Quezlo Hospital & Wholesale Management: Privacy Policy

1. Who we are

Quezlo Hospital & Wholesale Management ("the app") is made by Quezlo Technologies (Pakistan). Quezlo Technologies is responsible for this policy. Questions about privacy: [email protected]. Other help: [email protected].

This policy covers the editions listed below. Where editions work differently, we say which edition each part is about.

2. Editions covered

3. At a glance

Windows

• Business, patient and staff data stays in the local database.
• Only the licence check goes to Quezlo.
• Bill photos go to Google, and messages to Meta or Google, only if your business turns on those services with its own keys.

Android

• Data stays in the app's storage on the phone or tablet, or comes from your LAN server.
• Only the licence check goes to Quezlo.
• Optional services your business connects receive only what you send through them.

Web

• Data is stored in the browser on that computer, or comes from your LAN server.
• Only the licence check goes to Quezlo.

4. Data stored on your device

This data is created and kept on your own device (or your own local network). It is not sent to Quezlo, except the items that the next section (Data Quezlo collects) lists as sent to Quezlo.

• Patients: MR number, name, phone, age, gender, CNIC, address and the Sehat Card mark.
• Consultations: vitals, complaint, diagnosis, prescriptions, test orders and notes. Lab orders and results.
• Staff: name, phone, CNIC, address, emergency contact, salary, shift, attendance and advances.
• Suppliers, customers and their ledgers, sales, purchases, stock, accounts and kacha khata.
• Photos of bills, receipts and your logo.
• App logins for your staff. Passwords are stored as salted hashes, not as plain text.
• Queued WhatsApp and email messages.
• Settings, including the Google Gemini key, WhatsApp token and Gmail app password if you enter them. These are stored as plain text in the settings.
• Your licence key and a random device ID made by the app. These two are also sent to Quezlo for the licence check (see "Data Quezlo collects").

Where it is stored: on Windows in %APPDATA%\Quezlo Technologies\Quezlo, and every PDF you share or send from the Windows app (receipts, bills, lab reports) is also saved in Documents\Quezlo\PDF; on Android in the app's private storage; on the web in that browser's storage. On a LAN client, the data lives on the server PC. The database is not encrypted.

Health data. The app stores health data (consultations, prescriptions and lab results) on your own devices only. Health data leaves your devices only if your staff send it: for example a lab report shared on WhatsApp, sent with the WhatsApp Cloud API, emailed with Gmail, printed, or included in a backup file.

5. Data Quezlo collects

This data is stored in Quezlo's Supabase project. Supabase also sees the IP address of each licence check in its logs. Quezlo never receives patient, staff, customer, stock or account data. There is no Quezlo customer account.

6. Your business is in charge of its data

• The hospital, clinic or business using the app is the data controller for all patient, staff, customer and supplier data stored in it. It decides what to record and must follow the health-data and privacy laws that apply to it.
• Quezlo provides the software. Quezlo does not receive or process this data. Quezlo only receives the licence-check data listed above.
• Patients and staff who want to see, correct or delete their records should contact the hospital or business that holds them.

7. Data that leaves your device when you choose

These transfers happen only when you, or your staff, start them.

8. Third-party services and SDKs

These companies receive data in the cases below. Each one handles it under its own privacy policy (linked).

Google Gemini, WhatsApp Cloud API and Gmail are connected by your business with its own key, token or app password. Your business has its own agreement with Google or Meta for these services. Quezlo does not see what is sent through them.

9. Device permissions

The app asks for a permission only when you use the feature that needs it. You can refuse or withdraw any permission in your device settings; only that feature stops working.

Windows

Android (Package name: com.quezlo.hms)

The camera opens through the system camera when you photograph a bill, so the app has no camera permission. Photos and files are picked with the system picker, so the app has no storage permission. Token announcements use your device's text-to-speech engine.

Web

10. What we do not do

• No ads.
• No analytics SDK and no crash-reporting SDK.
• No location tracking. The app does not ask for location.
• We do not sell data.
• Quezlo does not receive patient, staff, customer or business records.
• No cloud sync. Data moves between your devices only over your own local network.

11. Security

• LAN sync is not encrypted. It uses ws:// on your local network, protected by a 4-digit PIN. Use it only on a private network you trust, never on public Wi-Fi.
• Backups are plain JSON files and are not encrypted. They contain all patient and staff data. Backups made by newer test builds leave out the stored Google Gemini key, WhatsApp token and phone number ID and Gmail app password; backups made by older test builds may still contain them, so treat an old backup file as if it holds them. Keep backup files somewhere safe and do not share them.
• The local database is not encrypted. Protect each computer and phone with a login and, where possible, device encryption (for example BitLocker on Windows).
• Staff passwords are stored as salted hashes. Give each staff member their own login and only the role they need.
• The licence check, Google Gemini and WhatsApp Cloud API use encrypted HTTPS. Gmail uses an encrypted SSL connection.

12. How long data is kept

• Business data stays on your devices until your business deletes it.
• Quezlo keeps licence and device records while your licence is active. After that, or when you ask, we delete them within 30 days.
• Invoices and payment records for licence sales are kept as long as the law requires.
• Emails you send us are kept as long as we need them to help you.

13. Deleting your data

The same steps are also on https://quezlotech.com/delete-account.

Windows

1. Make a backup first if you may need the data later.
2. Close the app. Press Windows key + R, type %APPDATA%\Quezlo Technologies\Quezlo and press Enter. Delete that folder.
3. PDFs you share or send from the Windows app (receipts, bills, lab reports) are also saved in Documents\Quezlo\PDF. Delete that folder too.
4. To remove the program, open Windows Settings → Apps and uninstall Quezlo.

Removed: All patients, staff, sales, stock, accounts, photos, settings, stored keys and the licence on this computer, and the shared PDFs in Documents\Quezlo\PDF if you delete that folder.
Not removed: Backup files you saved, and PDFs you saved or sent to other places. Delete them yourself.

Android

1. Open Android Settings → Apps → Quezlo → Storage → Clear storage, or uninstall the app.

Removed: Everything the app stored on this device.
Not removed: Backup files and PDFs you saved or shared. If the device was a LAN client, the data stays on the server PC.

Web

1. In your browser's settings, clear the site data (storage) for the site where you open the app.

Removed: The database stored in that browser.
Not removed: Backup files you downloaded.

Data held by Quezlo. Quezlo holds licence and device records (licence key, random device ID, device name, business name and first/last-seen times). To delete them, email [email protected] from your business email address with your business name and licence key. We delete them within 30 days and tell you when it is done. The licence stops working on all devices. We keep invoices and payment records as long as the law requires.

14. Your rights

You can ask us what personal data we hold about you, and ask us to correct or delete it, or stop using it. Email [email protected]. We answer within 30 days. If you are not happy with our answer, you can complain to the data protection authority where you live.

For records kept by a hospital, clinic or business in the app, contact that business. It controls that data.

15. Children

Quezlo Hospital is a business app for healthcare and wholesale staff. It is not directed at children.

• Patients may include children. Their records are entered by clinic staff, and the clinic is responsible for them, including any consent a parent or guardian must give.
• Quezlo does not receive any patient data.

16. Changes to this policy

We update this page when the app changes, and change the effective date at the top. If a change affects what data is collected or shared (for example, adding accounts, cloud sync or new ads), we update this policy before the change goes live.

17. Contact

Quezlo Technologies, Pakistan
Privacy: [email protected]
Support: [email protected]

See also: Terms of use · Delete your data · Child safety · Website privacy