One laboratory cannot see another
Every row belongs to a laboratory, and the database refuses a read or a write that crosses that line — row-level security in Postgres, not a filter the application remembers to apply. Two laboratories share one deployment and never meet.
Tenancy and RLS →A specimen, end to end
Ordered, collected, accessioned, labelled, benched, entered, reviewed and released — with an append-only chain of custody, and an amendment that keeps the original readable rather than overwriting it.
User guide →Honest about what it is
HIPAA-conscious, never “HIPAA-compliant” — no software can be. No live analyser or EMR interface — HL7 v2 and FHIR move as files — and the Android app is built but not yet released. The status page says so rather than implying otherwise.
What is not built →LabFlow is designed, built and maintained by the LabFlow team. See About LabFlow for contact and how to support the project.