Atlas Portal (app.atlasbiolabs.com)Last updated: October 2026
This privacy policy uses the terms defined in Article 4 GDPR (including 'personal data', 'processing', 'controller', 'processor', 'consent' and 'data subject'). Where 'we' or 'us' is used, this refers to Atlas Life Sciences GmbH.
Atlas Portal is a multi-tenant platform for commissioning and handling laboratory services. Users are generally staff of research institutions, clinics, laboratories and companies; the platform is also open to self-payers. Tenants see only the data of their own tenant.
When app.atlasbiolabs.com is accessed, our servers automatically record standard access data: IP address, browser type and version, operating system, referrer URL and time of access.
Log files are stored for 7 days and are then deleted automatically.
Legal basis: Art. 6(1)(f) GDPR — legitimate interest in the secure operation of the platform.
We use essential cookies that are required for sign-in, session management and the shopping cart. Where relevant, we set analytics cookies only with your prior consent.
Marketing measurement. With your consent in the notice “Marketing measurement (OpenAI, Google, Meta, X, LinkedIn)” we set two cookies: atlas_utm records which campaign, ad or website brought you to us (campaign parameters, click IDs from Google, OpenAI, Microsoft, Meta, X and LinkedIn, referring domain, landing page; 90 days), and atlas_oppref holds only the click ID of an OpenAI ad (30 days). A third cookie, atlas_einwilligung, stores your decision and when you made it (180 days), also when you decline, so that we do not ask again; the decision applies to app.atlasbiolabs.com and protocol.atlasbiolabs.com together. Without your consent we do not set atlas_utm or atlas_oppref and delete any that exist. If you order with consent, we store the origin with the order and set a fourth cookie, atlas_messung_belege (60 days), so that a later withdrawal in this browser also reaches these orders. If the order came through an OpenAI ad, we report the start of the order and the purchase to OpenAI, from our server through the Conversions API and from your browser through an image tag (a single image request without a script). We report the event type, the event ID, the time, the amount, the currency and the click ID. We do not report the service ordered, sample material, health data or contact details; for products with their own price, however, the service can be inferred from the amount. With the image tag, OpenAI technically also receives your IP address, details of your browser (user agent, language) and our domain as the referring page. You can withdraw your consent at any time via “Change consent” in the page footer or at the bottom of this page. Withdrawing deletes the stored origin on your device and also stops the reports for orders you placed in this browser or with your account; reports already sent remain with the platforms. If you withdraw on protocol.atlasbiolabs.com, the same applies: your browser informs this platform of the withdrawal, and if that message does not arrive, we complete it on your next visit here.
Meta, X and LinkedIn. With the same consent we report your page views on this platform to Meta, X and LinkedIn (not on pages behind a sign-in and not on result pages) and, after an order, the purchase: to Meta from our server through the Conversions API and from your browser, to X and LinkedIn only from your browser. From the browser this is a single image request without a script (image tag); we do not transmit the address of the page you are viewing, the platform only sees our domain. We report the type of event (page view or purchase), for a purchase the amount and currency (to LinkedIn without the amount), and to Meta also an event ID with which Meta counts the reports from server and browser as one, the click ID of a Meta ad (fbc) and, where available, Meta’s browser ID (fbp). We report the purchase to each of these platforms only if you came to us through one of its ads (to Meta with its click ID, to X and LinkedIn if your order carries their click ID twclid or li_fat_id); for Meta we set the cookie _fbc for this, which holds only that click ID (90 days, for app.atlasbiolabs.com and protocol.atlasbiolabs.com together). We do not report the service ordered, sample material, health data or contact details; for products with their own price, however, the service can be inferred from the amount. With the image tag the platforms technically also receive your IP address and details of your browser, and your browser sends along the cookies that the platform itself has set for you; this allows it to link the request to an account with it. Without your consent none of this takes place, and we delete existing _fbc and _fbp cookies. We delete Meta’s IDs 90 days after the order, both with the order and in the log of reports.
Joint controllership. For the collection and transmission of your data by the image tags of Meta, X and LinkedIn in your browser (page view and purchase) we are joint controllers with the respective platform (Art. 26 GDPR); the platform alone is responsible for any further processing: Meta Platforms Ireland Limited (Merrion Road, Dublin 4, Ireland), Twitter International Unlimited Company (X; One Cumberland Place, Fenian Street, Dublin 2, Ireland) and LinkedIn Ireland Unlimited Company (Wilton Plaza, Wilton Place, Dublin 2, Ireland). You can exercise your rights against us and against the respective platform.
Acquisition ID. Our website protocol.atlasbiolabs.com assigns a random ID (acq_id) on your first visit, which is not derived from any details about you and says nothing about you. It lets us recognise the path from an ad or campaign to the order as one process: the campaign details including the creative of the ad, the referring domain, the country, the status of your consent and the times of the steps (visit to the landing page, click to order, visit to a service page, start of the order, redirect to payment, payment with the net amount, shipment of the sample kit, sample receipt, data delivery). Without consent the ID is only part of the address of the next page and of the order process, not stored on your device; with consent it is also stored in the cookie atlas_acq (90 days, for app.atlasbiolabs.com and protocol.atlasbiolabs.com together) so that both sites see the same ID. As the landing page we store only campaign pages (such as /baseline), never pages about individual tests. The order carries only the ID itself; we store the details of the process separately, accessible only to a narrowly limited group of administrators, and do not pass them on to any advertising platform. We delete the country, referring domain and landing page 90 days after the last contact; a process without an order is deleted entirely 180 days after the last contact, a process with an order 25 months after it. The legal basis is our legitimate interest in evaluating the success of our campaigns (Art. 6(1)(f) GDPR), and your consent for the cookie.
Origin stored with the order and retention. With the order we store the campaign details (source, medium, campaign), the referring domain, the landing page and the name of the advertising platform; the click IDs themselves and your decision on marketing measurement are stored separately and are accessible only to a narrowly limited group of administrators. We delete click IDs 90 days after the order, both with the order and in the log of reports to OpenAI and Meta; the other details are kept with the order, and your decision on marketing measurement as proof of consent. If you order through a partner’s page, the partner passes the campaign details on with the order. Without your consent we keep only the campaign details without click IDs and without storing anything on your device, based on our legitimate interest in evaluating the success of our campaigns (Art. 6(1)(f) GDPR).
Legal basis: Section 25(2) TDDDG and Art. 6(1)(f) GDPR for essential cookies; Section 25(1) TDDDG and Art. 6(1)(a) GDPR for all others.
To provide access to the portal we process: name, email address, organisation, role within the tenant and sign-in times. Access is granted through a personalised sign-in link; for this purpose we store an access token and the time of the most recent sign-in.
Legal basis: Art. 6(1)(b) GDPR — performance of a contract and pre-contractual measures.
Access to an order is granted only to persons who work on the order and its results in a professional capacity. Persons who only handle ordering, sample shipment or invoicing are held as a contact without access.
When you send an enquiry or place an order we process: name, email address, telephone number, organisation, delivery and billing address, VAT identification number, order number and the details of the commissioned procedure.
Purposes: preparing quotations, order handling, sample tracking, provision of results, invoicing, customer communication and compliance with statutory obligations.
Legal basis: Art. 6(1)(b) GDPR — performance of a contract; Art. 6(1)(c) GDPR for obligations under commercial and tax law.
Retention period: customer and contact data for 3 years after the last transaction; order and invoice data relevant under commercial and tax law for 10 years pursuant to the German Commercial Code (HGB) and the German Fiscal Code (AO).
Payments in the self-service checkout are handled by Stripe. Payment data is processed by Stripe and is not stored on our systems. Where payment is made against an invoice, we process the invoice and payment receipt data ourselves.
Legal basis: Art. 6(1)(b) GDPR.
Samples and the genetic, epigenetic and molecular biological data derived from them are managed through the platform. Where such data relates to identifiable natural persons, it constitutes special categories of personal data within the meaning of Art. 9 GDPR.
Allocation of roles. Where an institution commissions an analysis of third-party samples (for example from study participants or patients), the commissioning institution is the controller and Atlas is the processor pursuant to Art. 28 GDPR. In that case, obtaining the data subject's consent and establishing the legal basis are the responsibility of the commissioning institution. For self-payers who commission an analysis of their own sample, Atlas is the controller; the legal basis is explicit consent pursuant to Art. 9(2)(a) GDPR, obtained before processing begins.
Storage and access. Samples and derived data are stored at the laboratory of Atlas Life Sciences GmbH in Germany and in the platform; samples and the data derived from them remain within the EU. Access is restricted to authorised laboratory, bioinformatics and service staff and to the authorised persons of the respective tenant.
Limits on use. We do not sell genetic data. We do not disclose genetic data to insurers or employers; such disclosure is prohibited under Section 4 GenDG. We do not use the data for our own research purposes and do not publish identifiable data without separate explicit consent.
Retention period. Samples and derived data are retained for as long as no deletion or destruction is requested. Controlling institutions and self-payers may request the destruction of the sample and the deletion of the data at any time at service@atlasbiolabs.com. Deletion extends to commissioned laboratories and service providers. Order and invoice data that must be retained under commercial and tax law remains unaffected; it contains no genetic data.
Diagnostic use. Services commissioned through the platform are non-diagnostic unless expressly agreed otherwise. Diagnostic or predictive use, and the communication of findings, take place exclusively through a responsible physician in accordance with the GenDG.
To handle orders we send transactional messages (quotations, order and status notifications, invoices, access links). Legal basis: Art. 6(1)(b) GDPR. For messages that do not serve order handling, Art. 6(1)(a) or (f) GDPR applies; you may object at any time and without any particular form.
We engage the following processors and recipients to deliver the service:
The service providers named above as processors are bound by data processing agreements pursuant to Art. 28 GDPR. We transmit measurement data to OpenAI, Meta, X and LinkedIn only with your consent (section 5).
Where data is processed outside the EU, the transfer takes place on the basis of standard contractual clauses and, where applicable, the EU-U.S. Data Privacy Framework. Samples and the genetic data derived from them are processed and stored exclusively within the European Union.
You have the following rights in respect of your personal data:
Contact: service@atlasbiolabs.com
If your request concerns data that we process on behalf of an institution, we forward it to the controlling institution and inform you accordingly.
You have the right to lodge a complaint with a supervisory authority.
Competent supervisory authority: Berliner Beauftragte für Datenschutz und Informationsfreiheit (BlnBDI), Friedrichstraße 219, 10969 Berlin, Germany, https://www.datenschutz-berlin.de
For all data protection enquiries: service@atlasbiolabs.com
With your consent we remember which ad or campaign brought you here (for example the click ID from OpenAI, Google or Meta) and report the start of an order and a purchase to OpenAI, and a purchase to Meta, X and LinkedIn: the event, the amount and the click ID, never your contact details. Meta, X and LinkedIn also count your page views for this, without the address of the page. We do not name the service, but for single products it can be inferred from the amount. Switching it off deletes the stored origin on your device and also stops the reports for orders you placed in this browser or with your account.
Not decided yet.
Atlas Portal is a product of Atlas Life Sciences GmbH, Berlin.