MediStock Clinic: Privacy Policy
Last updated: 14 October 2026
MediStock Clinic ("the app") helps small clinics manage their in-house pharmacy: stock, bills, prescriptions and patient records. It is provided by ModusLab ("we", "us"). This policy explains what data the app handles, why, and the choices you have. It is written to meet the Google Play User Data policy and India's Digital Personal Data Protection Act, 2023.
Who controls the data
Each clinic that uses the app decides what patient information to enter and is responsible for it (the clinic is the "data fiduciary" for its patients). We store and process that information only to provide the app to the clinic.
What we collect
| Data | Examples | Why |
|---|---|---|
| Account details | Email address, password (stored only as a secure hash), role (owner or assistant), personal app preferences (for example, whether the out-of-stock alert is shown) | Sign-in, password reset, team invitations, remembering your settings on any phone |
| Clinic profile | Clinic name, address, phone, doctor names, qualifications and registration numbers, GSTIN, UPI ID, default consultation fee, the email address chosen for the daily summary | Printed on bills and reports; sending the daily summary |
| Patient information entered by the clinic | Name, mobile number, age, gender, allergies, conditions, doctor's notes, the consulting doctor, medicines given, dosage and number of days, prescription photos | Billing, prescriptions, visit history, allergy warnings and refill reminders |
| Test reports (only when you add them) | Report date, test results and normal ranges, lab name, reviewing doctor, photo or lab PDF | The patient's record and result trends over time |
| Business records | Medicines and their composition, batches, expiry dates, prices, stock changes, bills, consultation fees, payment mode, imported stock lists | Inventory, billing, reports and order suggestions |
| Activity log | Who did what and when in the clinic (for example "bill created", "stock restocked"), with the team member's email | Lets the clinic owner review changes and keep the clinic accountable |
| Email-domain requests (only if a clinic asks to use its own email domain) | Clinic name, email, mobile number and one document (registration or GST certificate) | Checking the clinic is genuine; only the developer sees it, and the document is deleted 30 days after the decision |
| Error reports | Error message, screen, app version and Android version (phone numbers and emails masked; no patient details) | Finding and fixing problems |
| Purchases | Plan, renewal date and a purchase reference from Google Play (never card or UPI details) | Unlocking Pro and keeping it when you reinstall or change phone |
The camera is used only when you scan a barcode or photograph a prescription or report. Photos are reduced in size on the phone before upload to save space, keeping them readable. Phone notifications (expiry, low stock, trial reminders) are created on the phone itself. We do not collect location, contacts, call logs, advertising IDs or browsing data. The app has no ads and no analytics trackers.
Suggestions the app learns
To save time, the app learns from the clinic's own records: each doctor's usual prescriptions and dosages, medicines often given together, how fast stock sells and how the clinic orders, and when a regular patient's medicine is likely to run out. This learning happens only inside that clinic's data. It is never shared with other clinics and never used to train outside AI models. Suggestions and allergy warnings are prompts only; the doctor or pharmacist always decides, and the app is not a substitute for professional judgement.
Where it is stored
Data is stored with our hosting provider Supabase on servers in Mumbai, India, encrypted in transit (HTTPS) and at rest. Each clinic's data is isolated: only signed-in members of that clinic can read or change it, and some screens (Reports, Settings, Activity log) are for the clinic owner only. Some data (stock list, a bill being prepared, bills waiting to sync) is also kept on the phone so the app works without internet.
Who we share it with
We do not sell or rent data, and we do not share it for advertising. We use these service providers only to run the app:
- Supabase: database, sign-in and file storage (India region).
- Resend: sending sign-in and password-reset codes and the optional daily summary email.
- Google Play and RevenueCat: processing and tracking Pro purchases. RevenueCat receives only a random clinic ID, not names, emails or patient data.
- Expo: building and delivering app updates, and hosting this page.
- GitHub: storing encrypted backups (database nightly, photos weekly). Only we hold the key; GitHub cannot read them.
When you tap WhatsApp or Share (bills, prescriptions, photos, reports or refill reminders), the content is handed to the app you choose (for example WhatsApp) and sent from your own account; that app's privacy policy applies.
Linking with FamilyMeds
A clinic can send a prescription to the patient's FamilyMeds app (also made by ModusLab) so medicine reminders start automatically. Nothing is shared until the clinic creates a one-time code for that bill and the patient enters it in FamilyMeds with the same mobile number the clinic has. Codes expire after 7 days and lock after 5 wrong tries.
- Once linked, the patient sees the prescriptions shared with them (medicines, dosage, timing, days, instructions and doctor name) and the test reports the clinic added to their record.
- Reports the patient adds in FamilyMeds reach the clinic only if the patient separately turns on sharing. That permission is optional, is asked for on its own and is never a condition for getting reminders.
- The patient can turn sharing off at any time; the clinic stops seeing their reports immediately. Unlinking also deletes every report the patient shared with the clinic. Each link, permission change and shared report is recorded in the clinic's activity log.
How long we keep it
Data is kept while the clinic's account is active. When the clinic owner deletes the account, the clinic and all of its data (stock, bills, patients, test reports, photos, activity log and learned suggestions) are deleted immediately from the live database. When an assistant deletes their account, their login is removed, but the clinic keeps its records, including activity-log entries showing the assistant's email. Backups (by our hosting provider and our own encrypted backups) expire within 30 days. To allow one free Pro trial per person, we keep a one-way fingerprint of the account email (it cannot be turned back into the email) after the account is deleted. Error reports are kept only as long as needed to fix the problem.
Your choices and rights
- Access and correction: clinic users can view and edit their data in the app.
- Export: Account → Export all my data gives every record as spreadsheet files; reports can also be exported as CSV and PDF.
- Deletion: in the app, open Account → Delete my account. Or email us (below) from the account's email address and we will delete it within 7 days. See how to delete your account.
- Settings you control: the daily summary email, phone notifications, the security PIN and the out-of-stock alert can each be turned on or off.
- Patients: to see, correct or delete your information, contact the clinic you visited; we will help the clinic do so.
Children
The app is for clinic staff and is not directed to children. Clinics may record patients of any age as part of their care.
Security
We use encrypted connections, per-clinic access rules enforced by the database, hashed passwords and an optional 6-digit PIN for owner-only screens. The PIN is checked on our server and stored only as a secure hash; after 5 wrong tries it locks for 5 minutes. Sign-up is limited to well-known email providers and approved clinic domains to reduce fake accounts. No system is perfectly secure; please use a strong password and keep your phone locked.
Changes
We will update this page when the app's data practices change and show the new date at the top.
Contact and grievances
ModusLab · Email: support@moduslab.in. For questions, requests or complaints about personal data, write to this address and we will reply within 7 days.