Privacy Policy

1. What we collect

When you order or contact us: your name, company, email address, phone number if you give one, the details of your order (compounds, strengths, lot numbers, product or blend names), the name you ask certificates to be issued to, and anything you write to us, including notes sent through the "Ask the lab" box on your tracking page.

When we receive your samples: photographs of your vials taken at intake, which appear on your certificates, in your portal, and on your order-tracking page. Vial photographs and chromatogram images are stored at public web addresses so that certificates and tracking pages can display them; anyone who has an image's address can view it.

When you use the site: technical data such as IP address and browser type, used for security, fraud prevention, and performance measurement. We record the IP address an order was submitted from.

Payment is processed by Square; we never see or store your full card number. If you pay another way (for example Zelle or cash), we record the amount and the method.

2. How we use it

To test your samples, issue and deliver certificates, run the client portal and tracking pages, and send the emails that run an order: your invoice and up to two payment reminders, shipping instructions once you pay, receipt and correction notices, and certificate delivery. Our certificate email invites you to leave a Google review; that is optional and handled by Google on its own terms.

To keep laboratory records, to prevent fraud, abuse, and misuse of certificates, and, in de-identified aggregated form, to maintain and improve our methods.

We do not sell personal information, and we do not share it for cross-context behavioral advertising.

3. Certificates and tracking pages can be seen by anyone with the link

The verification lookup at kmdanalytical.com/verify shows anyone who has a certificate ID whether we issued it, the product, the issue date, and the certificate's SHA-256 fingerprint. The live certificate page — reachable from the lookup, from the QR code on the PDF, or from its link — shows the full certificate: the name it was issued to, any "Also named" parties, your lot number and label claim, the results, the chromatogram, and the vial photograph. The order-tracking link we email you shows your order's progress and vial photographs without a sign-in. Treat a certificate ID, a certificate link, or a tracking link as you would the certificate itself.

4. Who we share it with

Service providers that run our systems, only as needed to provide the Services and under contract to use the data for nothing else: hosting, site analytics, and encrypted off-site backups (Vercel); database, file storage, and portal sign-in (Supabase); transactional email (Resend); payments (Square); email hosting for messages you send us (Google Workspace); and an AI assistant (Anthropic) that our staff use to look up and summarize order details — your order information is processed by it only when a staff member asks it a question about your order, and it never contacts you.

Our employees and contractors who need it to do their jobs, and our professional advisers — attorneys, accountants, and insurers — all under confidentiality.

Anyone you ask us to name on a certificate, and anyone you give a certificate ID, certificate link, or tracking link to.

Law enforcement, regulators, accreditation bodies, or courts when required by law, subpoena, or an audit; when we believe in good faith that a sample or an order involves unlawful activity; to respond to a payment dispute; or where necessary to protect our rights or the safety of others. Anyone who checks a certificate on the verification page sees what the certificate shows, including whether it has been withdrawn or was never issued by us.

A buyer or successor of our business, who must honor this policy. No one else, and never for their own marketing.

5. Where your data lives

Our systems are in the United States. If you are outside the U.S., your information is transferred to and processed in the U.S., where privacy laws may differ from those where you live. We process it to perform your order, to keep laboratory records, and to protect the integrity of our certificates; by ordering, you agree to that. We do not offer a representative or rights beyond those in this policy for any other country.

6. How long we keep it

Laboratory records — orders, intake photographs, raw data, results, and the certificates themselves — are kept for at least 5 years, and for as long as a certificate remains verifiable or a dispute is open. We keep them because we must be able to stand behind, and if necessary defend, every certificate we issue, and because laboratory quality-system and legal requirements call for it. For that reason we cannot delete those records on request, even where a privacy law would otherwise give you a right to erasure (those laws allow records to be kept to meet legal obligations and to defend legal claims).

Because a certificate is a public document that others rely on, the certificate, its verification record, and the vial photograph stay available for as long as the certificate is verifiable. Contact and account details that are not part of a laboratory record are deleted on request. Nightly backups are kept for 30 days and mirrored, encrypted, off-site; information deleted at your request may persist in those backups until they expire.

7. Cookies and analytics

We use a session cookie to keep you signed in to the portal or admin console. We use Vercel Web Analytics and Vercel Speed Insights, which record page views, page performance, and a few product events (for example that an order form was submitted). They set no cookies and do not identify you by name; Vercel derives a short-lived visitor identifier from your IP address and browser. The order form saves your unfinished entries in your own browser's storage for up to seven days so you can resume; nothing from that draft reaches us until you submit. We use no advertising trackers.

No third party collects personal information about your online activities over time and across other websites through our site, and we do not respond to browser "Do Not Track" signals because we do not track you in that way.

8. Your choices and rights

You can ask what personal information we hold about you, ask us to correct it, or ask us to delete information not required for laboratory records, by emailing info@kmdanalytical.com. We will not treat you differently for exercising these rights. We are a small business that does not currently meet the thresholds that make the California Consumer Privacy Act apply to it; we honor these requests as a matter of policy, and we will honor any privacy rights that do apply to you under the law where you live.

9. Adults and businesses only; other people's information

The Services are not for anyone under 18, and we do not knowingly collect personal information from anyone under 18; if we learn we have, we delete it. If you give us someone else's information — a colleague's contact details or the name of a company you ask us to print on a certificate — you confirm you have the right to give it to us, and this policy covers how we use it.

10. Security and breaches

Data moves over encrypted connections and is held on access-controlled systems. No system is perfectly secure, and we cannot guarantee against every unauthorized access.

If we learn of a security breach that exposes your personal information, we will notify you at the email address on your order as soon as reasonably possible and as required by California law, and tell you what we know and what we are doing about it. That notice is the extent of our obligation for a breach, and any liability for one is subject to our Terms of Service.

11. Changes and contact

We may update this policy. Changes are posted here with a new effective date; if a change materially affects how we use information we already hold, we will email the address on your most recent order. Questions: info@kmdanalytical.com.