infomaniak's physical SSD NVMe volumes, and encrypted daily backups (pg_dump) exported in a resilient manner to Infomaniak's secure Swiss Backup archiving infrastructure [7, 35].
5.2. Mandatory Two-Factor Authentication (2FA)
- In order to protect the platform against identity theft of a staff member (risk of unauthorised access to the professional contact directory or malicious modification of listings), two-factor authentication (2FA) is mandatory for all technical and commercial administration roles (
admin,operator,maintainer) [33, 35, 1485].
5.3. Securing S3 Storage (Decontamination Passports)
- Confidential documents (Health Passports, optional purchase invoices or proprietary manuals) are stored externally on a private S3 Object Storage space at Infomaniak [8].
- These files are inaccessible via direct public URL. The Payload CMS server generates on-demand temporary pre-signed access URLs, valid only for a limited duration of a few minutes, and accessible exclusively to logged-in users duly authorised by the RBAC (Role-Based Access Control) mechanism [8, 18, 35].
5.4. Image Pipeline Processing (Sharp) and Location Data Removal
- To prevent geographic coordinates (GPS), device identification data or sensitive laboratory metadata from being inadvertently exposed publicly on the internet via equipment photos uploaded by sellers, the Platform integrates an automated server-side pipeline based on the
sharplibrary [260, 268]. - Upon upload, all images are reprocessed : EXIF, GPS and IPTC metadata are systematically and permanently removed from the stored image [268].
5.5. Anonymous and Sovereign Audience Tracking (Cookieless)
To measure the performance of product listings without collecting personal data without the user's knowledge, LABGENE excludes any advertising tracker or American tracking tool (e.g.: Google Analytics) [13, 43]. The Platform performs server-side audience counting, compliant with the nLPD, by calculating an ephemeral fingerprint (SHA-256) combining [13, 14] :
- The visitor's IP address, anonymised on the fly by truncation (the last two bytes of the IPv4 address being eliminated before processing).
- The browser identifier (User Agent).
- The identifier (ID) of the listing consulted.
- A random security salt, automatically renewed every 24 hours by the server.
This fingerprint is stored ephemerally to filter repeated views over a 24-hour period. It does not allow tracing back to a physical identity. No persistent cookie is written on the visitor's terminal, exempting the Platform from displaying an intrusive cookie banner in accordance with the PFPDT guidelines [13, 14].
ARTICLE 6. RECIPIENTS AND DATA TRANSMISSION
The personal data collected by LABGENE is exclusively intended for the operation of the Platform and is never sold, rented or commercialised to third parties [214].
It may be communicated only to the following authorised recipients :
- The authorised team of LABGENE SA : Operators, administrators and accounting department [350].
- Tandem Labs (Clément Lamy) : Within the exclusive scope of their technical database administration, application debugging and hosting infrastructure maintenance services [18, 156].
- Partner Carriers : For logistics execution (DHL, Swiss Post or approved pallet carriers), only for the contact and physical location data necessary for collection and delivery [151, 152].
- Federal or judicial authorities : Only if a Swiss legal obligation or an enforceable judicial decision requires it (in particular in the context of an investigation).
ARTICLE 7. DATA RETENTION PERIOD
LABGENE undertakes to retain personal data only for the duration required in light of the purposes for which it was collected, or in accordance with Swiss legal retention obligations [1479] :
- User Accounts : Profile data is retained as long as the account is active. An account with no activity (login or listing) for a consecutive period of 3 years is automatically deleted, after prior notification to the user.
- Listings and Health Passports : Published listings expire after 12 months if they are not renewed [12]. Data from archived listings and the associated decontamination passports are destroyed at most 2 years after the status changes to "expired", "sold" or "withdrawn", with the exception of data necessary for legal evidence purposes or warranty history of Labgene Certified Equipment.
- Accounting and Invoicing Data (Bexio) : Pursuant to Art. 958f of the Swiss Code of Obligations, all invoices, commercial correspondence and supporting documents associated with completed transactions are retained securely for a minimum period of 10 years [1197, 1198].
- Technical Logs (AuditLogs) : Immutable system logs related to auditing and technical security are retained for a rolling period of 12 months maximum.
ARTICLE 8. RIGHTS OF DATA SUBJECTS
In accordance with Chapter 4 of the nLPD, each User has fundamental rights regarding the processing of their personal data :
- Right of access (Art. 25 LPD) : The user may request at any time to obtain confirmation that data concerning them is being processed, and to obtain a complete copy in intelligible form [1512].
- Right to rectification (Art. 32 LPD) : The user may demand the immediate correction of inaccurate or incomplete personal data concerning them [1524].
- Right to erasure / forgetting (Art. 32 and 41 LPD) : The user may request the deletion of their personal data when it is no longer necessary, subject to the legal retention periods imposed by Swiss law (e.g.: 10-year accounting retention) [1524, 1538, 1539].
- Right to transmission / portability (Art. 28 LPD) : The user has the right to obtain the personal data they have provided in a commonly used electronic format, or to request its transfer to another technical provider if the operation does not require disproportionate effort [1517, 1518].
- Right to object (Art. 37 LPD) : The user may object to the processing or communication of their data for specific reasons, unless there is an overriding public interest or higher legal obligation of LABGENE [1534, 1535].
How to exercise your rights?
For any question relating to your data or to exercise your rights, you may contact our dedicated internal data protection contact point :
- By postal mail : LABGENE SCIENTIFIC SA, data protection, ZI, Route de Pra de Plan 35, 1618 Châtel-Saint-Denis, Switzerland [155]
- By email :
privacy@lab2lab.chorsupport@lab2lab.ch[155]
LABGENE will respond to any access request or exercise of rights within a maximum period of 30 days from receipt of the request, in accordance with Swiss legal requirements. The provision of information is entirely free of charge [1519].
End of the Privacy Policy.