Labflow · Hello

Privacy notice

Last updated 12 October 2026

The short version: we use what you tell us to reply to you. Your answers are saved as you type so nothing is lost if you’re interrupted. We don’t sell your details, we don’t put advertising trackers on these forms, and we don’t keep your IP address.

Who is collecting your details

This form is run by Labflow, a Magentus company. Hello is the tool we use to run our contact and enquiry forms. Questions about your details go to privacy@labflow.ai.

What we collect

Your answers — whatever the form asks for, such as your name, work email, phone number, organisation and message.
Answers you haven’t sent yet. Each answer is saved to our system as you type, before you press Send, so you can pick up where you left off and so a dropped connection doesn’t lose your message. If you never send it, unfinished answers are deleted automatically after 30 days.You can clear them yourself at any time with Start over.
A little about your visit — your approximate country (from the network you’re on), the type of device (phone, tablet or computer), the language you chose, and how you arrived (for example which poster’s QR code you scanned). To stop abuse we keep a scrambled code made from your IP address with a secret key; the address itself is not kept in our database.

What is stored on your device

Your answers in progress, so they survive a reload — removed when you send the form or press Start over.
A random identifier, so we can count visitors without knowing who they are.
Your chosen language, if you change it.
Your contact details for next time — only if you tick “remember my details” on a form that offers it.

There are no advertising or third-party tracking cookies. On shared devices at events, forms can run in a mode that remembers nothing.

Please don’t send patient information

These forms are for enquiries. Please don’t include patient names, dates of birth, record numbers or other health details about anyone.

How we use your details

To reply to you and follow up on what you asked about. When you press Send, the team is emailed that a response arrived (your answers stay in Hello and are not put in that email). Some forms also send you an automatic thank-you email, which may include a copy of your answers; it goes only to the address you typed.
To understand, in aggregate, how our forms are used (for example how many people who scan a poster go on to send it) so we can improve them.

We don’t sell your details, and we don’t send your answers to AI services or use them to train AI models.

Who can see them, and where they are kept

Only the Labflow team members who handle enquiries, each with their own account. We keep a record of who opens or exports responses.

Hello runs on Cloudflare, which acts only on our instructions. Your answers are stored in a Cloudflare database located in its Oceania region (Australia), and the service runs in Australia where it can. Some handling happens elsewhere on Cloudflare’s global network: carrying your connection to the nearest data centre, sending emails and short-lived technical logs. So your details may be processed outside your own country. Emails we send you or the team are also handled by the recipient’s email provider.

How long we keep them

Sent responses are deleted automatically after 730 days, or sooner if you ask.
Unfinished answers are deleted after 30 days.
Visit counts (country, device, how you arrived — no answers) are deleted after 18 months.
Technical request logs are kept by Cloudflare for up to 7 days.
Deleted data can stay in the database’s encrypted backups for up to 30 days before it is gone for good.
Emails already delivered — to you, or to the team — stay in those mailboxes; they aren’t recalled when a response is deleted.

Your choices and rights

You can ask to see the details we hold about you, correct them, or have them deleted, and you can withdraw your consent at any time — email privacy@labflow.ai. Depending on where you live (for example Australia, Singapore, Malaysia, India, the UK or the EU) you may have further rights under local privacy law. If you’re unhappy with how we’ve handled your details, tell us first and we’ll respond within 30 days; you can also complain to your privacy regulator — for example the OAIC in Australia, the PDPC in Singapore or the Personal Data Protection Department in Malaysia.

Changes

If we change how we handle your details we’ll update this notice and the date at the top.