Privacy Policy

1. Who this policy covers

This policy explains how PocketClinic (operated by Solurics, "we," "us") collects, uses, and protects information across three groups of people:

• Visitors to this website, including anyone who joins our waitlist.
• Clinic staff who use the PocketClinic app: the Doctor who owns a clinic's account, and any Receptionist they invite.
• Patients, whose appointment, visit, and billing information is entered into PocketClinic by a clinic that treats them.

These groups have different relationships with us, which is why section 4 below (Your role and ours) is worth reading even if you skip everything else.

2. Information we collect

From website visitors

If you join our waitlist, we collect the email address you submit. This website does not use cookies, analytics, or advertising trackers of any kind.

From clinic accounts (Doctor and Receptionist)

To create and run a clinic account, we collect: name, email address, password, phone number, role (Doctor or Receptionist), and clinic profile details (clinic name, address, logo, working hours, service catalog and pricing).

Patient data, entered by clinics

Clinics use PocketClinic to record information about their own patients. Depending on what a clinic chooses to enter, this can include:

Health information is sensitive personal data. It's visible only to the Doctor role within a clinic. Receptionists can see appointment and contact details, but not diagnosis, treatment, or prescription notes.

Device and operational data

To keep the app running reliably, we collect limited technical data such as device type, app version, and error/crash logs. We do not use this data for advertising, and we do not build advertising profiles of clinic staff or patients.

3. How we use information

• To operate the waitlist and let you know when PocketClinic is ready for your clinic.
• To provide the core app: scheduling, patient records, visit notes, invoicing, and the dashboard.
• To communicate with clinic accounts about their subscription, support requests, and product updates.
• To maintain the security, integrity, and reliability of the service.
• To meet our legal obligations, where applicable.

We do not sell personal data, and we do not use patient health information for marketing, advertising, or any purpose beyond running the clinic's own practice.

4. Your role and ours

Data protection law distinguishes between a data controller (the party that decides why and how personal data is processed) and a data processor (the party that processes data on the controller's behalf and instructions). This distinction matters for PocketClinic:

• For patient data: the clinic is the data controller. A clinic's Doctor decides what patient information to record and why: that's the clinical relationship between the clinic and its patient. PocketClinic (Solurics) acts as a data processor, storing and processing that data only as instructed by the clinic, and only to provide the app.
• For clinic account data (Doctor/Receptionist login details, clinic profile, subscription information) and website visitor data (waitlist emails), PocketClinic (Solurics) is the data controller.

In practice: if you are a patient and have a question about your own medical records, your clinic is the right first point of contact, since they control that data. If you are a clinic owner with a question about how we process data on your behalf, contact us directly using the details in section 13.

5. How we share information

We don't sell personal data to anyone, ever. We share information only in these situations:

• Infrastructure providers: we use reputable, industry-standard cloud infrastructure to host and secure clinic and patient data. These providers process data only to deliver hosting/storage services to us and are bound by confidentiality obligations.
• At the clinic's direction: features like sharing a PDF receipt via WhatsApp or email are actions the clinic's own staff choose to take, sending data to their patient's chosen contact method.
• Legal requirements: if required to by law, regulation, or a valid legal process.
• Business changes: if PocketClinic/Solurics were involved in a merger, acquisition, or asset sale, data may transfer as part of that transaction, subject to the same protections described here.

6. Data security

Each clinic's data is kept logically separate from every other clinic's, so no clinic can access another clinic's patients, appointments, or records. We rely on industry-standard cloud infrastructure and follow reasonable administrative and technical measures to protect data against unauthorized access.

No system is perfectly secure, and we can't guarantee absolute security, but protecting clinic and patient data is a core design requirement for PocketClinic, not an afterthought.

7. Data retention

We retain clinic and patient data for as long as a clinic's account is active, and for a reasonable period afterward to meet operational or legal needs. We're still finalizing the specifics of what happens to a clinic's data if they cancel their subscription (including export options), and we'll update this section before general availability.

Waitlist email addresses are kept until PocketClinic launches or until you ask us to remove them, whichever comes first.

8. Your rights

Depending on your relationship to us, you may have rights to access, correct, restrict, object to, or request deletion of your personal data, and to withdraw any consent you've given.

• Patients: since your clinic controls your medical records, please contact your clinic first for access, correction, or deletion requests. We will support clinics in fulfilling these requests on their instruction.
• Clinic staff: you can update most account and clinic information directly in the app, or contact us for anything you can't change yourself.
• Website visitors: email us to be removed from the waitlist at any time.

We aim to respond to any request within a reasonable time, consistent with applicable law.

9. Sri Lankan law & the PDPA

Sri Lanka's Personal Data Protection Act, No. 9 of 2022 ("PDPA") establishes rules for how personal data (including health data, treated as a sensitive category) should be collected, processed, and protected. As of this policy's last update, the PDPA's substantive obligations are not yet fully in force; only the provisions establishing the Data Protection Authority have been activated.

We're building PocketClinic with the PDPA's core principles in mind (data minimization, purpose limitation, security, and accountability), and we'll formalize our compliance program (including a designated privacy contact) as the Act's remaining provisions come into force.

10. International data transfers

Our hosting infrastructure may be located outside Sri Lanka. Where that's the case, we take reasonable steps to ensure data is handled with a level of protection consistent with this policy. We'll publish more specific detail here once our hosting region is finalized.

11. Children's data

PocketClinic's website and app accounts are intended for clinic staff who are adults. Patient records may relate to patients of any age, including children, but that information is entered and controlled by the clinic as part of standard patient care, not collected by us directly from a child.

12. Changes to this policy

We may update this policy as PocketClinic evolves, our infrastructure changes, or Sri Lankan data protection law develops. We'll update the "last updated" date above when we do, and for material changes, we'll make reasonable efforts to let clinic accounts know directly.

13. Contact us

Questions about this policy or how we handle data can be sent to pocketclinic@solurics.com.