UroPassport is published by Uro Apps PLT ("we", "us", "our"), a limited liability partnership registered in Malaysia. This policy explains what UroPassport does — and does not do — with your information. It is written in plain language because the people who use UroPassport are patients, not lawyers.

If you have any questions, email [email protected].

The one thing to understand first

Your health records stay on your phone. UroPassport is built so that the personal health information you put into it — your records, results, medications, symptoms, notes, photos, scanned documents, and your date of birth — is stored only on your device. We do not run a server that holds your health records. We have no account system. We cannot see your records, and neither can anyone else, unless you choose to export or share them yourself.

Information stored on your device

The following is saved locally on your phone only and is never sent to us or to anyone else:

Health records you create (for example PSA results, IPSS scores, symptoms, appointments).
Photos and document scans (e.g. PDFs) you attach to records.
Free-text notes.
Your date of birth, if you choose to enter it.
Your demographic details (age group, sex, country), if you choose to enter them.
Your app settings, reminders, and any custom record types you add.

This information lives in the app's private storage on your device. If you uninstall the app without making a backup, this information is gone — that is by design, because we never keep a copy.

Information that is processed off your device

A few features need to talk to outside services to work. In every case below, information is sent only at the moment you use the feature ("in flight") and is not stored by us. Your saved records are never uploaded.

1. Voice entry (speech-to-text)

When you use the microphone to dictate a record, your spoken audio is transcribed into text.

Default mode: the audio is sent to your phone's built-in speech service — Google on Android — for transcription, exactly as it would be for any other app that uses your keyboard's voice button. How long that provider keeps the audio is governed by your own device and Google account settings, not by us.
Offline mode (optional): on supported devices (Android 13 and later) you can turn on Offline speech recognition in Settings, so the audio is transcribed on your device and does not leave it. This mode is off by default and can be less accurate.

The transcribed text is then handled on your device. We do not receive or store your audio.

2. Smart record sorting (AI)

To turn what you said into the right kind of record, UroPassport sends the text of your request(plus minimal context such as today's date and the list of record types) to Google's Gemini model through Firebase AI Logic. This is used only to understand and categorise the entry.

We send only the words of your current request — never your stored records, never your notes, never your attachments, and never your identity.
You always review and confirm what will be saved before anything is written. The AI never saves a record on its own.

3. Anonymous usage and crash reporting (optional — you choose)

To help us fix bugs and understand which features are useful, UroPassport can collect anonymoususage statistics and crash reports. This is opt-in — you choose during setup, and you can change your mind at any time in Settings → Privacy → Anonymous analytics. When it is off, nothing is collected and nothing leaves your device.

When it is on, we use:

PostHog (usage analytics, hosted in the European Union — Frankfurt),
Firebase Analytics and Firebase Crashlytics (usage and crash diagnostics, by Google).

What may be collected when analytics is on:

Which features and record types you use, and how often.
Your age group (a band such as "60–69"), sex, and country, if you provided them.
Technical details: app version, operating-system version, device model.
Crash information: error stack traces and basic navigation breadcrumbs.

What is never collected, even when analytics is on:

The content of any health record, note, result, search, photo, or document.
Your date of birth (only the age band is ever used — never the exact date).
Your name, email, phone number, or payment details.
Your advertising ID. We do not store your IP address.

Each install is identified only by a random, anonymous identifier that is not linked to your identity. Crash reports are automatically scrubbed of file paths, record identifiers, and any record content before they are sent.

4. Subscriptions

UroPassport offers a free trial and an optional paid subscription. Purchases are handled by Google Play, and subscription status is managed through RevenueCat, identified by an anonymous, device-scoped identifier. We do not receive your payment-card details — those are handled entirely by the app store. Backing up, restoring, exporting, viewing, and deleting your data are always free.

Backups and sharing — under your control

When you create a backup, UroPassport produces a single file (which you can protect with a PIN) and hands it to you to save or share wherever you choose. When you export a PDF to send to your doctor, you choose the destination (for example WhatsApp or email). Once you share a file, it is governed by wherever you sent it — not by this app. We are never in that loop.

Children

UroPassport is intended for adults managing their own urological health. It is not directed at children.

Where data is processed

Your health records: only on your device.
Anonymous analytics (if enabled): PostHog in the EU (Frankfurt); Firebase Analytics and Crashlytics with Google (typically the Singapore asia-southeast1 region).
AI sorting and cloud voice transcription: processed in flight by Google; not retained by us.

Your choices and rights

Access and control: all your data is on your device, in your hands, at all times.
Delete everything: Settings → Delete all my data permanently erases your records, attachments, and demographics from the device.
Turn off analytics: Settings → Privacy → Anonymous analytics stops all telemetry and crash reporting.
Date of birth: you can add or clear it any time in Settings; it never leaves your device.

Because we hold no copy of your health data and have no account for you, requests of the kind some laws describe (such as asking a company to delete "your data on their servers") do not apply to your health records — there is nothing on our side to delete. For questions about the anonymous analytics data, contact [email protected].

Changes to this policy

If we change how UroPassport handles data, we will update this page and the "Last updated" date. Where the change is significant, we will surface it in the app.

Contact

Uro Apps PLT — [email protected] — https://uroapps.my