A shared space for your lab.

Scope and purpose

This notice concerns collaboration on the HZI service, including membership, sharing, synchronization, and administration. These functions use personal data to identify contributors, control access, deliver shared work, and investigate service problems. Mail connections and optional AI features have their own configured destinations and are outside this notice.

Visiting this information page is covered separately by the website privacy policy. The website and the HZI collaboration server are separate services.

Data processed by the service

• Membership: display name, work email address, lab membership, role, permissions, and invitation records.
• Shared work: messages, replies, files, tasks, notepad contributions, lab directory profiles and groups, and project information. Profiles can include work contact details and positions; projects can include funding and timelines.
• Synchronization: author and device identifiers, device labels, timestamps, and records of shared changes. Access credentials authenticate requests; the server stores credential hashes.
• Administration and diagnostics: audit records of administrative and membership actions, including the action, actor, target, time, and client IP address, plus operational logs. Online and away presence is temporary and held in memory.

Collaboration does not synchronize your mailbox, mailbox password, private notes or tasks, private contacts, or private personnel and salary records. Information you copy into a shared message, file, or record becomes shared content, including copied email text.

Who can access shared data

Authorized lab members can access shared features according to their permissions. The membership directory identifies colleagues in the lab. Assigning a shared task to one person does not make the task private. Lab administrators manage access and can inspect their lab’s audit trail.

Collaboration is not end-to-end encrypted. Operators with access to the server or its backups can access stored data. HZI must confirm the operational access arrangements, hosting and backup locations, and any service providers as part of finalizing this notice.

History, deletion, and local copies

Revoking a membership on the server stops future access for that member. Leaving a lab or revoking access does not erase earlier contributions, audit records, or downloaded copies, including copies on a former member’s devices.

Shared edits and deletions are recorded in the synchronization history, so earlier text and file metadata can remain there. Deleting a message or channel removes its attached file bytes from active storage; backups and downloaded copies may retain them. Unsent file uploads expire after seven days. That period does not apply to messages, memberships, audit records, or backups.

The service’s overall retention periods and deletion process have not yet been specified for this notice.

Using the browser app

Vercel serves the browser interface. The interface communicates directly with the HZI server for authentication and collaboration; shared data is not proxied through the website. The interface code runs in your browser and can access the shared content it displays.

The browser retains downloaded collaboration content, drafts, and pending changes in local site storage. Signing out does not erase that storage. Clearing this site’s browser data removes those local copies, including unsent changes.

In the SSO implementation, the application session lasts at most eight hours and its token stays in memory. Reloading requires sign-in again. The temporary sign-in proof lasts at most ten minutes; identity-provider tokens and the client secret stay out of the browser interface.

Planned SSO identity processing

The planned LS Login integration will use identity information to connect a sign-in to an approved lab membership. The exact attributes received, session handling, and retention must be documented here before SSO is enabled. The current invitation flow does not use LS Login.

Questions and data protection rights

Contact the project or HZI’s Data Protection Officer below about your data. Depending on the applicable conditions, GDPR rights include access, correction, erasure, restriction, portability, and objection. You may also complain to a data protection supervisory authority. See HZI’s data protection information.