Atlas Portal (app.atlasbiolabs.com)Last updated: August 2026
This privacy policy uses the terms defined in Article 4 GDPR (including 'personal data', 'processing', 'controller', 'processor', 'consent' and 'data subject'). Where 'we' or 'us' is used, this refers to Atlas Life Sciences GmbH.
Atlas Portal is a multi-tenant platform for commissioning and handling laboratory services. Users are generally staff of research institutions, clinics, laboratories and companies; the platform is also open to self-payers. Tenants see only the data of their own tenant.
When app.atlasbiolabs.com is accessed, our servers automatically record standard access data: IP address, browser type and version, operating system, referrer URL and time of access.
Log files are stored for 7 days and are then deleted automatically.
Legal basis: Art. 6(1)(f) GDPR — legitimate interest in the secure operation of the platform.
We use essential cookies that are required for sign-in, session management and the shopping cart. Where relevant, we set analytics cookies only with your prior consent.
Legal basis: Section 25(2) TDDDG and Art. 6(1)(f) GDPR for essential cookies; Section 25(1) TDDDG and Art. 6(1)(a) GDPR for all others.
To provide access to the portal we process: name, email address, organisation, role within the tenant and sign-in times. Access is granted through a personalised sign-in link; for this purpose we store an access token and the time of the most recent sign-in.
Legal basis: Art. 6(1)(b) GDPR — performance of a contract and pre-contractual measures.
Access to an order is granted only to persons who work on the order and its results in a professional capacity. Persons who only handle ordering, sample shipment or invoicing are held as a contact without access.
When you send an enquiry or place an order we process: name, email address, telephone number, organisation, delivery and billing address, VAT identification number, order number and the details of the commissioned procedure.
Purposes: preparing quotations, order handling, sample tracking, provision of results, invoicing, customer communication and compliance with statutory obligations.
Legal basis: Art. 6(1)(b) GDPR — performance of a contract; Art. 6(1)(c) GDPR for obligations under commercial and tax law.
Retention period: customer and contact data for 3 years after the last transaction; order and invoice data relevant under commercial and tax law for 10 years pursuant to the German Commercial Code (HGB) and the German Fiscal Code (AO).
Payments in the self-service checkout are handled by Stripe. Payment data is processed by Stripe and is not stored on our systems. Where payment is made against an invoice, we process the invoice and payment receipt data ourselves.
Legal basis: Art. 6(1)(b) GDPR.
Samples and the genetic, epigenetic and molecular biological data derived from them are managed through the platform. Where such data relates to identifiable natural persons, it constitutes special categories of personal data within the meaning of Art. 9 GDPR.
Allocation of roles. Where an institution commissions an analysis of third-party samples (for example from study participants or patients), the commissioning institution is the controller and Atlas is the processor pursuant to Art. 28 GDPR. In that case, obtaining the data subject's consent and establishing the legal basis are the responsibility of the commissioning institution. For self-payers who commission an analysis of their own sample, Atlas is the controller; the legal basis is explicit consent pursuant to Art. 9(2)(a) GDPR, obtained before processing begins.
Storage and access. Samples and derived data are stored at the laboratory of Atlas Life Sciences GmbH in Germany and in the platform; samples and the data derived from them remain within the EU. Access is restricted to authorised laboratory, bioinformatics and service staff and to the authorised persons of the respective tenant.
Limits on use. We do not sell genetic data. We do not disclose genetic data to insurers or employers; such disclosure is prohibited under Section 4 GenDG. We do not use the data for our own research purposes and do not publish identifiable data without separate explicit consent.
Retention period. Samples and derived data are retained for as long as no deletion or destruction is requested. Controlling institutions and self-payers may request the destruction of the sample and the deletion of the data at any time at service@atlasbiolabs.com. Deletion extends to commissioned laboratories and service providers. Order and invoice data that must be retained under commercial and tax law remains unaffected; it contains no genetic data.
Diagnostic use. Services commissioned through the platform are non-diagnostic unless expressly agreed otherwise. Diagnostic or predictive use, and the communication of findings, take place exclusively through a responsible physician in accordance with the GenDG.
To handle orders we send transactional messages (quotations, order and status notifications, invoices, access links). Legal basis: Art. 6(1)(b) GDPR. For messages that do not serve order handling, Art. 6(1)(a) or (f) GDPR applies; you may object at any time and without any particular form.
We engage the following processors and recipients to deliver the service:
All processors are bound by data processing agreements pursuant to Art. 28 GDPR.
Where data is processed outside the EU, the transfer takes place on the basis of standard contractual clauses and, where applicable, the EU-U.S. Data Privacy Framework. Samples and the genetic data derived from them are processed and stored exclusively within the European Union.
You have the following rights in respect of your personal data:
Contact: service@atlasbiolabs.com
If your request concerns data that we process on behalf of an institution, we forward it to the controlling institution and inform you accordingly.
You have the right to lodge a complaint with a supervisory authority.
Competent supervisory authority: Berliner Beauftragte für Datenschutz und Informationsfreiheit (BlnBDI), Friedrichstraße 219, 10969 Berlin, Germany, https://www.datenschutz-berlin.de
For all data protection enquiries: service@atlasbiolabs.com
Atlas Portal is a product of Atlas Life Sciences GmbH, Berlin.