The upgrade function needs to check if the "other" thing that just ran into it is a player or not. Without this check, any random thing could bump into the powerup and you'd get upgraded. With this check, you'll be required to actually walk over to the powerup and touch it to be upgraded.
We'll keep track of whatever thing hit your powerup with a local variable. We'll call the variable "character" and then set it equal to "other." (Remember, "other" is whatever "other" object ran into your powerup.)
We still have to double check that it was a player that hit your object. All players in Roblox have something called a "Humanoid" on them, and it holds all the health information of your player.
So, tell your "character" to run a function called "FindFirstChild" with the parameter "Humanoid"