Personal Data Collection Statement

1. PIIS

PIIS is a record of laboratory procurement and inventory, operated as a controlled pilot, and may be withdrawn. PIIS also holds a register of laboratory method documents, with the successive versions of each document. It further holds a shared roster of routine laboratory duties — which member is to do what, by when — with the record of each duty's completion or cancellation. PIIS also carries a noticeboard: a member may post a notice to the laboratory, which is shown on the home page until the time chosen by that member; past notices remain listed on the noticeboard. Registered documents, the duty roster and the noticeboard are visible to every signed-in member.

User accounts are issued to laboratory members. Signing in is required for every page of PIIS other than the sign-in, lockout and password-reset pages and this Statement. Signing in requires the password and, in addition, a code that PIIS sends by email to the address recorded for the account; a member may choose to have a particular browser trusted for 30 days, during which the code is not requested from that browser.

The authoritative records of the laboratory are the University's official systems and the physical stock held; in the event of a discrepancy between PIIS and verified physical stock, the physical stock prevails and the record is corrected.

Sign-in is governed by the sign-in protection component. The count of failed attempts is kept against the account name and not against the computer used; repeated failed attempts against an account name, by any person, lock that account name for approximately 30 minutes. The administrator (section 6) can unlock the account.

2. Purposes of collection

PIIS processes personal data for the following purposes:

• administering user accounts and controlling access to PIIS;
• recording and administering laboratory procurement and inventory activity, including what is ordered, received, stored and consumed;
• making stock already held visible to laboratory members, so that items are not purchased a second time, and identifying items that have expired or are approaching expiry;
• attributing requests, receipts, stock movements and issues to the members who performed or received them;
• tracing stock, batches and problem cases;
• registering laboratory method documents and maintaining the record of their successive versions;
• assigning routine upkeep duties to members and recording their assignment, reassignment, completion and cancellation;
• publishing notices from members to the laboratory, and keeping past notices available to members;
• sending members email concerning their accounts and the records that concern them, and verifying sign-in by a code sent by email;
• protecting the security of user accounts and investigating unsuccessful or abnormal sign-in activity;
• diagnosing system errors and maintaining, backing up and restoring the system; and
• responding to requests concerning personal data held in PIIS.

Personal data will not be used for purposes incompatible with those stated above.

3. Personal data collected

The following personal data are collected:

• the account name and the email address of each member, and, if provided, a name;
• the account name of the member who raised each request;
• the account name of the member who received goods, moved stock, opened a container, placed or released a hold, or worked on a problem case;
• the account name of the member to whom an item was issued, and of the member who issued the item. Where one member collects an item for another, these two account names differ;
• the text entered by members into free-text fields, including notes, reasons and descriptions of problems;
• the account name of the member who registered a method document or a new version of one, and the description that member gave of what changed;
• personal data contained in the text of a method document, where a member has written such data into it;
• the account name of the member to whom a duty is assigned, of the member recorded as having done the work, and of the member who recorded, reassigned, completed or cancelled the duty entry;
• the account name of the member who booked an instrument, the instrument, the times claimed, any description that member gave of the intended use, and, where a booking was cancelled, the account name of the member who cancelled it and any reason given;
• the account name of the member recorded as having used an instrument, the instrument, the start and finish times, whether the record was made by scanning or entered afterwards by hand, any note given, and the account name of the member who closed the session where that was a different member;
• the account name of the member who posted a notice, the text of the notice, the time until which it is shown, the account name of any member who edited or withdrew it, and the reason recorded for a withdrawal;
• the record of each email sent by PIIS: the address, the subject, the time and the result, and — except for messages carrying a sign-in code or an account link, whose text is not kept — the text;
• records of sign-in codes issued: the account, the address the code was sent to, the time, and whether the code was used; the code itself is not kept;
• where a member has chosen to trust a browser, a signed value stored in that browser which identifies the account and the time of the choice;
• sign-in records, comprising the time of the attempt, the account name, the network address, the browser and device information contained in the user-agent string, the page requested, and the fields submitted with the sign-in form. The password and the account name are masked within the record of the submitted fields. Sign-in records are maintained separately from the procurement and inventory records within PIIS;
• a session cookie and a cross-site request forgery token, stored in the browser of the member. Both are required to sign in and to submit forms.

The following are not collected:

• precise device location or satellite positioning data. The network address recorded during sign-in may indicate the approximate location of the connection;
• third-party analytics, advertising identifiers and tracking pixels. No page of PIIS loads content from a third party.

4. Mandatory and optional data

An account name is required to use PIIS; a member for whom the required account information is not provided cannot be given access to the system. The recording of actions carried out through an account, against the account name, is a necessary part of the system. It is not possible to use PIIS while being omitted from the procurement and inventory records. An account name and an email address are required to sign in; a name is optional and may be left blank. The laboratory records a University address where the member has one; a member may ask for a different address to be recorded.

5. Use of the data collected

The account names recorded against each transaction identify which member requested, received or took an item, so that stock held in common can be traced to the member holding it. The account names on the duty roster identify which member is responsible for each duty and who completed or cancelled it; the roster is visible to every signed-in member. Sign-in records are used for the purposes stated in section 2.

PIIS sends email to the address recorded for a member: a code when the member signs in, except where the administrator has suspended this step during an interruption of the email service; a link when a password is to be set or reset; and messages when a request of that member is ordered, shipped, received or cancelled by another member, when a problem case concerning the member is resolved or covers an item issued to the member, when a duty is assigned to or reassigned from the member, when a booking of the member is changed by another member, and when a member posting, editing or withdrawing a notice chooses to send it by email. Members in the procurement and inventory roles also receive messages concerning the work of their role. Each message is sent to the address recorded for the member; the operator of that mailbox receives its content. Replies to these messages are not read. Other communication concerning PIIS is by the means otherwise used by the laboratory.

6. Personnel with access to the data

Every laboratory member who can sign in can read the procurement and inventory records on screen, including the account names recorded against them. This follows from the purposes stated in section 2: stock held in common is visible to the members who share it. Role membership determines which operations a member may perform.

Several of the listings that a member can read on screen can also be exported by that member as a spreadsheet; such exports include the account names shown in them. Export of the complete list of stock units is available only to members in the inventory role and to the administrator.

One member of the laboratory administers PIIS (in this Statement, the administrator). The administrator holds the administrator account, the credentials for the services listed in section 7, and access to responses submitted through the suggestions form. The administrator works through an administrative console, which records every change made in it. The console also shows the record of each email sent by PIIS, including its text; the text of a notice that was sent by email remains readable there after the notice has been withdrawn. The database may also be reached directly where necessary for maintenance, security investigation, correction or recovery; such access is governed by a documented operating procedure of the laboratory, which requires each occasion to be recorded.

7. Where the data are kept

PIIS runs on services operated by other companies. The following receive data automatically:

• No service listed above holds data in Macao. Cloudflare publishes only a region name for storage of this kind and does not publish which countries that region covers.
• Each email that PIIS sends passes through Resend, which receives the address, the subject and the text of the message. The laboratory's contact address is forwarded to a mailbox of the laboratory by the forwarding service of the company with which the domain name is registered.
• The nightly backup is made by a job running on a machine operated by GitHub. The job copies the database in full, including free-text notes and sign-in records, and uploads the copy to Cloudflare R2. The machine is not retained after the job ends. GitHub does not publish its location.
• Sentry receives the time, the address of the page, the point in the code at which the failure occurred, and a record of the database statements run beforehand, with the values used in them removed. Request contents, account identity and internal code values are not transmitted.
• The suggestions link on the home page directs the member to a service operated independently by Google. Opening the form causes the device of the member to connect directly to Google, which may record that connection. PIIS transmits no information about the member, and none about the page from which the link was opened. Where the member submits the form, the response, including the PIIS account name entered by the member, is stored through Google Forms and can be read by the administrator. The form does not collect the Google account address of the member submitting it. Google does not publish where responses to a form are held.
• Data exported in spreadsheet form and label files prepared for printing are stored on the device of the member who requested them, and are no longer subject to the retention arrangements described in section 8. Such files are to be stored, used and deleted in accordance with the requirements of the laboratory and of the University.

8. Data retention period

• Procurement and inventory records are retained until a decision is taken to remove them. There is at present no routine deletion schedule for them.
• Certain records are append-only. Once a stock movement, an event or a case action has been written, PIIS provides no function by which it may be edited or removed. A correction is made by writing a further record; the original entry remains visible.
• Records of successful sign-in are retained for 365 days. Removal takes effect at the next monthly maintenance.
• Records of failed sign-in attempts become due for removal once the lock-out window of approximately 30 minutes has passed. Removal occurs when a sign-in is next processed.
• A signed-in session expires after 14 days. Records of expired sessions are removed at the next monthly maintenance.
• Method documents and their registered versions are retained until a decision is taken to remove them. There is at present no routine deletion schedule for them. A registered version may be withdrawn; the version number and the date remain visible so that the sequence of versions stays intelligible, while the text of that version and the reason given for the withdrawal are no longer displayed.
• Duty records, including the record of who was assigned, who did the work and who cancelled a duty, are retained until a decision is taken to remove them. There is at present no routine deletion schedule for them.
• Notices are retained until a decision is taken to remove them. There is at present no routine deletion schedule for them. A notice may be withdrawn; the entry stating who posted it and when, and who withdrew it and when, remains listed, while its text is no longer displayed.
• The record of each email sent by PIIS is retained until a decision is taken to remove it. There is at present no routine deletion schedule for it.
• Records of sign-in codes issued are retained for 365 days. Removal takes effect at the next monthly maintenance.
• The copy of each message held by Resend is retained by that company for the period it publishes, at present 30 days.
• Error reports are deleted by Sentry 30 days after they are received.
• A backup of the entire database is taken nightly and retained for 30 days. Removal of data from PIIS takes effect on the live database immediately; the data may remain in a backup for up to 30 days. Each night's backup is a separate file and is deleted on that schedule. Individual records are not removed from within a backup.
• When a member leaves the laboratory, the account is disabled. Identifiers necessary to preserve the intelligibility and integrity of historical transaction records continue to be retained for the applicable retention period. See section 10.

Monthly maintenance is performed manually, on the first working day of each month, by a person designated by the laboratory, who records what was removed. Maintenance not performed in a given month is performed at the next monthly maintenance.

9. Prohibited content and incident reporting

The following must not be entered into any free-text field:

• passwords or other access credentials;
• confidential or unpublished research data;
• personal information concerning other people;
• any other content that would be unsuitable for retention in a shared record.

Free-text entries should describe the item and the problem, not the person. Matters concerning a person should be raised with the Principal Investigator.

PIIS provides no function by which text entered in the following places can be edited or removed:

• the reason recorded on a problem case;
• the note recorded on a stock issue;
• the note recorded on a case action;
• the note attached to an event, into which text entered when carrying out other actions is written.

The text of a method document is a free-text field for the purposes of this section. It is the largest such field in PIIS and is visible to every signed-in member.

A registered version of a method document differs from the entries listed above in one respect. It cannot be edited, but it can be withdrawn by the administrator under a documented procedure of the laboratory, after which its text is no longer displayed; the version number, the status and the date remain visible so that the sequence of versions stays intelligible. The reason recorded for a withdrawal is not displayed. A withdrawal cannot be reversed. The considerations set out in section 8 concerning backups apply.

The text of a notice is a free-text field for the purposes of this section and is visible to every signed-in member. Unlike the entries listed above, a notice can be edited by the member who posted it or by a member in the inventory role; the earlier wording is not retained, and the noticeboard shows when the notice was last edited and by whom. A notice can be withdrawn by the same members, after which its text is no longer displayed or searched; the entry stating who posted it and who withdrew it remains listed. The reason recorded for a withdrawal is not displayed. A withdrawal cannot be reversed. The considerations set out in section 8 concerning backups apply. Where a notice was also sent by email, the copies delivered to members' mailboxes are outside PIIS and are not affected by withdrawal or editing.

A member who has entered prohibited content should inform the administrator without delay. PIIS itself provides no means of removing the entry, and a correction may be written alongside it. Removal from the live records, where warranted, is carried out under a documented procedure of the laboratory and requires the approval of the Principal Investigator. A copy taken beforehand may remain in a backup for up to 30 days. The matter is reported to the Principal Investigator, who determines what further action is taken.

10. Rights of members

The following are available to a member directly: My items, listing the items issued to that member, and My Orders, listing the requests that member has raised.

A member may request confirmation of whether PIIS processes personal data concerning that member, access to those data, information concerning the purposes, categories, sources and recipients of those data, and correction, deletion or restriction of the data where applicable under law. Such a request may be addressed to the administrator or to the Principal Investigator. Where the request cannot be met through the ordinary functions of PIIS, it is considered under the operating procedures of the laboratory, and the member is informed of the outcome and of the reason for it. Corrections made through PIIS are themselves recorded. A request to change the email address recorded for an account is made to the administrator; the change ends the trust given to any browser and the validity of any sign-in code sent to the earlier address.

When a member leaves the laboratory, the account is disabled; the account name remains visible on the records in which it appears, as described in section 8. Questions about this Statement may be raised with the administrator or with the Principal Investigator.