Atlas Portal (app.atlasbiolabs.com)Last updated: 11 October 2026
This privacy policy uses the terms defined in Article 4 GDPR (including 'personal data', 'processing', 'controller', 'processor', 'consent' and 'data subject'). Where 'we' or 'us' is used, this refers to Atlas Life Sciences GmbH.
Atlas Portal is a multi-tenant platform for commissioning and handling laboratory services. Users are generally staff of research institutions, clinics, laboratories and companies; the platform is also open to self-payers. Tenants see only the data of their own tenant.
When app.atlasbiolabs.com is accessed, our servers automatically record standard access data: IP address, browser type and version, operating system, referrer URL and time of access.
Log files are stored for 7 days and are then deleted automatically.
Legal basis: Art. 6(1)(f) GDPR — legitimate interest in the secure operation of the platform.
We use essential cookies that are required for sign-in, session management and the shopping cart. We set no cookies and store nothing on your device for audience measurement, analytics or advertising; there is therefore no consent notice for it.
Audience measurement with Vercel Web Analytics. We measure the reach of this platform with Vercel Web Analytics and Vercel Speed Insights, services of Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA, which processes the data on our behalf (Art. 28 GDPR) and is certified under the EU-U.S. Data Privacy Framework. The measurement runs on every page, without a consent notice. What is recorded: the page you visit, and from the query of its address only the campaign parameters of the link (utm_source, utm_medium, utm_campaign, utm_term, utm_content) and the language (lang); every other query parameter and any identifier in the path, such as an order number, an access code, a referral code or the click ID of an ad, is removed in your browser before anything is sent. In addition, the referring website, your country, device type, operating system and browser, and the steps of an order (click on an order button, checkout opened, order submitted, payment completed), each only with the key of the product, such as atlas-baseline, never with your name, your email address, an order number or the amount. Speed Insights additionally records how fast the page loads, with the same removal of identifiers.
No cookies, nothing on your device. The measurement neither stores information on your device nor reads it from there; Section 25 TDDDG does not apply. Vercel tells visitors apart only by a hash computed from the request data that changes every day and is discarded after 24 hours. There is no tracking across websites or devices and nothing is passed on to advertising platforms. Pages of our internal areas (/admin, /lab) are not measured.
Legal basis and right to object. The legal basis of the measurement is Art. 6(1)(f) GDPR. Our legitimate interest is to understand the reach and effect of our own campaigns and to improve our offer. You can object to the measurement at any time (Art. 21 GDPR), technically through the “Global Privacy Control” or “Do Not Track” signal of your browser (Art. 21(5) GDPR) or informally by email to service@atlasbiolabs.com. If your browser sends either signal, this platform sends nothing to Vercel.
Origin of an order. If you reach us through a campaign, an ad or a link on another website, the open page keeps the address through which you arrived and the referring page in its memory. None of this is stored on your device, no cookie and no other storage; the memory ends when you reload or close the page. If you place an order, both go with the order to our server, and from them we store with the order the campaign details (utm_source, utm_medium, utm_campaign, utm_term, utm_content), the referring domain, the landing page and the time. If the link carried the click ID of an advertising platform (gclid, gbraid, wbraid, oppref, msclkid, fbclid, twclid, li_fat_id), we store only the platform it belongs to, not the ID itself. If you order through a partner’s page, the partner passes the campaign details on with the order. We pass none of this on to advertising platforms. The details are kept with the order. The legal basis is our legitimate interest in evaluating the success of our campaigns (Art. 6(1)(f) GDPR); you can object at any time (Art. 21 GDPR).
Acquisition ID. Our website protocol.atlasbiolabs.com assigns a random ID (acq_id) on your first visit, which is not derived from any details about you and says nothing about you. It lets us recognise the path from an ad or campaign to the order as one process: the campaign details including the creative of the ad, the referring domain, the country and the times of the steps (visit to the landing page, click to order, visit to a service page, start of the order, redirect to payment, payment with the net amount, shipment of the sample kit, sample receipt, data delivery). The ID is only part of the address of the next page and of the order process, never stored on your device; it goes to Stripe as a reference on the payment. As the landing page we store only campaign pages (such as /baseline), never pages about individual tests. The order carries only the ID itself; we store the details of the process separately, accessible only to a narrowly limited group of administrators, and do not pass them on to any advertising platform. We delete the country, referring domain and landing page 90 days after the last contact; a process without an order is deleted entirely 180 days after the last contact, a process with an order 25 months after it. The legal basis is our legitimate interest in evaluating the success of our campaigns (Art. 6(1)(f) GDPR).
Consents given before 10 October 2026. Until 10 October 2026 we asked for your consent to marketing measurement in a notice. Since then we no longer ask for this consent, and no advertising tag runs in your browser any more. For orders for which you gave your consent before that date and which came through an OpenAI or Meta ad, our server still reports to the respective platform through the Conversions API for at most 30 days after 10 October 2026: to OpenAI the start of the order and the purchase, to Meta the purchase, each with the event type, the event ID, the time, the amount, the currency and the click ID stored at the time (to Meta also its browser ID fbp, where available); not the service ordered, sample material, health data or contact details. We delete these IDs 90 days after the order, both with the order and in the log of reports; your decision at the time is kept as proof of consent. You can withdraw your consent at any time informally by email to service@atlasbiolabs.com; after that we report nothing more. Cookies we used to set for this are deleted on your next visit.
Legal basis: Section 25(2) TDDDG and Art. 6(1)(f) GDPR for essential cookies; Art. 6(1)(a) GDPR for the reports based on consents given before 10 October 2026.
To provide access to the portal we process: name, email address, organisation, role within the tenant and sign-in times. Access is granted through a personalised sign-in link; for this purpose we store an access token and the time of the most recent sign-in.
Legal basis: Art. 6(1)(b) GDPR — performance of a contract and pre-contractual measures.
Access to an order is granted only to persons who work on the order and its results in a professional capacity. Persons who only handle ordering, sample shipment or invoicing are held as a contact without access.
When you send an enquiry or place an order we process: name, email address, telephone number, organisation, delivery and billing address, VAT identification number, order number and the details of the commissioned procedure.
Purposes: preparing quotations, order handling, sample tracking, provision of results, invoicing, customer communication and compliance with statutory obligations.
Legal basis: Art. 6(1)(b) GDPR — performance of a contract; Art. 6(1)(c) GDPR for obligations under commercial and tax law.
Retention period: customer and contact data for 3 years after the last transaction; order and invoice data relevant under commercial and tax law for 10 years pursuant to the German Commercial Code (HGB) and the German Fiscal Code (AO).
Enquiry about a genome sequenced elsewhere. If you ask on the booking page of an analysis whether we can use a genome already sequenced elsewhere, we process your name, email address, the selected analysis and your details on the provider, the available files, the coverage and PCR-free preparation in order to review and answer your enquiry; no files are transferred. Legal basis: Art. 6(1)(b) GDPR (pre-contractual steps at your request). The enquiry is deleted twelve months after the last contact; if an order follows, the retention periods for order data apply.
Payments in the self-service checkout are handled by Stripe. Payment data is processed by Stripe and is not stored on our systems. Where payment is made against an invoice, we process the invoice and payment receipt data ourselves.
Legal basis: Art. 6(1)(b) GDPR.
Samples and the genetic, epigenetic and molecular biological data derived from them are managed through the platform. Where such data relates to identifiable natural persons, it constitutes special categories of personal data within the meaning of Art. 9 GDPR.
Allocation of roles. Where an institution commissions an analysis of third-party samples (for example from study participants or patients), the commissioning institution is the controller and Atlas is the processor pursuant to Art. 28 GDPR. In that case, obtaining the data subject's consent and establishing the legal basis are the responsibility of the commissioning institution. For self-payers who commission an analysis of their own sample, Atlas is the controller; the legal basis is explicit consent pursuant to Art. 9(2)(a) GDPR, obtained before processing begins.
Storage and access. Samples and derived data are stored at the laboratory of Atlas Life Sciences GmbH in Germany and in the platform; samples and the data derived from them remain within the EU. Access is restricted to authorised laboratory, bioinformatics and service staff and to the authorised persons of the respective tenant.
Limits on use. We do not sell genetic data. We do not disclose genetic data to insurers or employers; such disclosure is prohibited under Section 4 GenDG. We do not use the data for our own research purposes and do not publish identifiable data without separate explicit consent.
Retention period. We keep sample material from Atlas Baseline and the DNA extracted from it until the 27th day after data delivery and destroy it afterwards; storage booked by then extends retention until the storage ends. Otherwise, samples and derived data are retained for as long as no deletion or destruction is requested. Controlling institutions and self-payers may request the destruction of the sample and the deletion of the data at any time at service@atlasbiolabs.com. Deletion extends to commissioned laboratories and service providers. Order and invoice data that must be retained under commercial and tax law remains unaffected; it contains no genetic data.
Diagnostic use. Services commissioned through the platform are non-diagnostic unless expressly agreed otherwise. Diagnostic or predictive use, and the communication of findings, take place exclusively through a responsible physician in accordance with the GenDG.
To handle orders we send transactional messages (quotations, order and status notifications, invoices, access links). Legal basis: Art. 6(1)(b) GDPR. For messages that do not serve order handling, Art. 6(1)(a) or (f) GDPR applies; you may object at any time and without any particular form.
We engage the following processors and recipients to deliver the service:
The service providers named above as processors are bound by data processing agreements pursuant to Art. 28 GDPR. To OpenAI and Meta we now transmit only reports on orders with a consent given before 10 October 2026 (section 5); nothing goes from your browser to any advertising platform.
Where data is processed outside the EU, the transfer takes place on the basis of standard contractual clauses and, where applicable, the EU-U.S. Data Privacy Framework. Samples and the genetic data derived from them are processed and stored exclusively within the European Union.
You have the following rights in respect of your personal data:
Contact: service@atlasbiolabs.com
If your request concerns data that we process on behalf of an institution, we forward it to the controlling institution and inform you accordingly.
You have the right to lodge a complaint with a supervisory authority.
Competent supervisory authority: Berliner Beauftragte für Datenschutz und Informationsfreiheit (BlnBDI), Friedrichstraße 219, 10969 Berlin, Germany, https://www.datenschutz-berlin.de
For all data protection enquiries: service@atlasbiolabs.com
Atlas Portal is a product of Atlas Life Sciences GmbH, Berlin.