Compliance

GDPR, HIPAA, and PII — without storing the data.

Labels carry regulated information all the time: personal data of EU residents under GDPR, protected health information under HIPAA, and personally identifiable information under a widening set of state and national privacy laws. Qpro+ lets you mark any mapped field as pass-through — used to render the label, and never written to our database. The most reliable way to reduce your regulatory exposure to a vendor is for that vendor not to hold the data at all.

How it works

The field renders. The value doesn't persist.

Pass-through is set per field at mapping time, so you decide exactly which values are retained for history and reprint, and which pass through and disappear.

Chosen field by field

A lot number probably belongs in your print history. A recipient's name probably doesn't. You set that per field, not per account.

Rendered, then released

The value is used to produce the label output and is not committed to the database record for that render.

History still works

The render is still logged for metrics and audit — the retained record simply doesn't contain the pass-through values.

Reduces what you have to cover

Data we never store is data that doesn't need to appear in your processing inventory, your retention schedule, or your breach exposure.

Field mappingjson
{
  "template": "SHIP-DOC-4x6",
  "format": "pdf",
  "data": {
    "order_ref":    "SO-88214",
    "ship_date":    "2026-08-16",
    "recipient":    "—",
    "address_line": "—"
  },
  // these render, then are released
  "pass_through": ["recipient", "address_line"]
}

Fields named in pass_through are used to produce the output and excluded from the stored render record.

Verification

Don't take our word for it. Watch the record.

We built this because a customer operating in the EU needed to prove it, not just be told it. The walkthrough follows a single value from the canvas to the database and shows you what's there at the end.

STEP 01

Label design

We place the field on the canvas together, so you can see exactly where the value lands on the rendered output.

STEP 02

Column mapping

The field is marked pass-through in the mapping step. You choose which fields, live, during the session.

STEP 03

API call

A real render request is sent with a real value in that field, and the finished label comes back with the value printed on it.

STEP 04

Database record

We open the stored record for that render in front of you. The label rendered correctly. The pass-through value isn't there.

You'll also get it in writing. The walkthrough is accompanied by documentation of the data flow, so your compliance reviewer has something to file alongside what your engineer watched happen.

Regulations

What pass-through actually does for each obligation.

Pass-through doesn't make a regulation go away. It removes Qpro+ from the part of the data flow the regulation is concerned with, which is usually the harder part to solve.

RegimeTypical label dataWhat pass-through changes
GDPR Recipient names, addresses, and contact details on shipping labels and documents The value is rendered and released rather than retained, so it isn't sitting in a vendor system subject to retention, access, and erasure obligations.
HIPAA Patient identifiers on specimen, pharmacy, and chart labels Identifiers produce the label without being stored, which narrows what a business associate agreement has to cover.
PII — state and national Names, account numbers, and device serials tied to individuals Data we never store doesn't appear in your processing inventory, your retention schedule, or your breach exposure.
UDI and traceability Device identifiers, lot and expiry, serialization Retained deliberately, because you need this history. Pass-through is set per field, so compliance data stays and personal data doesn't.

What we claim, precisely

Qpro+ gives you a technical control: named fields render without being persisted, and you can watch it work on your own data. That materially reduces your exposure under GDPR, HIPAA, and PII regimes, because it reduces what a vendor holds in the first place.

What we don't claim

A control is not a certification. Compliance depends on your whole data flow, not on one vendor inside it. If your use requires a signed business associate agreement, a data processing agreement, or a specific attestation, ask us directly — we'd rather tell you exactly where we stand than let a web page imply something we haven't signed.

Pass-through is available on paid plans. If you're evaluating and need it to assess fit, tell us — we'd rather enable it for your test than have you guess.

Bring your compliance reviewer.

The walkthrough is live, specific to your data, and takes about thirty minutes. Engineers and reviewers both get something they can act on.

Qpro+ is a Quando Solutions product — supply chain & manufacturing IT