Privacy Policy

Draft — not for publication as written

PLACEHOLDER: This Privacy Policy is a working draft prepared for review. It has not been reviewed by legal counsel and must not be published until qualified counsel has confirmed it against the privacy laws applicable to the Laboratory's jurisdiction and to the jurisdictions of its clients and site visitors — which may include state privacy statutes, the GDPR, and the UK GDPR. Every bracketed item requires an owner or counsel decision, and several require confirming what the deployed website and hosting stack actually collect. Do not publish a description of data practices that does not match the live implementation. Delete this notice only after that review is complete.

PLACEHOLDER: legal entity name, entity type, state of formation, and registered address of the data controller.

PLACEHOLDER: effective date and version of this policy.

1. Scope

This policy describes what information Arcadia Diagnostics collects through its website and certificate of analysis lookup, what it does with client and testing information, and how to make a request about your data.

Arcadia Diagnostics tests materials, not people. We do not accept human or animal biological specimens, we do not perform clinical or diagnostic testing, and we do not hold health information about any individual.

This policy covers the website and the COA lookup. Handling of client testing records is also governed by the confidentiality terms of the services agreement and the Terms of Service.

2. Information collected through the website

Information you send us. If you email us or use a contact form, we receive what you choose to send: typically your name, email address, organization, and the content of your inquiry, including any details you supply about a material or a testing requirement. We keep inquiry correspondence as a business record.

PLACEHOLDER: confirm whether the site has a contact form at all, and if so exactly which fields it collects and where submissions are delivered and stored.

Server logs. Our hosting infrastructure records standard technical information about requests: IP address, user-agent string, requested URL, referring URL, response status, and timestamp. These logs are used to operate the site, diagnose faults, and detect abuse.

PLACEHOLDER: server log retention period, and the hosting provider acting as processor.

Cookies and analytics. PLACEHOLDER: state exactly what the deployed site sets. If the site uses no cookies and no analytics, say so plainly — it is the strongest and simplest statement. If analytics are added, name the provider, state what it collects, whether IP addresses are truncated, and provide a consent mechanism where required. Do not claim "no tracking" unless the implementation matches.

We do not use advertising networks, cross-site tracking pixels, or cross-context behavioral advertising.

3. The certificate of analysis lookup

The COA lookup requires no account and no registration. You do not sign in and we do not ask who you are.

What is logged. For each lookup we record the accession number submitted, the timestamp, the requesting IP address and user-agent, and whether a record was returned. Nothing else.

Why it is logged. Solely to protect client confidentiality and site availability:

• Rate limiting. Lookups are rate limited per source. Logs are what make that enforceable.

• Abuse and enumeration detection. Certificates are private by default and accession numbers are high-entropy and non-sequential precisely so the record set cannot be walked. Repeated failed lookups are the signature of an attempt to guess identifiers, and we monitor for it.

• Integrity investigations. Where a forged or altered certificate is circulating, lookup logs help establish what was actually retrieved and when.

Lookup logs are not used to profile visitors, are not combined with marketing data, and are not shared for any commercial purpose.

PLACEHOLDER: lookup log retention period, and the specific rate limit thresholds if the owner wishes to publish them.

What is displayed. Published certificates show analytical and sample information only — report and accession identifiers, status and dates, sample as received, methods, results with units and reporting limits, and the client-declared lot identifier. Submitter names, individual contact details, addresses, internal client codes, and pricing are never displayed. No personal data about any individual appears in a published certificate.

4. Client and testing information

For clients, we hold the information needed to run the engagement and keep a defensible record: contact details for the people we correspond with, submission and chain-of-custody records, sample descriptions and declared identities, raw analytical data, reports, and billing records.

Testing data is confidential by default. Client identity, sample information, and results are not disclosed to third parties except with the client's written authorization, to subcontractors engaged for the work under equivalent confidentiality obligations, or where required by law.

We do not confirm client relationships. We do not tell third parties whether a person or company is a client, or whether any product or lot has been tested here.

Publication is opt-in. A certificate appears in the COA lookup only where the client has given written, revocable authorization identifying which fields may be displayed. Publication is never automatic and never applied retroactively to past reports.

PLACEHOLDER: policy on withdrawal of publication, including whether a previously published certificate can be de-published at client request and whether unfavorable results can be removed. This is an integrity decision the owner must make deliberately and state here.

5. How information is used

We use the information described above to:

• respond to inquiries and prepare quotations;

• perform, document, and report testing;

• issue submission instructions and manage sample custody;

• invoice and collect payment;

• maintain analytical and quality records for the retention periods stated in our Terms;

• operate, secure, and troubleshoot the website and COA lookup, including rate limiting and abuse detection; and

• comply with legal obligations and respond to lawful requests.

PLACEHOLDER: if the GDPR or UK GDPR applies to any visitor or client, counsel should map each purpose above to a lawful basis — contract, legitimate interests, or legal obligation — and record the legitimate interests assessment for the log and rate-limiting processing.

We do not use client testing data to train models, to build market intelligence products, or for any purpose beyond delivering and documenting the engagement.

6. We do not sell your data

We do not sell personal information. We do not share it for cross-context behavioral advertising. We do not rent, trade, or otherwise make personal information or client testing data available to data brokers, marketers, or any third party for their own purposes.

We do not publish client lists, client logos, testimonials, or aggregate statistics derived from client work.

Information is disclosed only to:

• service providers acting on our instructions, such as website hosting and email — PLACEHOLDER: name the actual providers used, or state the categories, and confirm data processing terms are in place with each;

• subcontract laboratories, where a determination is referred, under confidentiality obligations and in accordance with the Terms of Service; and

• authorities, where disclosure is required by law, court order, or valid legal process. Where we are permitted to notify the affected client, we will.

7. Retention

PLACEHOLDER: retention schedule. State separately: inquiry correspondence; client account and billing records; sample retention; raw analytical data and reports; server logs; COA lookup logs. Each needs a period and a rationale, and the analytical record periods should match the Terms of Service.

We retain analytical records for the period stated in our Terms of Service so that an issued report remains supportable. Records are deleted or securely destroyed at the end of the applicable period.

8. Security

Access to client testing records is limited to personnel who need it to perform or review the work. Systems holding client data are access-controlled and reports are released only by an authorized signatory.

The COA lookup is designed so that confidentiality does not depend on obscurity of the interface alone: identifiers are high-entropy and non-sequential, there is no listing or index endpoint, requests are rate limited, and unauthorized records are indistinguishable from nonexistent ones in the response.

PLACEHOLDER: describe actual technical and organizational security measures in place — transport encryption, at-rest encryption, backup practice, access control, and incident response. Do not describe controls that are not implemented.

Email is not a secure channel. Information you send by email may be read in transit or at rest by parties outside our control. Do not send anything by email that requires stronger protection; contact us first and we will agree an alternative.

PLACEHOLDER: breach notification commitment and timeline, aligned to the notification laws counsel identifies as applicable.

9. Your rights and how to make a request

Depending on where you live, you may have rights to access, correct, delete, or obtain a copy of personal information we hold about you, to object to or restrict certain processing, and to be free from discrimination for exercising those rights.

PLACEHOLDER: enumerate the specific rights that apply under the privacy laws counsel identifies — for example GDPR/UK GDPR access, rectification, erasure, restriction, portability, objection, and the right to complain to a supervisory authority; and state-level rights to know, delete, correct, and opt out. Include the supervisory authority or attorney general contact route where required.

To make a request, email arcadiadiagnostics.contact@gmail.com with the subject line "Privacy request". We will ask for information sufficient to verify that the request comes from you or an authorized agent.

PLACEHOLDER: response timeframe commitment, verification method, and appeal process where required by applicable law.

Note that requests to delete may be limited where we are required to retain analytical records, billing records, or correspondence to support a report we have issued or to meet a legal obligation. Where that applies we will tell you what is being retained and why.

10. Other matters

Children. The website is directed to businesses and research organizations. We do not knowingly collect information from children. PLACEHOLDER: confirm the applicable age threshold for the jurisdiction and state it.

International transfers. PLACEHOLDER: state where data is stored and processed, and the transfer mechanism relied on if data leaves the jurisdiction of a client or visitor whose law requires one.

Third-party links. Pages on this site may link to external references such as standards bodies and published literature. Those sites have their own privacy practices and this policy does not cover them.

Changes. We may update this policy. The current version and its effective date appear at the top of this page. PLACEHOLDER: how material changes are communicated to existing clients, and where prior versions are archived.

Additional contact details

PLACEHOLDER: postal address for privacy requests, and the name or role of the person responsible for privacy inquiries. A postal route is required under several privacy statutes and cannot be satisfied by email alone.

PLACEHOLDER: if a Data Protection Officer or EU/UK representative is required, name them here with contact details — or confirm with counsel that none is required.