This Privacy Policy explains how **HospiAll** ("we", "our", or "us"), provided by **CreatesApp**, collects, uses, stores, and protects information when you use the HospiAll Hospital Management mobile application, web portal, and associated software services (the "Application" / "Services").
---
## 1. Information We Collect
### A. Health & Medical Information
To facilitate healthcare administration, the Application processes:
- Patient medical records, UHID, OPD/IPD consultation notes, and diagnoses.
- Doctor e-prescriptions, treatment recommendations, and medication history.
- Diagnostic laboratory and radiology test results.
### B. Personal & Administrative Information
- **Staff & Doctors:** Name, email, mobile phone number, medical qualification, registration number, duty roster, and payroll details.
- **Patients:** Full name, age, gender, guardian name, contact number, billing address, and insurance/TPA policy details.
### C. Device & Technical Information
- Device platform (Android/iOS/Web), operating system version, and unique push notification tokens (Firebase Cloud Messaging) solely used for critical clinical and appointment alerts.
- Camera access (only when explicitly allowed by the user to scan staff QR attendance boards or patient wristbands/barcodes).
---
## 2. How We Use Information
We use the collected information exclusively to:
- Generate and manage hospital OPD/IPD appointments, e-prescriptions, and discharge summaries.
- Process hospital billing, pharmacy point-of-sale inventory, and diagnostic reports.
- Send automated test report notifications and appointment updates to patients via secure links or WhatsApp upon explicit clinical request.
- Calculate staff duty hours, attendance punches, and salary payslips.
---
## 3. Data Storage & Security
- All sensitive health information is transmitted over encrypted HTTPS/TLS protocols and stored on secure cloud database servers.
- Role-Based Access Control (RBAC) ensures only authorized hospital staff (Doctors, Nurses, Receptionists, Lab Technicians, Administrators) can view data corresponding to their authorized role.
- We do **NOT** sell, rent, monetize, or share patient medical data with third-party advertisers.
---
## 4. Permissions Requested by the App
| Permission | Purpose |
|---|---|
| **Camera (`android.permission.CAMERA`)** | Used to scan staff attendance QR codes and barcode medicine labels. |
| **Internet (`android.permission.INTERNET`)** | Used to synchronize hospital records, fetch appointments, and backup data to the secure hospital server. |
| **Notifications** | Used to deliver critical patient triage alerts, doctor consultation calls, and duty shift updates. |
---
## 5. Data Retention and Deletion
Hospitals and authorized administrators retain control over their healthcare data. To request account deletion or data removal, hospital administrators can contact: `support@createsapp.com`.
---
## 6. Contact Us
If you have any questions or concerns regarding this Privacy Policy:
- **Email:** `support@createsapp.com`
- **Application:** HospiAll (`com.createsapp.hospiall`)