Privacy Policy

Last updated: October 2026

BRS Lab Services ("we," "us," or "our") operates the AI Lab Services platform ("Platform"). This Privacy Policy explains how we collect, use, and protect information in connection with the Platform and this website. Our principal place of business is 45260 Indian Creek Dr., Canton, Michigan 48187.

Information We Collect

Account information: When you register, we collect your name, email address, organization name, and billing information.

Laboratory data: Data you enter into the Platform — including chain of custody records, certificates of analysis, client records, sample data, and results — is Your Data. We process it only to provide you the Platform services.

Usage data: We collect logs, feature usage, and performance metrics to operate and improve the Platform. This data is aggregated and not linked to individual users.

Website data: Standard analytics (page views, referral source) collected through privacy-respecting tools when you visit ailabservices.com.

Multi-Tenant Data Isolation

The Platform is a multi-tenant system. Your laboratory data is logically isolated from all other tenants. No tenant can access another tenant's data. Our staff cannot access your data without explicit authorization from your account administrator, except as required by law or for agreed-upon technical support.

How We Use Your Information

We use account information to provision your tenant, process billing, and provide customer support. We use aggregated usage data to improve Platform performance and features. We do not use your laboratory data for any purpose other than providing the Platform to you. We do not sell your information.

Data Security

Data in transit uses TLS. Connection strings, tokens, API keys, and two-factor secrets are encrypted at the application level; storage-level encryption at rest is provided by our hosting provider. We maintain audit logs of all data access events. Access to production systems is restricted to authorized personnel and is reviewed regularly. We conduct periodic security reviews of the Platform.

Data Retention and Portability

Your Data is retained for the duration of your subscription. Upon termination, you have 30 days to export your data in a standard format. After that period, your data is securely deleted. Anonymized, aggregated usage statistics may be retained indefinitely.

Third-Party Processors

We use trusted infrastructure providers (cloud hosting, payment processing) that are contractually bound to protect your data. We do not share your laboratory data with any third party for marketing or analytics purposes.

Compliance

AI Lab Services is designed with PIPEDA (Canada) and applicable US state privacy laws in mind. If your laboratory operates under additional regulatory frameworks (e.g., HIPAA, ISO 17025), please contact us to discuss a Data Processing Agreement.

Your Rights

You may request access to, correction of, or deletion of your account information at any time. As the controller of Your Data, you are responsible for honoring any data subject requests from your own clients. We will assist you in fulfilling those requests upon written request.

Legal Basis and Your Data Protection Rights (GDPR)

If you are in the European Economic Area, the United Kingdom or Switzerland, the GDPR (or the equivalent local law) applies to personal data we handle. We rely on these legal bases:

Contract: to create your account, provide the Platform and bill you.
Legitimate interests: to keep the Platform secure, prevent misuse and understand aggregate performance, where those interests are not outweighed by your rights.
Consent: for optional contact such as marketing email or hub introductions. You can withdraw consent at any time.
Legal obligation: where the law requires us to keep or disclose a record.

For the laboratory data you enter, you decide what is collected and why, and we act as your processor, handling it only on your documented instructions under our Data Processing Agreement. For your account information, we are the controller.

You have the right to access your personal data, correct it, have it erased, restrict or object to its use, receive it in a portable format, and complain to your local data protection authority. To use any of these rights, email the address in the Contact section below. If your request concerns data held in a laboratory's tenant, we will pass it to that laboratory as the controller.

International Transfers

Our standard hosting is in North America, so personal data from the EEA, the UK or Switzerland is transferred outside those regions. We use the European Commission's Standard Contractual Clauses (and the UK addendum where needed) in our Data Processing Agreement to protect those transfers. Our infrastructure providers are listed in the Data Processing Agreement, and we give notice before adding a new one.

EU Data Residency

EU data residency (Frankfurt) is available on enterprise deployment. It is not part of the standard plans, and a tenant is hosted in the EU only when it has been set up that way.

Health Information and HIPAA

If your laboratory handles protected health information, a Business Associate Agreement (BAA) is available on request. Please contact matthew.dewolfe@brslab.com before you enter that data into the Platform.

Hub Network and Email Capture

When you use the AILS Hub Finder, we do not store your search inputs. If you submit an introduction request or reserve a spot, we collect your name and email address to follow up on your request. We will not add you to marketing lists without your express consent.

If you apply to become an AILS Hub partner, we collect your organization details and contact information to process your application.

AILS uses Resend (resend.com) to send transactional emails. All emails include an unsubscribe link and sender identification. AILS complies with the requirements of CASL (Canadian Anti-Spam Legislation) and the CAN-SPAM Act, including express consent where required, clear sender identification, and functioning unsubscribe mechanisms.

Contact

For privacy questions or data requests, contact Matthew.dewolfe@brslab.com or write to us at 45260 Indian Creek Dr., Canton, Michigan 48187.