Security, Privacy & Terms

This Privacy Policy applies to:

• visitors to Labbera's website
• users of the Labbera platform
• employees, contractors, researchers, scientists, administrators, and representatives of Labbera customers
• individuals whose personal data may be included in customer systems connected to Labbera
• individuals who contact Labbera, request a demo, join a pilot, subscribe to updates, or otherwise interact with us

Where Labbera processes personal data on behalf of a business customer, that customer is usually the "controller" and Labbera acts as a "processor". Where Labbera decides how and why personal data is processed (e.g. our own website, sales, billing, security, recruitment, compliance), Labbera acts as the "controller".

• Customer data stays customer-controlled — remains within the customer's own infrastructure or approved environment wherever possible.
• Limited access only — Labbera's hosted agent layer accesses customer-approved systems only where required to provide requested Services.
• No unnecessary copying — Labbera does not intentionally extract, replicate, or retain a full copy of customer data outside the customer environment unless expressly agreed in writing.
• No sale of customer data.
• No model training on customer data, prompts, retrieved context, files, documents, outputs, metadata, or connected system content.
• Security by design — reasonable technical and organisational measures.
• Customer control — customers control which systems are connected, which users have access, and what data is made available.
• Limited subprocessor use — approved subprocessors (including Google Cloud and Anthropic Claude) only where reasonably necessary.
• No independent subprocessor use of customer data for their own purposes, advertising, resale, analytics, profiling, or model training.
• Temporary and task-specific processing — tied to the specific user query, workflow, task, or instruction.
• No external customer data repository outside the customer environment.

3.1 Account and user information: name, work email, job title, organisation, department, username, authentication credentials, role and permissions, profile information.

3.2 Customer-provided and connected data: personal data contained in documents, research files, laboratory notes, protocols, meeting notes, emails, calendars, project tools, databases, spreadsheets, experiment records, task systems, chat tools, file storage, and other customer-approved integrations. The exact data accessed depends on the customer's configuration, permissions, and user instructions.

3.3 AI interaction data: prompts, queries, instructions, conversation history within the Services, retrieved context from customer-approved systems, AI-generated outputs, user feedback on outputs, and workflow actions.

3.4 Technical and usage information: IP address, browser type, device type, OS, access logs, login timestamps, feature usage, error logs, diagnostic and performance information, security event logs, integration status, and API request metadata.

3.5 Communications information: name, email, company, message content, support requests, demo requests, sales enquiries, feedback, correspondence history.

3.6 Billing and commercial information: billing contact details, company address, payment status, subscription plan, invoice information, tax information, order history. Payment processing may be handled by third-party payment providers.

3.7 Website and cookie data: pages visited, referral source, session information, device and browser information, analytics data, preferences.

Labbera's Services may be used by R&D, scientific, or laboratory teams. Connected systems may contain sensitive data, confidential research data, health-related information, genetic data, employee data, commercial secrets, or regulated information. Customers are responsible for deciding what data to connect and ensuring they have the required legal basis, permissions, safeguards, and notices.

• provide, operate, and maintain the Services
• authenticate users and manage accounts
• connect to customer-approved systems
• process user queries and generate AI-assisted outputs
• retrieve relevant customer-hosted context for authorised tasks
• provide dashboards, reports, notifications, workflows, and project tracking
• configure, troubleshoot, and support customer deployments
• monitor performance, reliability, and security
• prevent fraud, abuse, unauthorised access, and security incidents
• communicate with users and customers
• provide onboarding, support, and customer success
• manage billing, subscriptions, pilots, and contracts
• improve the Services using aggregated, anonymised, or de-identified information where possible
• comply with legal, regulatory, contractual, and security obligations
• enforce our Terms and Conditions

Labbera may operate a hosted AI agent or orchestration layer. The hosted agent may send requests into the customer environment, retrieve relevant context from customer-approved systems, process that context for the requested task, and return an output.

Unless expressly agreed otherwise in writing:

• the hosted agent only accesses customer-approved systems
• access is limited to the specific task, workflow, query, or instruction requested
• the hosted agent is not intended to permanently retain customer data
• Labbera does not build an independent copy of the customer's dataset
• Labbera does not use customer data to train, fine-tune, improve, or develop any AI model or system
• Labbera does not sell customer data
• Subprocessors may not use customer data for advertising, profiling, resale, independent analytics, or model training
• Temporary processing is limited to what is reasonably necessary

Where UK GDPR, EU GDPR, or similar data protection laws apply, Labbera relies on one or more of the following legal bases:

• Contract — to provide the Services, manage accounts, support customers, and fulfil contractual obligations.
• Legitimate interests — to secure, operate, improve, and market our Services, prevent misuse, and manage business relationships.
• Consent — where we ask for it, such as certain cookies, marketing, or optional processing.
• Legal obligation — to comply with applicable laws, regulations, court orders, tax obligations, or lawful requests.
• Customer instructions — where we process personal data as a processor on behalf of a customer under the applicable Data Processing Agreement.

Where Labbera processes personal data on behalf of a customer, the customer is responsible for determining the purpose and lawful basis, providing privacy notices, obtaining consents, configuring access controls, ensuring data accuracy, responding to data subject requests, and ensuring lawful use of connected systems. Where required, Labbera and the customer will enter into a Data Processing Agreement.

Labbera may use third-party infrastructure, AI model, cloud, security, monitoring, support, and analytics providers — including Google Cloud and Anthropic Claude — only where reasonably necessary to deliver, secure, operate, monitor, and maintain the Services.

Unless expressly agreed otherwise in writing:

• customer data remains hosted within the customer environment or customer-approved infrastructure
• Labbera does not transfer, export, replicate, or permanently store customer data on Labbera-controlled servers or third-party subprocessor systems
• subprocessors will not receive customer data except where technically necessary to perform an authorised function
• AI model providers only process customer data for the limited purpose of generating the requested output
• Labbera does not permit AI model providers or other subprocessors to use customer data to train or improve any model
• prompts, queries, retrieved context, outputs, logs, and temporary processing data are not retained by subprocessors beyond what is necessary
• subprocessors processing personal data are subject to appropriate confidentiality, security, and data protection obligations

Labbera may share limited personal data with: service providers and sub-processors; customer administrators and authorised users; customer-approved third-party integrations; professional advisors; regulators, courts, or law enforcement where legally required; buyers, investors, or successors in connection with a corporate transaction; and other parties with consent or the customer's instruction. Labbera does not sell personal data.

Labbera is based in the United Kingdom. Personal data may be processed in the UK, the EEA, the United States, or other countries. Where required by law, Labbera will use appropriate safeguards for international transfers, such as adequacy decisions, standard contractual clauses, or the UK International Data Transfer Agreement.

• account data — retained while the account is active and for a reasonable period afterwards
• billing and contract records — retained for legal, tax, and accounting purposes
• support communications — retained to provide ongoing support
• security logs — retained for security monitoring and incident investigation
• temporary AI processing data — retained only as long as reasonably necessary
• customer-hosted data — remains primarily within the customer environment and is managed by the customer
• prompts, queries, retrieved context, files, outputs, and connected system content — not retained for model training

Labbera does not use customer data — including files, documents, laboratory records, experiment data, prompts, queries, retrieved context, embeddings, outputs, metadata, user feedback, connected system content, or personal data — to train, fine-tune, improve, or develop any AI model. Labbera does not permit third-party AI model providers, cloud providers, or other subprocessors to do so either.

Because Labbera is designed around a customer-hosted model, most customer data remains under the customer's control. Upon ending the relationship: customer-hosted data remains in the customer environment; the customer is responsible for exporting or deleting it; Labbera will delete or return any personal data it controls in accordance with the applicable agreement, DPA, legal requirements, and retention policies.

Labbera uses reasonable technical and organisational measures, which may include:

• encryption in transit
• access controls and authentication
• least-privilege access
• audit logging
• monitoring and alerting
• secure development practices
• vulnerability management
• internal confidentiality obligations
• incident response procedures
• vendor security review
• data minimisation where practical

No system is completely secure. Customers are responsible for securing their own environments, connected tools, credentials, and internal systems.

If Labbera becomes aware of a personal data breach affecting personal data processed by Labbera on behalf of a customer, Labbera will notify the affected customer without undue delay where required by applicable law or contract. Customers are responsible for notifying affected individuals or regulators where they are the controller.

Depending on your location and applicable law, you may have rights to: access, correct, delete, restrict processing of, object to processing of, or port your personal data; withdraw consent; and complain to a data protection authority. Where Labbera acts as a processor, we may refer your request to the relevant customer.

Labbera may send marketing communications to business contacts where permitted. You may opt out at any time. Labbera may use cookies and similar technologies to operate the website, remember preferences, authenticate users, improve performance, analyse usage, and understand marketing effectiveness. The Services are intended for business, research, and professional use and are not intended for children.

Labbera Limited, 36 Penywern Road, London, United Kingdom. Email: info@labbera.com.

If you are located in the United Kingdom, you may contact the UK Information Commissioner's Office. If you are located in the European Economic Area, you may also have the right to contact your local data protection authority.

Labbera provides an AI-native workspace for R&D, scientific, laboratory, and technical teams. The Services may include customer-hosted software components, connectors to customer-approved data sources, an AI agent or orchestration layer operated by Labbera, user interfaces, dashboards, chatbots, reports, search tools, workflow automations, notification systems, analytics, and related support, onboarding, configuration, maintenance, and documentation.

Labbera is designed so the Customer's underlying data, files, documents, records, experiment data, internal systems, databases, and connected tools remain hosted within the Customer's own infrastructure or approved third-party environment. Unless expressly agreed otherwise in writing:

• Customer Data remains stored on the Customer's side
• Labbera does not host the Customer's full underlying datasets on Labbera-controlled servers
• Labbera's hosted agent layer reaches into Customer-approved systems only for the limited purpose of performing requested tasks
• Labbera does not intentionally extract, retain, replicate, or build an independent copy of Customer Data outside the Customer's environment
• Labbera does not use Customer Data to train general-purpose AI models without separate written permission
• Labbera does not sell Customer Data
• Approved subprocessors are used only to support the Services and do not alter the customer-hosted principle
• Any temporary processing by subprocessors is limited to the specific authorised task

Data residency and no-transfer principle. Labbera's intended architecture is that Customer Data stays within the Customer Environment.

Customer Data — all data, files, documents, text, images, tables, experiment records, laboratory records, project information, messages, metadata, prompts, queries, outputs, user content, business information, confidential information, personal data, and other materials submitted to, connected to, accessed by, or processed through the Services by or on behalf of the Customer.

Customer Environment — the Customer's own systems, servers, cloud environment, private network, databases, file storage, applications, and approved third-party tools.

Hosted Agent — the Labbera-operated orchestration, reasoning, routing, or AI agent component that may communicate with Customer-hosted components or Customer-approved systems.

Outputs — answers, summaries, reports, analyses, recommendations, classifications, generated text, workflow actions, charts, notifications, or other content generated by the Services.

Order Form — any signed quotation, subscription agreement, pilot agreement, statement of work, email confirmation, or other written agreement setting out commercial terms.

Customer owns and retains all rights, title, and interest in and to Customer Data. Labbera does not claim ownership. Customer grants Labbera a limited, non-exclusive, non-transferable right to access, process, transmit, query, and use Customer Data solely to the extent necessary to provide, secure, maintain, troubleshoot, support, and improve the Services for that Customer. This right does not permit unrelated commercial purposes, sale of Customer Data, or training of general-purpose models unless separately agreed in writing.

Labbera will only access Customer Data where technically required to provide the Services or where Customer has authorised such access. Access may occur through secure connectors, APIs, permissions, service accounts, embeddings, indexes, temporary context windows, retrieval systems, or other Customer-approved mechanisms.

Labbera will use reasonable technical and organisational measures designed to ensure that: Customer Data remains within the Customer Environment wherever possible; access is limited to the specific task, query, workflow, or authorised function; Customer Data is not permanently retained unless expressly agreed; temporary processing is minimised; logs and telemetry are minimised where practical; and access controls, audit trails, and permission boundaries are implemented.

Labbera will not permit subprocessors to use Customer Data for their own independent purposes, advertising, resale, or general-purpose model training, unless expressly agreed by Customer in writing.

Labbera will not use Customer Data to train, fine-tune, or improve general-purpose AI models made available to other customers or third parties unless the Customer expressly agrees in a separate written agreement. Labbera may use aggregated, anonymised, or de-identified technical information to understand service performance, reliability, security, usage patterns, and product improvements, provided such information does not identify the Customer.

Labbera's processing of personal data is described in Labbera's Privacy Policy above. Where Labbera processes personal data on behalf of a Customer, the parties may enter into a separate Data Processing Agreement ("DPA"). If required by applicable data protection law, the DPA will govern Labbera's processing of personal data as processor on behalf of the Customer. If there is a conflict between these Terms and the DPA regarding the processing of personal data, the DPA will prevail.

• ensuring the legal right to connect, process, and use Customer Data with the Services
• obtaining all required consents, permissions, notices, and legal bases
• configuring access permissions, integrations, user roles, and system controls appropriately
• ensuring that only authorised users access the Services
• maintaining the security of the Customer's own systems, devices, credentials, networks, and Customer Environment
• reviewing Outputs before relying on them for scientific, operational, legal, regulatory, medical, financial, employment, or other important decisions
• ensuring compliance with applicable laws, regulations, institutional policies, research ethics, contractual obligations, and third-party terms
• ensuring that sensitive, regulated, or high-risk data is only connected where appropriate safeguards are in place

Customer and its users are responsible for maintaining the confidentiality of login details, access credentials, API keys, tokens, and other authentication methods. Customer must promptly notify Labbera of any actual or suspected unauthorised access or misuse.

Customer must not use the Services to:

• violate applicable laws or regulations
• infringe intellectual property, privacy, confidentiality, or data protection rights
• upload, connect, or transmit unlawful, harmful, abusive, discriminatory, defamatory, or malicious content
• attempt to gain unauthorised access to Labbera or third-party systems
• interfere with, disrupt, overload, reverse engineer, or compromise the Services
• bypass security, access control, rate limits, or usage restrictions
• create malware, phishing content, harmful code, or cyber abuse
• make automated decisions with legal or similarly significant effects without appropriate human review
• use Outputs as a substitute for professional scientific, legal, regulatory, medical, financial, or safety advice

The Services may generate AI-assisted Outputs. Customer acknowledges that Outputs may be incomplete, inaccurate, outdated, biased, misleading, or unsuitable for a particular purpose. Customer is responsible for reviewing, validating, and approving Outputs before relying on them. Labbera does not guarantee that Outputs will be error-free, scientifically valid, or regulatory-compliant.

Labbera supports R&D teams but does not replace professional judgment, laboratory validation, peer review, regulatory review, quality assurance, or safety procedures. Customer remains solely responsible for experimental design and interpretation, validation of findings, laboratory safety, regulatory submissions, clinical/diagnostic/therapeutic decisions, quality control, and compliance with applicable research, laboratory, institutional, and industry standards.

Labbera may use carefully selected third-party providers and subprocessors — including cloud infrastructure and AI model providers such as Google Cloud and Anthropic Claude — to support the provision, security, hosting, operation, monitoring, and performance of the Services. Their use does not change the customer-hosted architecture. Where possible, Labbera designs the Services so sensitive Customer Data is processed inside the Customer Environment and only limited instructions, metadata, or temporary context are transmitted outside where strictly necessary.

Labbera will implement reasonable technical and organisational measures designed to protect the Services and any data processed by Labbera against unauthorised access, loss, misuse, alteration, or disclosure. These may include access controls, encryption in transit, least-privilege access, monitoring, logging, secure development practices, incident response, and internal confidentiality controls. Customer acknowledges that no system can be guaranteed to be completely secure.

Each party may receive confidential or proprietary information from the other. Each party must protect the other party's Confidential Information using reasonable care, use it only for purposes related to the Services, not disclose it to third parties except as permitted, and limit access to personnel bound by confidentiality obligations. Standard exceptions apply for publicly available or independently developed information, or where disclosure is required by law.

Labbera and its licensors own all rights, title, and interest in and to the Services. Except as expressly permitted, Customer must not copy, modify, distribute, resell, sublicense, reverse engineer, decompile, or create derivative works based on the Services. Customer receives only the limited right to access and use the Services during the applicable subscription, pilot, or contract term.

If Customer provides feedback, suggestions, ideas, feature requests, or improvement recommendations, Labbera may use them without restriction, provided Labbera does not disclose Customer Confidential Information or Customer Data.

Fees, billing terms, subscription periods, usage limits, pilot terms, seat numbers, implementation fees, renewal terms, and payment deadlines will be set out in the applicable Order Form. Unless stated otherwise: fees are payable in advance; fees are non-refundable except as required by law or expressly agreed in writing; late payments may result in suspension; and Customer is responsible for applicable taxes (excluding taxes on Labbera's income).

Labbera will use reasonable efforts to keep the Services available but does not guarantee uninterrupted, error-free, or continuous availability. Labbera may update, modify, suspend, restrict, replace, or discontinue parts of the Services where reasonably necessary for security, maintenance, legal compliance, product improvement, or operational reasons.

Support, onboarding, service levels, response times, and maintenance commitments will be provided as stated in the applicable Order Form or support policy. Unless expressly agreed, Labbera does not guarantee specific response times, resolution times, uptime percentages, or custom development deliverables.

Labbera may suspend access if Customer fails to pay overdue fees; breaches these Terms; creates a security, legal, operational, or reputational risk; where required by law; Customer's systems or credentials appear compromised; or continued access could harm Labbera, the Services, another customer, or a third party.

Either party may terminate the Services as set out in the applicable Order Form. Labbera may terminate or suspend if Customer materially breaches these Terms and does not remedy the breach within a reasonable period after notice. Upon termination: Customer's right to use the Services ends; unpaid fees remain payable; each party must return or delete the other's Confidential Information subject to legal, regulatory, backup, and audit obligations; and Customer Data hosted in the Customer Environment remains under Customer's control.

Because the Services are designed around a customer-hosted model, Customer Data should remain primarily within the Customer Environment. Upon termination, Customer is responsible for preserving, exporting, deleting, or managing Customer Data. Where Labbera holds limited support data, logs, temporary data, or account data, Labbera will delete or return such data in accordance with the Privacy Policy, DPA, applicable law, and Labbera's standard retention practices.

Labbera may offer beta, pilot, experimental, early-access, or trial features. Such features may be incomplete, changed, withdrawn, unstable, or subject to additional limitations. Unless expressly agreed otherwise, they are provided "as is" and without service level commitments.

To the fullest extent permitted by law, the Services are provided "as is" and "as available". Labbera disclaims all warranties, representations, and conditions, whether express, implied, statutory, or otherwise, including warranties of merchantability, fitness for a particular purpose, non-infringement, accuracy, availability, and reliability.

To the fullest extent permitted by law, Labbera will not be liable for indirect, incidental, special, consequential, exemplary, or punitive damages; loss of profits, revenue, business, goodwill, opportunity, anticipated savings, or reputation; loss, corruption, or unavailability of data; business interruption; research delays; failed experiments; regulatory consequences; decisions made based on AI-generated Outputs; or failures caused by Customer systems, third-party services, user error, or unauthorised access caused by Customer.

Labbera's total aggregate liability arising out of or relating to the Services will not exceed the amount paid by Customer to Labbera for the Services in the twelve months before the event giving rise to the claim. Nothing in these Terms limits liability that cannot be limited by law.

Customer will indemnify and hold harmless Labbera, its officers, directors, employees, contractors, affiliates, and licensors from and against claims, damages, liabilities, losses, costs, and expenses arising from Customer's misuse of the Services, Customer Data, breach of these Terms, violation of law or third-party rights, Customer's connected systems or third-party tools, or reliance on Outputs without appropriate review.

Each party must comply with laws applicable to its own performance under these Terms. Customer is responsible for determining whether the Services are appropriate for its intended use and for ensuring compliance with applicable laws, including data protection, research, laboratory, employment, export control, intellectual property, confidentiality, and sector-specific regulations.

Customer must not use, export, re-export, or transfer the Services in violation of applicable export control or sanctions laws. Customer represents it is not located in, organised under the laws of, or ordinarily resident in any country or territory subject to comprehensive sanctions, and is not listed on any applicable restricted party list.

Labbera may not use Customer's name, logo, or trademarks in public marketing materials without Customer's prior written consent, unless otherwise stated in an Order Form.

Labbera may update these Terms from time to time. Where practical, Labbera will provide reasonable notice of material changes.

These Terms are governed by the laws of England and Wales. The courts of England and Wales will have exclusive jurisdiction over any dispute arising out of or relating to these Terms, the Services, or any related agreement, unless otherwise agreed in writing.

Labbera Limited, 36 Penywern Road, London, United Kingdom. Email: info@labbera.com.