DocPro — Privacy Policy

Effective date: 14 July 2026

DocPro is clinic-management software published by UpTech ("we", "us"). It is used by independent medical clinics to run their day-to-day work: patient records, the waiting queue, appointments, lab tests, prescriptions and clinic finances.

This policy explains what information DocPro handles, where that information is sent, and who can see it. It covers the DocPro applications for Windows, Android and iPhone, and the DocPro patient portal.

1. Who is responsible for your data

This distinction matters, so please read it carefully.

The clinic controls the patient data. When a clinic enters a patient's name, phone number, diagnosis or lab result into DocPro, that clinic decides what is recorded, who on its staff may see it, and how long it is kept. The clinic is the data controller.
UpTech provides the software and the infrastructure. We supply the app and configure the cloud services the clinic's data sits in. We process that data on the clinic's behalf and do not use it for our own purposes.

If you are a patient and you want to see, correct or delete your records, please contact the clinic that treats you. They hold your file; we cannot make those decisions for them.

2. Each clinic's data is separate

Every clinic using DocPro runs in its own separate Google Firebase project, with its own database and its own accounts. One clinic's patients, visits and finances are not stored alongside another's, and no clinic can read another clinic's records. There is no shared, central pool of patient data at UpTech.

A clinic is identified by a private clinic code. Entering the code on a new device asks a DocPro directory service for that clinic's encrypted configuration so the app knows which database to connect to. That request contains the clinic code only — it carries no patient data.

3. What information DocPro handles

Staff accounts

Name, email address and password (the password is handled by Google Firebase Authentication; we never see or store it in readable form).
Role — administrator, doctor, receptionist or laboratory — which determines what that person is allowed to see.

Patient records, entered by the clinic

Identity and contact: name, phone number, date of birth, gender.
Clinical: blood type, allergies, chronic conditions, current medications, visit notes, diagnoses, prescriptions, vital signs, lab tests and their results.
Scheduling: queue entries, appointments and follow-up dates.
Financial: visit fees, payments and the clinic's own purchases and expenses.
Images: handwritten notes drawn in the app, photographs of lab results, and scans of the clinic's older paper records.

On your device

Your sign-in credentials, kept in the operating system's secure storage so you are not asked to log in every time.
The clinic's encrypted configuration, and your preferences (language, colours, text size, message wording).

4. Where the information goes

DocPro sends data to the following services and to nowhere else.

Service	What is sent	Why
Google Firebase (Authentication, Firestore)	Staff logins; all patient, visit, lab, queue and financial records	This is the clinic's database. Each clinic has its own project.
Cloudinary	Images only: handwriting drawings, lab result photos, scans of old paper records	Image hosting. Images are stored under the clinic's own Cloudinary account.
Google Gemini (AI assistant)	The text of a patient's record — only when a doctor presses an AI button. See section 5.	To produce the summary, medication review or answer the doctor asked for.
WhatsApp / SMS / phone	The patient's phone number and the message text, handed to the app you choose	Only when a staff member presses call or send message. DocPro does not send messages by itself.

Handwriting recognition runs on your device. Converting a handwritten note to text uses Google ML Kit locally on the phone or tablet. The handwriting is not uploaded for that purpose.

5. The AI assistant — please read this

When a doctor uses an AI feature, the patient's record is sent to Google's Gemini service for processing. This includes the information needed to answer: name, age, allergies, chronic conditions, medications, vital signs, visit notes and diagnoses.

Nothing is sent to the AI unless a doctor deliberately presses one of the AI buttons (patient summary, clinical suggestions, medication review, or the patient chat). Simply opening a patient's file sends nothing.

The AI is decision support only. It does not diagnose and it does not prescribe. Every suggestion it produces carries an on-screen notice that the physician must verify it before acting, and the treating physician remains fully responsible for every clinical decision.

Clinics should tell their patients that an AI assistant is used, and should obtain consent where local law requires it. If a clinic does not want any patient data to leave for AI processing, the AI features can be disabled for that clinic — contact us and we will remove the AI key from your clinic's configuration.

6. The patient portal

Patients whose clinic has enabled it can sign in to the DocPro portal with their phone number and a password issued by the clinic. A patient can see only their own records — their visit history, including any old paper records the clinic has scanned into it, and their lab results — and can request an appointment. The portal cannot be used to view any other patient.

7. What we do not do

We do not sell patient data or clinic data, to anyone, ever.
We do not use it for advertising, and DocPro contains no advertising.
We do not include analytics, tracking or profiling SDKs. DocPro does not follow you around the internet.
We do not combine data across clinics, and we do not use one clinic's records to build products for another.
We do not use patient data to train AI models. Records are sent to Google Gemini only to answer the specific question a doctor asked.

8. Device permissions

Camera and photos — to photograph lab results and scan old paper records. Used only when you choose a picture.
Internet — to reach the clinic's database.
Phone, SMS and WhatsApp — DocPro does not place calls or send messages on its own. It opens your dialer or messaging app with the number filled in, only when you press the button.

9. Security

Access is enforced by server-side security rules, not just by what the app chooses to show. A receptionist cannot read a patient's clinical notes even if they bypass the app.
A laboratory account sees only the tests a doctor directed to it (or tests not directed to any particular laboratory) — never another laboratory's work, and never the patient's clinical notes.
Data travels over encrypted connections (HTTPS/TLS). Clinic configuration is encrypted, and sign-in credentials are kept in the operating system's secure storage.
Each clinic is isolated in its own database project.

No system can be guaranteed to be perfectly secure. If we become aware of a breach affecting a clinic's data, we will inform that clinic without undue delay.

10. Keeping and deleting data

Patient records are kept for as long as the clinic needs them, which medical record-keeping law in the clinic's country may require to be a number of years. The clinic decides this, not us.

A clinic may ask us to export or permanently delete its entire database at any time.

Deleting a patient inside the app removes that patient's record from the clinic's database. Please note that this does not automatically erase images already uploaded to Cloudinary (handwriting, lab result photos, scans). To have a patient's images permanently removed as well, contact us and we will delete them.

11. Children

Children are treated as patients of the clinic like anyone else, and their records are entered by clinic staff, not by the child. DocPro is not directed at children as users, and we do not knowingly create user accounts for them.

12. Changes to this policy

We may update this policy. The effective date at the top will change, and the current version will always be available at this address. Material changes affecting patient data will be communicated to clinics directly.

13. Contact

For questions about this policy, or to request export or deletion of a clinic's data:

Email: iquptech.ai@gmail.com
Phone: +964 751 808 6984
Web: up-techai.web.app

Patients: please contact your clinic first — they hold and control your records.

14. Deleting your account

You can request deletion of your DocPro account and its associated data at any time. See Delete your account and data for what is deleted, what must be kept, and how to make the request.