Privacy policy

ZERA Bioanalytics, Möhe 118, 2563 Ipsach, Switzerland (contact@zerabioanalytics.ch), is the controller responsible for the personal data described in this policy. This policy explains what we process in order to accept a sample and issue a report, and what we deliberately do not.

We provide services to businesses and organisations. The personal data we handle is largely limited to the business contact details of the people who order analyses on behalf of a client, together with the records needed to perform and verify an analysis.

To accept a sample and return a report we process: the contact and business details you provide (such as name, organisation, email address, and where relevant order and client references); the metadata of the sample and the analysis ordered; and the resulting analytical record. We also process limited technical data, such as server logs and the information needed to keep the site secure and functioning.

We do not seek, and ask you not to send us, special categories of personal data. A sample is a material for analysis, not personal data about an individual.

We process this data to perform the contract for analysis and to issue and verify reports; to comply with our legal and accounting obligations; and to pursue our legitimate interests in operating, securing and improving our services and in preventing misuse of the verification system.

Depending on the law that applies to you, our legal bases under the Swiss Federal Act on Data Protection (FADP) and, where it applies, the EU General Data Protection Regulation (GDPR) are: performance of a contract, compliance with a legal obligation, our legitimate interests, and — for anything that requires it, such as non-essential cookies — your consent, which you can withdraw at any time.

Samples are logged against a reference rather than a client name, so that the analytical record and the client identity are not held together by default.

Results are released only to the client who submitted the sample. ZERA does not publish client results.

Our verification service accepts a report identifier together with a task number and returns only whether a matching published record exists and corresponds to what was presented. It does not return confidential dossier data, and a failed lookup is indistinguishable from a lookup of an identifier that does not exist.

To protect against guessing, a small number of failed attempts against a report are rate-limited, and we keep a short-lived audit record of verification attempts.

We use only the cookies and local storage strictly necessary for the site and the verification flow to function — for example to remember your language and to hold a short-lived, secure token after you have entered a valid task number. We do not use these for advertising.

If we introduce any non-essential or analytics cookies, we will ask for your consent first.

Payment is handled through our payment method or processor. Where payment is made in cryptocurrency, the transaction is recorded on a public ledger outside our control. We do not collect or store full card or bank credentials.

We do not sell personal data. We share it only with service providers that process it on our behalf under contract — such as our hosting, database and storage providers, and our payment processor — and with authorities or professional advisers where we are legally required or entitled to do so. These providers may use the data only to provide their service to us.

Our infrastructure providers may process data on servers located in Switzerland, the European Economic Area, or other countries. Where data is transferred to a country without an equivalent level of protection, we rely on appropriate safeguards, such as standard contractual clauses or an applicable adequacy decision.

We keep issued report records for as long as a client may reasonably need to rely on and verify them, and to meet our legal and accounting obligations — generally for at least ten years from issue. Business contact and order data is kept for the duration of the client relationship and the statutory retention periods that follow it.

Physical samples are destroyed once the analysis and any re-analysis are complete. Technical logs and verification-attempt records are kept only for the short period needed for security and troubleshooting.

We use technical and organisational measures appropriate to the risk, including access controls, encryption in transit, the separation of analytical records from client identity, and keeping task numbers out of URLs, report images and shared links.

Depending on the law that applies to you, you may have the right to access the personal data we hold about you, to have it corrected or deleted, to restrict or object to its processing, and to receive it in a portable form. To exercise a right, contact us at the address above; we may need to verify your identity first.

If you are in Switzerland you may also contact the Federal Data Protection and Information Commissioner (FDPIC). If the EU GDPR applies to you, you may lodge a complaint with your local supervisory authority. We would ask you to raise any concern with us first so that we can address it.

Our services are directed to businesses and are not intended for children, and we do not knowingly process children’s personal data.

We may update this policy from time to time. The version in force is the one published here, with the date shown above. Questions or requests about this policy and your data can be sent to contact@zerabioanalytics.ch.