Privacy Policy for Rapid Clinical (RapidClinical)

1. Application Identity, Ownership & Verified Domain Scope

This Privacy Policy governs your access to and use of Rapid Clinical (also branded and operated as RapidClinical), an evidence-based point-of-care clinical decision support platform developed and maintained by RapidClinical Health Technologies (Principal Developer: Dr. Mahadi Hasan, Dhaka, Bangladesh).

This Privacy Policy applies uniformly across all verified web domains, subdomains, and mobile software applications owned and operated by Rapid Clinical:

• Official Homepage: https://rapidclinical.com
• Web Application & Clinician Portal: https://app.rapidclinical.com
• Official Privacy Policy URL: https://rapidclinical.com/privacy
• Official Terms of Service URL: https://rapidclinical.com/terms
• Mobile & PWA Applications: RapidClinical Android Application (Google Play Store) and Progressive Web Application (PWA) for iOS, Android, and desktop browsers.

2. Google User Data Disclosure & Limited Use Compliance

Rapid Clinical (https://rapidclinical.com and https://app.rapidclinical.com) integrates Google Sign-In (Google OAuth 2.0 Authentication) to allow doctors, medical residents, and medical students to securely sign in to their Rapid Clinical accounts. In full compliance with Google Cloud OAuth Branding Verification requirements (Google Cloud Answer 13806988) and the Google API Services User Data Policy, this section explicitly details how our application accesses, uses, stores, protects, and shares Google user data.

2.1 What Google User Data We Access and Collect (OAuth Scopes)

When you choose to sign in or register using “Sign in with Google”, Rapid Clinical requests access only to non-sensitive, basic identity scopes necessary for authentication:

No Restricted or Sensitive Google Scopes: Rapid Clinical does not request access to your Google Drive files, Gmail messages, Google Calendar, Google Contacts, Google Photos, or Google Fit/Health data.

2.2 How We Use Google User Data

Rapid Clinical uses the Google user data obtained via Google Sign-In strictly for the following user-facing purposes:

• User Authentication & Session Management: Verifying your identity when logging in to app.rapidclinical.com or the Rapid Clinical mobile app.
• Account Provisioning & Cross-Device License Sync: Associating your Rapid Clinical Pro subscription, bookmarked disease monographs, and preferred clinical settings with your verified email address across web and mobile devices.
• User Interface Personalization: Displaying your name and profile image in your account profile panel.
• Customer Support & Transactional Notices: Responding to your direct support inquiries, sending subscription confirmation receipts, and notifying you of material updates to our Privacy Policy or Terms of Service.

2.3 How We Store and Protect Google User Data

• Encryption in Transit: All data exchanged between your browser/device, Google OAuth servers, and Rapid Clinical servers is encrypted using TLS 1.3 (HTTPS) with strict HSTS enforcement.
• Encryption at Rest: Your Google Account identifier, name, and email address are stored in secure, access-controlled cloud databases (Google Cloud / Firebase Authentication infrastructure) encrypted at rest using AES-256 encryption.
• Strict Access Controls: Access to production authentication records is restricted via multi-factor authentication (MFA) and least-privilege role-based access control (RBAC).

2.4 How We Share or Transfer Google User Data

Rapid Clinical maintains a strict zero-monetization policy for user data:

• No Sale of Google User Data: We never sell, rent, lease, trade, or barter your Google user data to any third party, data broker, pharmaceutical company, or advertising network.
• No Advertising or Marketing Transfers: We never transfer or disclose Google user data for third-party marketing, retargeting, or interest-based advertising.
• Permitted Disclosures Only: Google user data is only processed by our core cloud infrastructure providers (such as Google Firebase Authentication and Cloudflare) acting strictly as data processors under confidentiality obligations to deliver the sign-in service, or when disclosure is legally mandated by a valid court order or applicable law.

2.5 Affirmative Compliance with Google API Services User Data Policy (Limited Use)

3. Categories of Personal & Technical Data We Collect

To operate the Rapid Clinical platform, we collect only the minimum personal and technical information required to authenticate clinicians and deliver offline-capable medical reference content:

• Account & Profile Information: When you create an account (via Google Sign-In or email registration), we collect your full name, email address, unique user ID, profile picture URL (if signing in via Google), and optional professional designation (e.g., Medical Student, Intern Doctor, Resident, Consultant, BMDC Registration Number if voluntarily provided for institutional verification).
• Subscription & Transaction Verification Records: When upgrading to a paid Rapid Clinical Pro plan via Mobile Financial Services (bKash, Nagad, or Rocket), we collect the payer mobile phone number (or last 4 digits), the mobile payment Transaction ID (TrxID), and the selected plan tier. We never collect or store credit card numbers, bank account passwords, or mobile wallet PIN codes.
• Technical & Device Telemetry: To synchronize weekly clinical guideline updates and prevent unauthorized multi-device credential sharing, our servers automatically log basic technical metadata including device model, operating system version, browser type, app version, IP address (for security rate-limiting), and crash diagnostics.
• User Support Communications: If you contact us via email (support@rapidclinical.com) or WhatsApp support, we retain your contact details and message history to resolve your inquiry.

4. How We Use Your Information (Purpose of Processing)

We process the collected information strictly for the following legitimate operational purposes:

• Authentication & Account Access: Enabling secure sign-in via Google OAuth 2.0 or email credentials across web and mobile platforms.
• Clinical Content Delivery & Offline Sync: Delivering 800+ disease monographs, STAT emergency protocols, antibiotic matrices, and 100+ medical calculators to your device for offline point-of-care access.
• Subscription Verification & Billing Administration: Validating bKash/Nagad/Rocket Transaction IDs (TrxID) and activating Pro license entitlements on your account.
• Platform Security & Abuse Prevention: Detecting automated scraping, unauthorized account sharing, fraudulent transactions, or denial-of-service attacks.
• Service Updates & Policy Notifications: Sending important notices regarding clinical guideline updates, security patches, or changes to this Privacy Policy.

5. Data Storage, Security Safeguards & Encryption

Rapid Clinical implements rigorous technical, administrative, and physical safeguards designed to protect user data against unauthorized access, alteration, disclosure, or destruction:

• End-to-End Transport Encryption: All network traffic between your browser/app and Rapid Clinical servers (`rapidclinical.com` and `app.rapidclinical.com`) is encrypted using TLS 1.3 (HTTPS) with SHA-256 certificates.
• Database Encryption at Rest: All user account tables and authentication records are encrypted at rest using AES-256 encryption.
• Cryptographic Password & Token Security: Password-based accounts use salted bcrypt/Argon2 cryptographic hashes; Google OAuth 2.0 sessions use short-lived, cryptographically signed JWT tokens.
• Sandboxed Device Storage: Offline clinical databases and calculator states on Android, iOS, and Web PWA are stored inside the application's isolated origin sandbox (`IndexedDB` / Android internal storage).

6. Data Sharing, Transfers & Third-Party Processors

Rapid Clinical does not sell, rent, trade, or monetize personal data or Google user data. We share limited data only with trusted infrastructure sub-processors necessary to host and operate the service, bound by strict data protection agreements:

We may also disclose user information if required to do so by law or in the good-faith belief that such action is necessary to comply with legal obligations, protect the safety of users, or investigate fraud or security breaches.

7. Zero Patient Health Information (Zero-PHI) Guarantee

Rapid Clinical is a clinical reference and decision support tool for healthcare professionals—not an Electronic Health Record (EHR) or Electronic Medical Record (EMR) system:

• No Patient Identifiers Collected: Rapid Clinical does not prompt for, collect, transmit, or store patient names, national ID numbers, hospital registration numbers, patient phone numbers, or biometric records.
• 100% Ephemeral Bedside Calculations: Clinical values entered into our 100+ medical calculators (such as serum creatinine for eGFR, weight for pediatric dosing, or GCS/CURB-65 parameters) are computed strictly in local volatile device memory (RAM). They are never transmitted to our servers and are immediately cleared when you close or reset the calculator.

8. Google Play Data Safety Matrix

In accordance with Google Play Store User Data policies, the table below summarizes our data collection and sharing practices across all Google Data Safety categories:

9. Cookies, Local Storage & Offline Clinical Database

Rapid Clinical uses strictly necessary first-party browser storage mechanisms (`localStorage`, `IndexedDB`, and secure authentication session cookies) solely to keep you signed in and to cache medical monographs for offline use in hospital wards with poor connectivity. We do not use third-party advertising cookies, tracking pixels, or cross-site behavioral profiling scripts.

10. Subscription Payment Verification (bKash / Nagad / Rocket)

When purchasing a Rapid Clinical Pro subscription via Bangladesh Mobile Financial Services (bKash, Nagad, or Rocket), users submit the payment Transaction ID (TrxID) and sender phone number for manual or automated license verification. Rapid Clinical never has access to your mobile wallet PIN, bank credentials, or credit card details.

11. Data Retention, Revoking Google OAuth Access & Account Deletion

You have full control over your personal data and Google Account permissions at all times:

• How to Revoke Google Sign-In (OAuth 2.0) Access: You may revoke Rapid Clinical's access to your Google Account at any time by visiting your Google Account Security Settings at https://myaccount.google.com/permissions, selecting Rapid Clinical (RapidClinical), and clicking Remove Access.
• In-App Account Deletion: Logged-in users can request immediate account deletion directly inside the application under Settings > Account & Privacy > Delete Account.
• Web / Email Account Deletion Request (No Login Required): You may request complete erasure of your account and all associated Google user data without logging into the app by emailing support@rapidclinical.com or Hmahadi98@gmail.com with your registered email address.
• Deletion Timeline: Upon receiving a deletion request, all personal identifiers (including your name, email address, Google Account ID, and profile photo URL) are permanently and irreversibly purged from our active databases and backups within 30 calendar days.

12. Children’s Privacy & Changes to This Privacy Policy

Children’s Privacy: Rapid Clinical is professional medical software intended strictly for qualified healthcare professionals, residents, and adult medical students (aged 18 and older). We do not knowingly collect personal information from children under 13 (or under 18).

Changes to This Privacy Policy: We keep this Privacy Policy current and will notify users of any material changes in how our application collects, uses, stores, or shares Google user data or personal information. Whenever we update this policy, we will revise the “Effective & Updated” date at the top of https://rapidclinical.com/privacy and notify registered users via email or an in-app notification banner prior to any new data practices taking effect.