How Onceva collects, uses, stores and protects the information clinics and patients put into the system.
Onceva is a clinical record system, so most of what it stores is information a clinic enters in the course of care. We collect only what a clinic's own workflow requires, in two broad categories.
We do not collect information for advertising purposes, and we do not ask a clinic for patient data beyond what its own record-keeping needs.
Information is used to provide the clinical record and workflow that a clinic has asked Onceva to run: keeping a patient's history in one place, supporting the consultation, prescribing and billing flow, and giving a clinic visibility into its own day. We also use account information to secure access, respond to support requests, and communicate with a clinic about its use of Onceva, such as service updates or early-access programme changes.
We do not use a clinic's patient records to train machine learning models, and we do not repurpose clinical data for any use unrelated to the care the clinic is providing.
Records are encrypted in transit between a clinic's device and Onceva, and encrypted at rest in storage. Access inside the system is role-based, so a receptionist, a nurse and a doctor at the same clinic see only the parts of a record their role requires, and every entry, edit and view of a patient record is timestamped and attributed to the account that made it.
More detail on how this works in practice, including what we do not yet claim, is set out on our Data security page.
We do not sell patient or clinic data, and we do not share clinical records with third parties for advertising or unrelated commercial purposes. Information may be shared only in the following circumstances:
A clinic's records are retained for as long as the clinic's account is active, so that its patient history remains complete and usable. If a clinic ends its use of Onceva, its data remains exportable and accessible to it for a reasonable transition period, after which it is deleted from active systems unless the clinic instructs otherwise or retention is required by law. We do not currently publish a single fixed retention period across all record types, because clinical retention expectations vary by record and by regulation as Pakistan's health-data rules develop; a clinic can always ask us directly about a specific case.
A clinic can access, correct and export the patient and account data it has entered into Onceva at any time. Where a patient asks a clinic about their own record, the clinic — as the party responsible for that patient's care — is best placed to respond, and Onceva supports that by keeping the record accurate and exportable. If you are a patient with a question about a specific clinic's record of you, we encourage contacting that clinic directly; if you contact us instead, we will help direct the request appropriately.
The Onceva marketing website does not use third-party advertising cookies. We may use basic, privacy-respecting analytics to understand how the website itself is used (for example, which pages are visited), which does not access any clinical record. The Onceva product itself uses only the technical session information required to keep a clinic securely signed in.
Write to oncevepk@gmail.com with any question about this policy, a specific record, or to make a request about your data.