Privacy Policy for UpcharHub

1. Introduction

UpcharHub ("we," "our," or "us") is a healthcare practice management application designed for doctors and healthcare providers to manage patient records, prescriptions, and medical visits. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application.

By using UpcharHub, you agree to the collection and use of information in accordance with this Privacy Policy.

2. Important Notice

3. Information We Collect

3.1 User Account Information

• Google Account Information: When you sign in using Google SSO (Single Sign-On), we collect your name, email address, and profile picture from your Google account.
• Authentication Data: Login credentials and session tokens for maintaining your authenticated session.

3.2 Patient Medical Information

As a healthcare provider using our app, you may enter the following patient information:

• Patient name and contact details (phone number)
• Age at patient record creation
• Visit dates and medical history
• Complaints and diagnostic information
• Prescribed medicines (name, dosage, frequency, duration)
• Vital signs (blood pressure, heart rate, temperature, weight, height, oxygen saturation)
• Audio recordings for medical transcription (temporary, processed via AI)

3.3 Technical Information

• Device Information: Device type, operating system version, unique device identifiers
• App Usage Data: Features used, session duration, interaction patterns (via Firebase Analytics)
• Approximate Location: At sign-up we derive an approximate location (city, region, and country) from your IP address, solely to understand which regions our doctors come from. We store only this derived location for analytics — we do not store your IP address itself.
• Crash Reports: Automatic error logs and crash data to improve app stability
• Application Logs: Debug and performance logs for troubleshooting

3.4 Audio Data

• Voice Recordings: When you dictate a visit, the audio is sent to Google's Gemini through Vertex AI in Google Cloud's Mumbai region (asia-south1) to be converted to text. The audio and the text it produces are processed as the request happens, are not retained by that service afterwards, and are not used to train any model. Both the request and its result stay in India.

3.5 Website Visitors and the Support Assistant

The sections above describe information about doctors who have created an account. This section is about anyone visiting upcharhub.in, whether or not they have signed up, and it exists because the assistant on our website collects something the rest of this policy does not cover.

• What is stored: when you use the chat assistant on our website, we store the question you asked and the answer it gave, so that we can see which questions our website fails to answer and write better pages. We also store when it happened and how long the answer took.
• Who it is attached to: nobody. We do not store your IP address, your name, your email address, a cookie or any other identifier alongside a conversation. Each conversation carries a random reference that exists only so that consecutive messages can be read together, expires after fifteen minutes, and cannot be traced back to a person or to a UpcharHub account — including by us.
• Patient information is refused, not collected. The assistant is instructed to decline any question containing patient details and to answer only the question about our software underneath it. When it does decline, we record that such a question was asked and do not store the text of it. Please do not send us patient information through the website assistant; use the software itself, where records are protected as described in section 5.
• Where the question goes: to Google's Gemini through Vertex AI in Google Cloud's Mumbai region (asia-south1) to produce an answer, on the same terms as section 6.3. It stays in India and is not used to train any model.
• How long we keep it: conversations are kept while they remain useful for improving our website. You can ask us to delete a conversation by writing to contact@upcharhub.in, though because we store nothing that identifies you, you will need to tell us roughly when it took place and what it was about.
• You never have to use it. Everything the assistant can tell you is written on the website, and a person answers contact@upcharhub.in.

Our website also uses Google Analytics and Google Ads measurement, and reCAPTCHA to tell people from automated scripts. reCAPTCHA is loaded only when you open the chat assistant, not when you read a page.

4. How We Use Your Information

4.1 Core Functionality

• Authenticate healthcare providers via Google SSO
• Store and manage patient medical records
• Enable doctors to create, view, update, and delete patient information
• Generate prescriptions and medical visit summaries
• Facilitate search and retrieval of patient records

4.2 AI-Powered Features

• Transcribe audio recordings of doctor-patient consultations
• Extract medical information (complaints, diagnosis, prescriptions) from transcriptions
• Improve transcription accuracy over time

4.3 Analytics and Improvement

• Understand how healthcare providers use the app (Firebase Analytics)
• Identify and fix bugs and crashes
• Improve app performance and user experience
• Monitor system health and reliability

4.4 Security and Compliance

• Maintain secure user authentication
• Prevent unauthorized access to patient data
• Ensure data integrity and availability

5. Data Storage and Security

5.1 Data Storage

• Cloud Storage: All clinic and patient data is stored in Google Cloud Firestore.
• Geographic Location: The database is located in Google Cloud's Mumbai region (asia-south1). Data at rest stays in that region, and the application servers that read and write it run in the same region.
• Backup: Backups are held in India only. They exist to protect against infrastructure failure. They are not an undelete: once you delete a patient record or your account, it is gone immediately and cannot be restored — see section 7.

5.2 Security Measures

• Encryption in Transit: All data transmission uses HTTPS/TLS encryption
• Encryption at Rest: Firebase Firestore provides encryption at rest by default
• Authentication: Access restricted to authenticated users via Google SSO
• Access Control: Access is strictly scoped to authenticated user accounts. In solo practice, a doctor only accesses records in their own clinic. In shared practices, access is restricted to doctors explicitly invited and accepted into that practice, while each consultation remains individually attributed to the treating doctor.
• No Data Sharing: We never share patient data with third parties

5.3 Cache and Local Storage

• The app uses in-memory caching for performance optimization
• Cached data is cleared when the app is closed
• No sensitive patient data is permanently stored on the device

6. Third-Party Services

We use the following third-party services to provide and improve our application:

6.1 Google Firebase

• Purpose: Cloud database, authentication, analytics, crash reporting
• Data Shared: User authentication data, patient medical records, app usage analytics, crash logs
• Where it is stored: Google Cloud's Mumbai region (asia-south1).
• Where it is processed: the same region.
• Privacy Policy: https://firebase.google.com/support/privacy

6.2 Google Sign-In (SSO)

• Purpose: User authentication
• Data Shared: Name, email address, profile picture
• Privacy Policy: https://policies.google.com/privacy

6.3 Google Gemini AI

• Purpose: Audio transcription and medical information extraction, and answering questions asked of the assistant on our website.
• Accessed through: Google Cloud Vertex AI, Mumbai region (asia-south1).
• Data Shared: Temporary audio recordings and the text made from them; the text of a website assistant question.
• Where it is processed: India only. Nothing is sent to a Gemini endpoint outside India.
• Data Retention: processed as the request happens, not retained afterwards, and not used to train any model.
• Privacy Policy: https://policies.google.com/privacy

6.4 ZeptoMail (Zoho)

• Purpose: Sending transactional and clinic-update email to doctors.
• Data Shared: A doctor's name and email address, and the content of the message sent to them. No patient record and no clinical content.
• Where it is processed: India.
• Privacy Policy: https://www.zoho.com/privacy.html

6.5 Important Note on Third-Party Services

While we use these services to operate the app, we do not share identifiable patient medical information with any third party for marketing, advertising, or commercial purposes. Third-party services are used solely for the technical operation of the app.

7. Data Retention

7.1 Active Patient Records

• Patient records are retained as long as the healthcare provider maintains them in the system
• Doctors have full control over their patient data and can delete records at any time

7.2 Deleted Patient Records

• When a doctor deletes a patient record, it is removed immediately
• There is no retention window and no undelete: once a record is deleted, neither you nor UpcharHub can restore it

7.3 User Accounts

• Healthcare provider account data is retained as long as the account is active
• Account deletion is immediate. When you delete your account, it and all associated data (including patient records) are removed at once — there is no waiting period and no recovery window
• You can delete your account yourself, at any time, at upcharhub.in/delete-account. Sign in, confirm, and the account and its records are removed.

7.4 Audio Recordings

• Audio recordings used for transcription are not permanently stored
• Audio data is processed in real-time and immediately discarded after transcription

7.5 Analytics and Logs

• Analytics data is retained according to Firebase Analytics retention policies (default: 14 months)
• Crash logs and debug information are retained for up to 90 days

8. User Rights and Data Control

As a healthcare provider using UpcharHub, you have the following rights:

8.1 Access

• You can access all patient records you have created at any time through the app

8.2 Correction

• You can update and correct patient information at any time

8.3 Deletion

• You can delete individual patient records or visit information
• You can delete your account yourself at any time at upcharhub.in/delete-account. Sign in, confirm, and it is done immediately. You can also write to contact@upcharhub.in and we will do it for you

8.4 Data Export

• You can export/download patient records through the app's export features
• For bulk data export requests, contact us at contact@upcharhub.in

8.5 Data Portability

• Upon request, we will provide your data in a machine-readable format (JSON)

8.6 Patient Rights

• As the healthcare provider, you are responsible for managing patient consent and rights
• Patients should contact their healthcare provider directly for access to their medical records

9. Data Sharing and Disclosure

9.1 No Third-Party Sharing

9.2 Legal Requirements

We may disclose information if required by law, such as:

• In response to valid legal process (court orders, subpoenas)
• To protect the rights, property, or safety of UpcharHub, users, or the public
• In connection with legal investigations or regulatory inquiries

9.3 No Marketing or Advertising

We do not use patient data for marketing, advertising, or any commercial purposes beyond providing the core healthcare management functionality.

10. Children's Privacy

UpcharHub is designed for use by healthcare providers only. The app is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children under 18 for the purpose of app usage.

Note: While the app stores medical information about pediatric patients entered by healthcare providers, this data is managed by the healthcare provider in accordance with applicable medical privacy laws.

11. International Data Transfers

UpcharHub is built for use in India, and patient and clinic data does not leave India.

• Where it is stored. Every patient record, visit, prescription and clinic account is stored in Google Cloud's Mumbai region (asia-south1). Backups are held in India only.
• Where it is processed. The servers that read and write those records run in the same region. Audio you dictate, and the text made from it, are processed by Google's Gemini through Vertex AI in asia-south1 and are not retained afterwards. Questions asked of the assistant on our website are processed the same way. Email to doctors is sent through ZeptoMail from India.
• What does leave India, and what it is not. Our website and app use Google Analytics, Google Ads and Google reCAPTCHA. These process device and browsing information — the page visited, the referring link, browser and device type, and an advertising identifier — and Google operates them outside India. They receive no patient record, no clinical content and no part of a patient chart. They are how we measure which pages bring doctors to us and keep our forms free of bots.

12. Your Consent

By using UpcharHub, you consent to:

• The collection and use of information as described in this Privacy Policy
• The use of third-party services (Firebase, Google SSO, Gemini AI, ZeptoMail) as described
• The storage of patient medical data in cloud services located in India
• The processing of audio recordings for transcription purposes

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, regulatory, or operational reasons. When we make changes:

• We will update the "Last Updated" date at the top of this policy
• Significant changes will be notified through the app or via email
• Continued use of the app after changes constitutes acceptance of the updated policy

We encourage you to review this Privacy Policy periodically.

14. Data Breach Notification

In the event of a data breach that affects patient information:

• We will notify affected healthcare providers within 72 hours of discovery
• We will provide details about the nature of the breach and steps being taken
• We will assist healthcare providers in fulfilling their notification obligations to patients

15. Contact Us

16. Grievance Officer

In accordance with the Information Technology Act, 2000 and the rules made thereunder, and applicable data-protection law, grievances about the processing of your information may be addressed to our Grievance Officer:

17. Governing Law

This Privacy Policy is governed by the laws of India. Any disputes arising from this policy or the use of UpcharHub shall be subject to the exclusive jurisdiction of the courts at Nagpur, Maharashtra, India.

17. Healthcare Provider Responsibilities

As a healthcare provider using UpcharHub, you are responsible for:

• Obtaining appropriate patient consent for data collection and storage
• Complying with applicable medical privacy laws and regulations in India
• Ensuring the accuracy of patient information entered into the app
• Maintaining the confidentiality of your login credentials
• Informing patients about how their data is stored and managed

18. Disclaimer

UpcharHub provides a platform for healthcare providers to manage patient records. We are not responsible for:

• The accuracy or completeness of medical information entered by healthcare providers
• Medical decisions made using the app
• Compliance with specific medical regulations (this remains the healthcare provider's responsibility)
• Unauthorized access resulting from sharing login credentials

---