Privacy Policy for UpcharHub

1. Introduction

UpcharHub ("we," "our," or "us") is a healthcare practice management application designed for doctors and healthcare providers to manage patient records, prescriptions, and medical visits. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application.

By using UpcharHub, you agree to the collection and use of information in accordance with this Privacy Policy.

2. Important Notice

3. Information We Collect

3.1 User Account Information

• Google Account Information: When you sign in using Google SSO (Single Sign-On), we collect your name, email address, and profile picture from your Google account.
• Authentication Data: Login credentials and session tokens for maintaining your authenticated session.

3.2 Patient Medical Information

As a healthcare provider using our app, you may enter the following patient information:

• Patient name and contact details (phone number)
• Age at patient record creation
• Visit dates and medical history
• Complaints and diagnostic information
• Prescribed medicines (name, dosage, frequency, duration)
• Vital signs (blood pressure, heart rate, temperature, weight, height, oxygen saturation)
• Audio recordings for medical transcription (temporary, processed via AI)

3.3 Technical Information

• Device Information: Device type, operating system version, unique device identifiers
• App Usage Data: Features used, session duration, interaction patterns (via Firebase Analytics)
• Approximate Location: At sign-up we derive an approximate location (city, region, and country) from your IP address, solely to understand which regions our doctors come from. We store only this derived location for analytics — we do not store your IP address itself.
• Crash Reports: Automatic error logs and crash data to improve app stability
• Application Logs: Debug and performance logs for troubleshooting

3.4 Audio Data

• Voice Recordings: When you use the audio transcription feature, we temporarily process audio recordings through Google's Gemini AI service to convert speech to text and extract medical information. Audio recordings are processed in real-time and are not permanently stored.

4. How We Use Your Information

4.1 Core Functionality

• Authenticate healthcare providers via Google SSO
• Store and manage patient medical records
• Enable doctors to create, view, update, and delete patient information
• Generate prescriptions and medical visit summaries
• Facilitate search and retrieval of patient records

4.2 AI-Powered Features

• Transcribe audio recordings of doctor-patient consultations
• Extract medical information (complaints, diagnosis, prescriptions) from transcriptions
• Improve transcription accuracy over time

4.3 Analytics and Improvement

• Understand how healthcare providers use the app (Firebase Analytics)
• Identify and fix bugs and crashes
• Improve app performance and user experience
• Monitor system health and reliability

4.4 Security and Compliance

• Maintain secure user authentication
• Prevent unauthorized access to patient data
• Ensure data integrity and availability

5. Data Storage and Security

5.1 Data Storage

• Cloud Storage: All data is stored securely in Google Firebase Firestore (cloud database)
• Geographic Location: Data is stored on Firebase servers with appropriate data residency controls
• Backup: Automatic backups are maintained for data recovery purposes

5.2 Security Measures

• Encryption in Transit: All data transmission uses HTTPS/TLS encryption
• Encryption at Rest: Firebase Firestore provides encryption at rest by default
• Authentication: Access restricted to authenticated users via Google SSO
• Access Control: Each doctor can only access patient records they have created
• No Data Sharing: We never share patient data with third parties

5.3 Cache and Local Storage

• The app uses in-memory caching for performance optimization
• Cached data is cleared when the app is closed
• No sensitive patient data is permanently stored on the device

6. Third-Party Services

We use the following third-party services to provide and improve our application:

6.1 Google Firebase

• Purpose: Cloud database, authentication, analytics, crash reporting
• Data Shared: User authentication data, patient medical records, app usage analytics, crash logs
• Privacy Policy: https://firebase.google.com/support/privacy

6.2 Google Sign-In (SSO)

• Purpose: User authentication
• Data Shared: Name, email address, profile picture
• Privacy Policy: https://policies.google.com/privacy

6.3 Google Gemini AI

• Purpose: Audio transcription and medical information extraction
• Data Shared: Temporary audio recordings, transcribed text
• Data Retention: Audio data is processed in real-time and not permanently stored
• Privacy Policy: https://policies.google.com/privacy

6.4 Important Note on Third-Party Services

While we use these services to operate the app, we do not share identifiable patient medical information with any third party for marketing, advertising, or commercial purposes. Third-party services are used solely for the technical operation of the app.

7. Data Retention

7.1 Active Patient Records

• Patient records are retained as long as the healthcare provider maintains them in the system
• Doctors have full control over their patient data and can delete records at any time

7.2 Deleted Patient Records

• When a doctor deletes a patient record, the data is retained for 90 days for recovery purposes
• After 90 days, the data is permanently deleted from all systems and backups

7.3 User Accounts

• Healthcare provider account data is retained as long as the account is active
• Upon account deletion request, all associated data (including patient records) is deleted within 90 days

7.4 Audio Recordings

• Audio recordings used for transcription are not permanently stored
• Audio data is processed in real-time and immediately discarded after transcription

7.5 Analytics and Logs

• Analytics data is retained according to Firebase Analytics retention policies (default: 14 months)
• Crash logs and debug information are retained for up to 90 days

8. User Rights and Data Control

As a healthcare provider using UpcharHub, you have the following rights:

8.1 Access

• You can access all patient records you have created at any time through the app

8.2 Correction

• You can update and correct patient information at any time

8.3 Deletion

• You can delete individual patient records or visit information
• You can request complete account deletion by contacting us at contact@upcharhub.in

8.4 Data Export

• You can export/download patient records through the app's export features
• For bulk data export requests, contact us at contact@upcharhub.in

8.5 Data Portability

• Upon request, we will provide your data in a machine-readable format (JSON)

8.6 Patient Rights

• As the healthcare provider, you are responsible for managing patient consent and rights
• Patients should contact their healthcare provider directly for access to their medical records

9. Data Sharing and Disclosure

9.1 No Third-Party Sharing

9.2 Legal Requirements

We may disclose information if required by law, such as:

• In response to valid legal process (court orders, subpoenas)
• To protect the rights, property, or safety of UpcharHub, users, or the public
• In connection with legal investigations or regulatory inquiries

9.3 No Marketing or Advertising

We do not use patient data for marketing, advertising, or any commercial purposes beyond providing the core healthcare management functionality.

10. Children's Privacy

UpcharHub is designed for use by healthcare providers only. The app is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children under 18 for the purpose of app usage.

Note: While the app stores medical information about pediatric patients entered by healthcare providers, this data is managed by the healthcare provider in accordance with applicable medical privacy laws.

11. International Data Transfers

UpcharHub is designed for use in India only. However, due to the nature of cloud services (Firebase), data may be stored or processed on servers located outside India. Google Firebase implements appropriate safeguards for international data transfers in compliance with applicable laws.

12. Your Consent

By using UpcharHub, you consent to:

• The collection and use of information as described in this Privacy Policy
• The use of third-party services (Firebase, Google SSO, Gemini AI) as described
• The storage of patient medical data in cloud services
• The processing of audio recordings for transcription purposes

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, regulatory, or operational reasons. When we make changes:

• We will update the "Last Updated" date at the top of this policy
• Significant changes will be notified through the app or via email
• Continued use of the app after changes constitutes acceptance of the updated policy

We encourage you to review this Privacy Policy periodically.

14. Data Breach Notification

In the event of a data breach that affects patient information:

• We will notify affected healthcare providers within 72 hours of discovery
• We will provide details about the nature of the breach and steps being taken
• We will assist healthcare providers in fulfilling their notification obligations to patients

15. Contact Us

16. Governing Law

This Privacy Policy is governed by the laws of India. Any disputes arising from this policy or the use of UpcharHub shall be subject to the exclusive jurisdiction of the courts in India.

17. Healthcare Provider Responsibilities

As a healthcare provider using UpcharHub, you are responsible for:

• Obtaining appropriate patient consent for data collection and storage
• Complying with applicable medical privacy laws and regulations in India
• Ensuring the accuracy of patient information entered into the app
• Maintaining the confidentiality of your login credentials
• Informing patients about how their data is stored and managed

18. Disclaimer

UpcharHub provides a platform for healthcare providers to manage patient records. We are not responsible for:

• The accuracy or completeness of medical information entered by healthcare providers
• Medical decisions made using the app
• Compliance with specific medical regulations (this remains the healthcare provider's responsibility)
• Unauthorized access resulting from sharing login credentials

---