1Who we are
Labmart (“we”, “us”) runs a business-to-business marketplace for laboratory supplies in the Kurdistan Region of Iraq. Laboratories order consumables from supply companies through Labmart, and Labmart’s drivers deliver the orders.
Labmart is for businesses only: our team creates every account after checking the business. Labmart does not offer lab tests or medical services, and it does not handle patient or health data.
We handle personal data in line with the laws of Iraq and the Kurdistan Region that apply to us. For any question about this policy or your data, contact us through the Help and contact page.
2Data we collect
We collect only the data in this table.
| Data | From whom | How we get it | Why |
|---|---|---|---|
| Name and phone number | All users | From your account request, or given to our team when we create your account. You log in with your phone number. | Your account; contacting you |
| Business name, address, map pin and licence number | Labs and suppliers | Given when the account is created; kept up to date by our team | Delivery; verifying the business |
| Orders, invoices and payments | Labs and suppliers | Created as you use the app: orders you place or receive, payment records, invoices and payout statements. Suppliers give our team the account that receives their payouts. | Providing the service; accounting |
| Precise location | Drivers, only during an active delivery trip | From the driver’s phone, with the driver’s permission, from Start trip until the trip ends | Showing the lab where its order is |
| Photos | Drivers (pickup and drop-off proof); suppliers (product photos) | Taken with the in-app camera, or chosen from the photo library by the user | Proof of delivery; the product catalog |
| Push token and device name | Users of the iPhone and Android apps | From your device when you log in and allow notifications | Notifications |
| Request-an-account and website deletion forms (business name, account type, city, contact name, phone, licence number, note) | Anyone who sends one of these forms | Typed into the form in the app or on this website | Creating accounts; deleting accounts |
| IP address | All users | From your internet connection when you use the app or this website | Security and fraud prevention: limiting login attempts, and the audit log of file access and admin actions |
| Content you add: product listings and CSV imports, order notes, listing reports | Suppliers (listings); labs (order notes); any user (reports) | Typed or uploaded in the app | The catalog; deliveries; reviewing reported listings |
We do not collect health or patient data, your contacts or advertising identifiers. There are no ads, no analytics tools and no tracking in the app or on this website. Labmart never receives your bank or card details: FIB payments are made inside the FIB app.
3How we use your data
- To create and manage your account, and to check that businesses are licensed.
- To show products, take orders, work out prices and delivery fees, and deliver orders.
- To record payments, issue invoices and payout statements, and keep accounting records.
- To send notifications about your orders, payouts and account.
- To keep Labmart secure and prevent fraud.
- To answer your questions and requests.
We do not use your data for advertising, and we do not sell it.
4Driver location
Only the driver part of the app uses location. Lab and supplier accounts never access your location.
- The app asks for location access “while using the app” only. It never asks for “Always” access.
- Sharing starts when the driver taps Start trip. It stops automatically when the order is delivered, returned or cancelled, when the driver is released from the job, at logout, or when the driver taps Stop.
- During a trip the position keeps updating if the driver briefly switches to another app, such as a phone call or navigation. The phone shows the location indicator (iPhone) or a notification (Android) the whole time.
- Only the lab that placed the order and Labmart’s team see the driver’s live position.
- We keep only the driver’s last position and the position of each delivery step in the order history, and we delete these after 90 days.
5Photos
Proof photos are taken with the in-app camera and are not saved to your phone’s gallery. We remove location and camera data (EXIF) from every uploaded photo.
Proof photos are private: only the driver who took them and Labmart’s team can open them, and we delete them after 180 days. Product photos are shown publicly in the catalog.
6Who can see your data in Labmart
- Labs see the name, address and phone number of the suppliers on their orders, and the name and live position of the assigned driver during the trip.
- Suppliers see the name, address and phone number of the labs that order from them.
- Drivers see the names and addresses of the lab and the supplier for open and assigned jobs, and their phone numbers only for jobs assigned to them.
- Labmart’s team can see all data in order to run the service. Every admin action and every opening of a private file is recorded in an audit log.
8How long we keep data
| Data | How long we keep it |
|---|---|
| Your account: name, phone number, login, push tokens and favorites | Until your account is deleted, within 30 days of your request |
| Orders, invoices, payments, supplier balances, payouts and driver cash records | At least 7 years, for accounting. They stay after your account is deleted, without your name or phone number. |
| Proof photos | 180 days |
| Delivery positions in the order history, and the last position of inactive drivers | 90 days |
| Notifications | 180 days |
| Expired and ended login sessions | 30 days |
| Audit log, including IP addresses | 2 years |
| IP addresses used to limit login attempts | At most 1 hour, in memory only |
| Account requests, deletion requests and listing reports | 1 year after we handle them |
Our encrypted backups keep a copy of deleted data for up to 6 more months. After that it is gone.
9Security
All data is encrypted in transit (HTTPS). Passwords are stored only as secure hashes. Sensitive fields, such as supplier payout account numbers, are encrypted in our database, and our backups are encrypted. Access is limited by role, our administrators use two-step verification, and our logs do not contain passwords, tokens or phone numbers.
10Your choices and rights
- See or correct your data: ask us for a copy of your data or for a correction. Our team updates business details; you can change your language and password in the app.
- Location (drivers): you can turn off location access at any time in your phone’s settings. You can still accept and complete jobs; the lab then sees that the live position is not available.
- Notifications: you can turn them off in your phone’s settings. The app keeps working, and you see updates when you open it.
- Camera and photos: allow or deny access in your phone’s settings.
- Delete your account: at any time, as described below.
11Deleting your account
In the app: Profile → Delete account, then confirm with your password. Without the app: use the form on the Delete account page. We complete every deletion within 30 days.
We erase your name, phone number, login, the notification tokens of your devices and your favorites. Orders, invoices, payments and accounting records are kept without your name or phone number, because accounting records must be kept. Drivers who still hold collected cash must hand it over first.
12Children
Labmart is a service for businesses and is not meant for anyone under 18. We do not knowingly collect data from children.
14Changes to this policy
When we change this policy, we update the version and the effective date at the top of this page. If the change is important, the app asks you to read and accept the new version.
15Contact
Questions about your data, or a request to see, correct or delete it: contact us through the Help and contact page.