Privacy notice

PerfLab provides tools for scientific data analysis and cooperation. This notice explains how the Institute of Scientific Instruments handles personal data when you use PerfLab.

Who is responsible

PerfLab is operated and hosted by the Institute of Scientific Instruments of the Czech Academy of Sciences, v. v. i. (Ústav přístrojové techniky AV ČR, v. v. i.), Královopolská 147, 612 00 Brno, Czechia, identification number 68081731.

For all PerfLab privacy questions, rights requests, account questions and deletion requests, please contact perflab@isibrno.cz. You may also contact the institute’s data protection officer through institute@isibrno.cz or the postal address above. The institute also publishes institutional data protection information.

Your account and use of PerfLab

Accounts are necessary to operate PerfLab: they identify users, control access to projects, and let users run and manage their analyses as part of scientific cooperation.

We process your name, email address, institution, protected sign-in credentials, account permissions and settings. We keep access-request correspondence and the version of the Terms of access you accepted. We also store information associated with your use of the service, such as login times, projects, analysis and processing records, saved variant plans, and export requests. If you use the optional game, its best score is saved in your account; the leaderboard can show your name and score to other users with access to the game.

Where in-app terms acceptance is enabled, we also record the accepted terms version, a fingerprint of the reviewed text and the acceptance time to document the agreement. This acceptance is separate from consent to optional browser preferences.

Technical and security records can contain your account identifier, IP address, request details, timestamps and error information. We use these records to operate the service, diagnose failures, protect accounts and investigate misuse.

Providing the information needed for an account is necessary to receive authenticated access to PerfLab. Optional appearance preferences and the game are not required to use the analysis tools.

Legal grounds

We process the account information necessary to provide the PerfLab service agreed with you under Article 6(1)(b) GDPR (performance of a contract). This includes identifying you, controlling access to your projects, and enabling you to run and manage analyses. We do not rely on optional consent for this necessary account operation.

Remembering optional browser preferences is based on your consent, which you can withdraw through Cookie settings.

Where necessary to meet our GDPR obligations to protect personal data, demonstrate compliance and handle rights requests, we process limited security/audit information and maintain a minimal deletion record under Article 6(1)(c) GDPR (legal obligation), in connection with Articles 5, 17 and 32. This processing is limited to what those obligations require.

Research data you upload

Only anonymized research data may be uploaded by default. Pseudonymized research data may be uploaded only under a prior mutual written agreement between your institution and the Institute of Scientific Instruments covering the proposed processing in PerfLab.

Before uploading, remove direct patient identifiers, including those in filenames, metadata and images. Identification keys must never be uploaded. You are responsible for ensuring that uploading and processing are permitted by your institution and applicable national laws governing patient data.

For permitted pseudonymized data, the written agreement must address the institutions' respective responsibilities, permitted processing, security, access, retention and deletion, together with any required data protection terms. Such an agreement does not replace the legal grounds or authorizations required for processing patient data.

Who can access the data

Administrative access is restricted to PerfLab administrators. Users access their projects and analyses according to the application's permissions. Research data are hosted at the institute in Brno, Czechia.

This notice does not authorize sharing patient data with other users or transferring them to another institution. Any such processing must be covered by the applicable permissions and institutional arrangements.

How long data are kept

Access-request correspondence is kept for as long as needed to handle your request and document the agreement governing your access. Your account and its settings are kept while the account is maintained. You can request account deletion at perflab@isibrno.cz; accounts are not automatically deleted solely because they are inactive. You manage your analyses in PerfLab. Analyses may also be removed by the administrators after prior notice.

Application diagnostic logs use daily rotation with a normal retention of 14 days; expired files are removed when rotation next runs. Web-server and container logs are overwritten as their configured storage limit is reached, so they do not have a fixed retention time. MCP security audit records are normally cleaned after 90 days. These operational records may therefore remain for their own retention period after account deletion.

Deleted account data may remain in encrypted recovery backups until those copies expire. The normal backup rotation can retain selected copies for approximately two years and seven months; its most recent recovery copy is preserved if no newer backup is available. Backups are retained for recovery rather than routine use. A minimal protected deletion record is kept while a recoverable backup may contain the account, so account deletions can be reapplied before access is reopened after a restore.

Any different retention obligations for research data accepted under a written agreement must be stated in that agreement.

Cookies and browser preferences

Necessary cookies support sign-in, sessions and form security. Optional browser storage remembers your appearance preference only after you accept it. We do not use analytics, advertising cookies or third-party tracking services in PerfLab. See the cookie policy for the storage details and how to change or withdraw your preference consent.

Your rights

Depending on the applicable legal ground and circumstances, you may request access to your personal data, correction, erasure or restriction of processing, object to processing, or request data portability. Where processing is based on consent, you may withdraw it without affecting the lawfulness of processing before withdrawal.

Please send rights requests primarily to perflab@isibrno.cz, so the PerfLab administrators can handle them. You may also contact the institute’s data protection officer through institute@isibrno.cz. We may need to verify your identity before acting on a request. You also have the right to complain to the Czech Office for Personal Data Protection (ÚOOÚ).

Changes to this notice

We will update this notice when the way PerfLab processes personal data changes. Material changes will be communicated through the application or the contact details associated with your account.