Privacy Policy

Last updated: 27 August 2026

This privacy notice explains how Pragati Pathology Laboratory ("the Laboratory", "we", "us") collects, uses, stores and protects personal data in connection with our Android application Pragati Pathology Laboratory (package identifier com.makos.pathology) and the administration system that supports it.

Please note who this application is for. This is not a consumer application. It is an internal tool issued only to employees of Pragati Pathology Laboratory, who use it to register patients, record the tests a patient has been billed for, and print or reprint the corresponding invoice. It is not available for patients to use, and it holds no account for a patient. Where this notice refers to "you" as a user, it means a member of Laboratory staff; patient information is entered into the application by staff, not by patients.

1. Information we collect

1.1 Staff account information

When the Laboratory issues an account to a member of staff, we hold that person’s name and email address, together with a securely hashed password. Signing in issues an access token to the device so the member of staff does not have to sign in repeatedly.

1.2 Patient information — including health information

Staff enter and retrieve the following about the patients the Laboratory serves:

Category	Data	Why it is held
Identity and contact	Patient name, mobile number, gender, age	To identify the correct patient, retrieve their previous records, and print an accurate invoice
Health	The pathology tests a named patient has been billed for, and the history of those tests	To raise an invoice and to reprint it when the patient or the Laboratory needs a further copy
Referral	Referring hospital or clinic	To record who referred the patient, and for the Laboratory’s own accounting
Financial	Invoice number, amount charged, method of payment	To issue receipts and maintain the Laboratory’s billing records

We do process sensitive personal data. A record of which pathology tests an identifiable person has undergone is health information. Under the Digital Personal Data Protection Act, 2023 of Bharat, and under Google Play’s User Data policy, this is treated as sensitive personal data. We state this plainly because it is the most important fact in this notice: this application exists to handle patient health records, and we handle them accordingly.

1.3 Information stored only on the device

To print, the application remembers the Bluetooth address and name of the receipt printer that a member of staff has paired with their device. This is stored on that device alone. It is never transmitted to us and is removed when the member of staff signs out or the application is uninstalled.

2. Device permissions, and why each is requested

Permission	What it is used for
Bluetooth (connect and scan)	To find and connect to the Laboratory’s receipt printer, and to send the invoice to it
Approximate and precise location	Requested only because versions of Android before Android 12 require the location permission before an application is allowed to scan for nearby Bluetooth devices. The application does not read, record, store or transmit your location. It contains no mapping, tracking or geolocation feature of any kind.
Device storage	To hold the invoice being prepared for printing on the device
Network access	To communicate with the Laboratory’s own server

3. How we use this information

To register a patient and retrieve their existing record.
To record the tests a patient has been billed for and calculate the amount due.
To print an invoice, and to reprint it whenever a further copy is required.
To maintain the Laboratory’s billing and accounting records.
To authenticate members of staff and keep their accounts secure.

We do not use this information for advertising, profiling or automated decision-making, and we do not use it to build a profile of any patient beyond the record of the services provided to them.

4. We do not share this information

Patient and staff information is held on the Laboratory’s own server and is not sold, rented or traded. We do not disclose it to any third party except:

to the patient concerned, or a person the patient has authorised;
to the referring hospital or clinic, to the extent required to report on the referral;
where we are required to do so by law, by a court, or by a competent regulatory authority.

The application contains no advertising network, no analytics service and no crash-reporting service. It transmits data to no destination other than the Laboratory’s own server. There is no third-party software development kit embedded in it that collects data about you.

5. How long we keep it

Patient records and invoices are retained for as long as the Laboratory is required to keep its medical and financial records under applicable law, and thereafter for as long as they may be needed to answer a query about a test or an invoice already issued. Staff account records are retained for the duration of employment and are disabled when a member of staff leaves.

6. How we protect it

Accounts are issued only by the Laboratory’s administrators. The application offers no public sign-up, and no account can be created from a mobile device.
Every request from the application other than signing in must carry a valid access token.
Passwords are stored only as a cryptographic hash and are never held in readable form.
Staff accounts are limited to the work they are issued for: registering patients, raising invoices and reprinting them. Charges for tests, and the management of staff accounts, can be changed only by an administrator, and only from the administration system — never from the mobile application.

7. Your rights

Under the Digital Personal Data Protection Act, 2023, a person whose personal data we hold may ask us to:

confirm what personal data about them we hold, and obtain a copy of it;
correct anything that is inaccurate, or complete anything that is incomplete;
erase personal data where we are not required by law to continue holding it;
nominate another person to exercise these rights on their behalf; and
raise a grievance about how we have handled their personal data.

Requests may be made using the contact details in section 10. We may need to verify identity before acting on a request concerning health information, and we will respond within the period required by law. Where a request would require us to erase a record we are legally obliged to retain, we will explain that to the person making it.

8. Children

The application is not offered to, and may not be used by, children. Where the Laboratory provides a service to a child, that child’s records are entered by a member of staff and are handled under this notice with the consent of a parent or lawful guardian.

9. Changes to this notice

If we change this notice we will publish the revised version at this address and update the date shown at the top. Where a change materially affects how personal data is handled, we will make that clear.

10. Contact us

For any question about this notice, or to exercise any of the rights described in section 7, please contact the Laboratory:

Data Protection contact	Pragati Pathology Laboratory
Address	18, Shivalaya, Vikas Nagar, Hotgi Road, Solapur 413 003, Maharashtra, Bharat
Telephone	(0217) 2600 110 \| 8262837114
Email	shilpakulkarni121@hotmail.com

11. Governing law

This notice is governed by the laws of Bharat. Any dispute arising out of it is subject to the exclusive jurisdiction of the courts at Solapur, Maharashtra, Bharat.