Information used to provide your account
AssayNova stores your account email, basic profile, verification status and submitted testing, contact and report recovery requests. We also keep necessary session, security and rate-limit records. Public report lookup is separate: an email address or Google identity does not establish ownership of a laboratory report.
Google sign-in
When Google sign-in is enabled and you choose it, Google shares a provider identifier, basic name, email and verification information with AssayNova. We use these for sign-in, deliberate account linking and security confirmation. We do not receive your Google password, access Gmail or other mailbox contents, Drive or Calendar, fetch your avatar, or store Google access or refresh tokens. Google independently handles its own sign-in and privacy practices.
Requests and transactional messages
We use account information to manage the requests you submit, support account recovery and send transactional messages when email delivery is enabled. We do not use Google sign-in for marketing or infer report ownership from it. Optional analytics or advertising consent is not required for account access or COA lookup.
Necessary cookies and private storage
Requested account access uses host-only session and account-form security cookies scoped to /api/account. Sign-in expires after 24 hours of inactivity or 7 days in total. The sign-in-form challenge lasts 10 minutes; an authenticated security cookie lasts up to 7 days. If you explicitly start enabled Google sign-in, linking or reauthentication, an_google_flow_[port] provides browser binding and PKCE. It is Secure, HttpOnly and SameSite=Lax, scoped to /api/account/oauth/google, lasts at most 10 minutes and is cleared on a completed, canceled or expired flow. Privacy settings explain the preference cookie and legacy browser storage separately.
Service providers and retention
Private server storage and applicable hosting and email providers support account operation and transactional delivery. We retain account records for account operation. Deleting an owned request from My requests removes that request from the active account records; operational and private backups may retain earlier copies. We do not promise a fixed deletion period here.
Your choices and contact
You can correct available profile fields and delete owned requests in My account. When another sign-in method is available, you can disconnect Google in account Security. Removing Google permissions or disconnecting sign-in does not itself erase existing AssayNova records. Contact [email protected] for privacy, access, correction or deletion requests, which are handled manually.