ClinicPad Privacy Policy
Last updated: 12 October 2026
This policy applies to the ClinicPad mobile app (package com.clinicpad.uplinnexus) and its backend services (together, "ClinicPad", "we", "us", "our"). ClinicPad is run by Uplin Nexus, Nashik, Maharashtra, India.
ClinicPad is a clinic management tool. Clinics use it to register patients, manage visits and tokens, record payments, and run their daily operations. This policy explains what information we collect, why we collect it, and how we protect it.
1. Who this policy applies to
- Clinic users: clinic owners, doctors and receptionists who use the app.
- Patients: people whose details a clinic enters into ClinicPad. Patients do not use the app themselves.
- Marketing executives and administrators: our partners and staff who onboard clinics.
Our role for patient data: each clinic decides what patient information to record and why, so the clinic is the Data Fiduciary / Controller. ClinicPad processes that data on the clinic's behalf as a Data Processor. Patients who have questions about their records should contact their clinic first.
2. Information we collect
a) Account information (clinic users)
- Full name, mobile number, role (owner, receptionist, etc.)
- Password, which we store only as a secure one-way hash and never in plain text
- Login activity, such as last login time, failed login attempts and IP address, used for security and account lockout
b) Clinic information
- Clinic name, address, city, district, contact numbers
- Operating hours, consultation and follow-up fees, and settings for the patient registration form
- Subscription plan and payment status
c) Patient information (entered by the clinic)
- Name, mobile number, gender, age or date of birth, address
- A patient code, and any custom fields the clinic sets up
- Visit records: date, token number, visit status, fees, amounts paid and due, payment mode, remarks and notes
d) Payment information
- Subscription payments are handled by Razorpay. We store only transaction references such as order ID, payment ID and subscription ID, plus the amount and status.
- We never collect or store card numbers, UPI PINs, CVVs or net-banking passwords.
e) Marketing executive / partner information
- Name, mobile number, referral and commission records
- Bank account holder name, account number and IFSC, used only to pay commissions
- Payout proof images that administrators upload
f) Device information
- A push notification token, the device platform (Android/iOS) and the app version, used to send notifications and check whether an app update is needed
g) Enquiries / leads
- Name, clinic name, mobile number, city and message, collected when someone submits an enquiry through the app
3. Device permissions we request
| Permission | Purpose |
|---|---|
| Internet / network state | To sync data with our servers, and to detect when you are offline so data can be saved locally and synced later. |
| Notifications | To send appointment, subscription expiry and other service alerts. |
| Photos / media library | Used only by administrators to attach payout proof images. Never accessed in the background. |
| App visibility (WhatsApp) | To check whether WhatsApp is installed so invoices and receipts can be shared with patients. |
We do not access your contacts, location, microphone, call logs or SMS.
4. How we use information
- To provide the service: patient registration, visit and token management, billing, reports and daily closing
- To create and manage user accounts and verify logins
- To process subscription payments and generate receipts
- To send service notifications, such as subscription expiry reminders and updates
- To calculate and pay marketing executive commissions
- To provide customer support
- To keep the service secure, prevent fraud and abuse, and fix technical problems
- To meet our legal, tax and accounting obligations
We do not sell, rent or trade any personal or patient data. We do not use patient data for advertising.
5. Sharing of information
We share information only in the following cases:
- Razorpay: to process payments, under Razorpay's privacy policy.
- Google Firebase Cloud Messaging / Expo push services: to deliver push notifications. Only the device token and the notification content are shared.
- Hosting provider (Hostinger): our servers and database are hosted with this provider.
- WhatsApp: when a clinic user chooses to share an invoice with a patient, the app opens WhatsApp on the user's device. The user sends the message; we do not send it.
- Legal requirements: when required by law, court order or a government authority, or to protect the rights and safety of ClinicPad, our users or others.
6. Data storage and security
- Data is stored on secure servers located in India.
- Data in transit is encrypted with HTTPS/TLS.
- Passwords are hashed. Access to data is limited by role, and each clinic can see only its own data.
- Repeated failed logins trigger an account lockout.
- To support offline use, some data is temporarily cached on your device in local app storage and synced when you are back online. This cache is removed when you log out or uninstall the app.
No system is 100% secure, but we use reasonable, industry-standard measures to protect your information.
7. Data retention
- We keep account and clinic data for as long as the clinic's account is active.
- We keep patient and visit records for as long as the clinic needs them, or as long as medical record laws require.
- After an account is closed, we delete or anonymise its data within 90 days, except where the law requires us to keep it longer (for example, tax and payment records).
8. Your rights
Under India's Digital Personal Data Protection Act, 2023 and other applicable laws, you have the right to:
- Access the personal data we hold about you
- Correct or update inaccurate data
- Ask us to delete your data or close your account
- Withdraw consent, which may stop you from using some features
- Raise a grievance
Clinic users can make these requests by emailing us at yadnikchetan@gmail.com. Patients should contact their clinic, and we will help the clinic respond.
9. Children's privacy
ClinicPad is meant for clinic staff aged 18 and over. Clinics may record information about minor patients as part of their medical care. In that case, the clinic is responsible for getting consent from a parent or guardian.
10. Changes to this policy
We may update this policy from time to time. If we make important changes, we will notify you in the app or by other means. The "Last updated" date at the top shows when the policy last changed.
11. Contact and grievance officer
- Grievance Officer: Chetan Yadnik
- Email: yadnikchetan@gmail.com
- Phone: +91 7798000791
- Address: Nashik, Maharashtra, India
We will acknowledge your complaint within 48 hours and try to resolve it within 30 days.