Privacy Policy

1. What we collect

Only what you give us yourself. Nothing is collected behind a hidden field.

• If you create an account — your name, email and password. The password is stored hashed, which means even we cannot read the original.
• Saved lists — which medicines or doctors you saved, and the target price on any price alert.
• Reviews and ratings — your opinion of a doctor or hospital, published with your name.
• Comments — name, email and the text. The email is never published; it is only for replying and for spotting spam.
• Contact form — name, email, phone (optional) and your message.
• Newsletter — your email address only.
• Submit-a-medicine form — details of the medicine, plus your name and email if you choose to give them.

2. Prescription scanning

This is the most sensitive part, so it gets its own section. A prescription can show a patient's name, age, phone number or condition.

• The photo is sent to Google's servers to read the text. There is no other way to read handwriting from an image.
• We do not store the photo anywhere. It reaches our server's memory, is read, and is then discarded — it is never written to a disk, to cloud storage, or to a database.
• You do not need an account to use this, because there is nothing to keep.
• We ask for your consent before the first scan, and you can withdraw it at any time simply by not using the feature.
• ⚠️ This feature is in testing right now. During this period it runs on Google's free service, where Google may use submitted content to improve their products and their staff may review it. That is why the feature is currently limited to a few testers. Before it opens to everyone we will move to the paid service, where submitted content is not used for training — and this page will be updated then.
• A suggestion — especially important right now: if the prescription shows a name, age or phone number, cover that part before photographing it. We only need the list of medicines.

3. Medicine box and reminders

• In the mobile app, everything in your medicine box stays on your phone — which medicines, when you take them, which doses you marked. None of it reaches our servers. Delete the app and the data goes with it.
• On the website, if you are signed in, your medicine box is stored on our servers so it is available on your other devices. Deleting your account deletes it too.
• Reminders are scheduled on your phone. Knowing when to take a medicine needs no server, so it works offline.

4. Period tracker (mobile app only)

This is among the most private health information there is, so the rule here is the strictest.

• The dates stay on your phone only. They never reach any server — not ours, not anyone else's. The feature needs no account and no sign-in.
• The website does not offer this, because that would mean keeping the data on a server.
• If you turn on the reminder, it too is scheduled on your phone. Its wording is deliberately vague so that nothing is given away if someone else sees your lock screen.
• You can erase every date from inside the app at any time, and deleting the app removes the data as well.

This is not medical advice, and not a reliable method of contraception.

5. Statistics

• How often a doctor or hospital profile was viewed, or their phone number tapped — we keep only the daily count, not who did it.
• So that one person refreshing a page is not counted repeatedly, a hash is kept for 24 hours. That hash changes every day, so there is no way to recognise anyone across days.
• Raw IP addresses are not stored.
• Ads are counted the same way — numbers only, not who saw or clicked. We use no third-party ad network.

6. Cookies and Google Analytics

• Login cookie — signing in sets one httpOnly cookie (30 days). httpOnly means no script on the page can read it. Signing out removes it.
• Language preference — to remember Bangla or English.
• Google Analytics — used on the website to understand which pages are read most. It sets Google's own cookies and shares usage data with them. You can block it in your browser settings or with any blocker, and nothing on the site will stop working. The mobile app has no Google Analytics or any similar tracking.

7. Who your data reaches

We do not sell, rent, or hand personal data to advertisers. Only what is needed to keep the service running reaches these companies:

• Google — to read prescription photos (see section 2), and website Analytics.
• Cloudflare R2 — to host the site's images.
• An email provider — to send password reset links and the newsletter.
• Legal requests — if a court or authority lawfully requires it.

8. How long we keep it

• Account data — for as long as the account exists. Ask us to delete it and it goes.
• Prescription photos — never stored in the first place.
• The daily counting hash — 24 hours.
• Contact messages and comments — as long as needed to reply and keep a record.

9. Your rights

Under Bangladesh's Personal Data Protection Act, 2026 you may:

• Ask what data we hold about you.
• Correct anything that is wrong.
• Delete your account and your data.
• Withdraw consent you gave — for example by no longer using prescription scanning, or unsubscribing from the newsletter.

Email support@osudhkosh.com for any of these. We will respond within 30 days.

10. Children

osudhkosh is not built for people under 18, and we do not knowingly collect their data. If something reached us by mistake, tell us and we will delete it.

11. Security

All traffic is encrypted over HTTPS. Passwords are hashed, login tokens live in httpOnly cookies, and repeated wrong-password attempts are rate limited. Even so, no system on the internet is perfectly safe — it is fairer to say that plainly.

12. Changes to this policy

If anything material changes, we will say so on this page with the date. Check the “Last updated” line above.

13. Contact

Any question or request about privacy — support@osudhkosh.com