PMS263 Privacy Policy

PMS263 is a product of New Health 263 (Pvt) Ltd, hereafter “PMS263”) (“we,” “our,” or “us”). We provide a practice management system where clinicians manage records and conduct tele-consultations.

This Privacy Policy explains how PMS263 collects and uses your personal information, with whom it is shared, and your choices and rights in relation to your personal information.

It applies to personal information that is collected from you physically or in a borderless digital environment during your interactions with us, whether online, including through our websites (including mobile sites), social media sites and mobile applications (collectively “Internet Services”) that link to this Privacy Statement, in writing or orally, or personal information that we may collect offline or receive from third parties.

• By using our services, you acknowledge and agree to the practice described in this policy.

PMS263 is primarilysubject to the Cyber and Data Protection Act of 2021 (“CDPA” and its Regulations) and other data and privacy regulations from where you can access our services or internet services.

We may collect the following kinds of information when you use the Services: Information you provide directly to us. For certain activities, such as when you register, use our telemedicine services, subscribe to our alerts, or contact us directly, we may collect some or all of the following types of information:

• Contact information, such as your full name, email address, mobile phone number, and address;
• Identification Number, Date of Birth, Gender, Relationship Status, Medical details e.g. blood type, family history.
• Username and password;

For Healthcare Service Providers, we also collect information about your employment, such as your job title, practice area, primary specialty, professional qualifications and medical license status.

• Personal health information; and
• Any other information you provide to us.
• We may combine such information with information we already have about you.

Information we obtain from your Healthcare Service Providers and other sources. In connection with your treatment, we may collect medical records from your past, current, and future health care providers. This may include information about your diagnosis, previous treatments, general health, laboratory and pathology test results and reports, social histories, any family history of illness, and records about phone calls and emails related to your illness.

We may also collect other information that does not personally identify you. Such other information includes browser and device information, website and application usage data, IP addresses, demographic information such as geographic location, home language, and information collected through cookies and other technologies or information that has been anonymised or aggregated. If we link this information with your personal information, we will treat such linked information as personal information.

You can choose not to provide personal information to us when requested. However, if this is necessary to provide you with our solutions, products and services, access to our Internet Services, or to perform administrative functions, we may be unable to provide you with our solutions or services.

• When you access our Internet Services, or interact with us in any other way, or use our solutions, products and services.
• We collect personal information when you:
• Visit our platform,

We may also collect personal information via API integrations, such as through switch service providers or other technical integrations necessary for providing our services.

• Use our solutions, products and services,
• Perform administrative and business functions,
• When you communicate with us.

We collect personal information when we respond to your inquiries and requests, obtain feedback from you about our solutions, products and services or you apply for employment with us.

Usage Data is collected automatically when using the Service.

Usage Data may include information such as your device's Internet Protocol address (e.g. IP address), browser type, browser version, the pages of our service that you visit, the time and date of your visit, the time spent on those pages, unique device identifiers and other diagnostic data.

When you access the service by or through a mobile device, We may collect certain information automatically, including, but not limited to, the type of mobile device you use, your mobile device unique ID, the IP address of your mobile device, your mobile operating system, the type of mobile Internet browser you use, unique device identifiers and other diagnostic data.

We may also collect information that your browser sends whenever you visit our service or when you access the service by or through a mobile device.

When we process your personal information in connection with the purposes set out in this Privacy Statement, we may rely on one or more of the following legal bases, depending on the purpose for which the processing activity is undertaken and the nature of our relationship with you:

Processing is necessary to meet our contractual obligations with you which include verifying your identity, efficiently managing the administrative and operational aspects of the practice and customer support relating to your consultations.

Our legitimate interests (or those of a third party with whom we share your personal information) for the purpose of managing, operating or promoting our business, including direct marketing, and administrative purposes, except where such interests are overridden by your interests or fundamental rights or freedoms which require protection of personal information.

Where this is necessary to comply with a legal obligation on us, whether contractually or otherwise.

Where you have consented for such processing to take place.

For doctors, Nurses, Staff, we may use your personal information to:

Registering you and providing access to the PMS263 system;

Support continuity of care by including your details on prescriptions and other documents;

Provide you with access to restricted pages on the Platform; and

Compile non-personal statistical information about browsing habits, click patterns and access to the Platform.

For patients, we may use your personal information to:

Identification, medical diagnosis, communication, and treatment purposes.

Marketing purposes though limited strictly to PMS263 promotional communications and product/service enhancements.

Where necessary, personal data may be shared with funders and other healthcare service providers through prescriptions, doctor’s notes, or other printed documents, only when requested or required for the provision of care.

Obtain feedback from you about our services, products and solutions including through client satisfaction surveys, in which event, we will only use your personal information for the sole purpose of sending you a survey.

Respond to your inquiries and fulfil requests by you.

Assess the performance of our Internet Services and to improve their operation.

Inform you about and provide you with our products, services and solutions.

Update our records and keep your contact details up to date.

We engage in these activities to manage our contractual relationship with you, to comply with our legal obligations, or for our legitimate business interests:

Provide you with marketing materials and to personalise your experience with us, for example to:

Send marketing communications to you.

Enable you to subscribe to our newsletters and mailing lists.

Enable you to register for PMS263 events, workshops and webinars.

We engage in these activities with your consent or for our legitimate business interests:

Achieve our business purposes and analyse information. For example, to:

Establish, manage, and maintain our business relationship with you.

Recruit staff.

Process and respond to privacy requests, questions, concerns and complaints.

Fulfil legal and contractual obligations.

We engage in these activities to manage our contractual relationship with you, to comply with a legal obligation and for our legitimate business interests.

• We may share your personal information for the purposes set out in this Privacy Policy (as applicable):

With Healthcare Providers, Insurance Companies and other healthcare-related entities: We may share your information with other Healthcare Service Providers, laboratories, insurance companies, organ procurement organizations, medical examiners or funeral directors, and other entities relevant to providing you with treatment options and support.

For Business Transfers: We may share or transfer Your personal information in connection with, or during negotiations of, any merger, sale of Company assets, financing, or acquisition of all or a portion of Our business to another company.

With Corporate Affiliates: We may share Your information with Our affiliates, in which case we will require those affiliates to honour this Privacy Policy. Affiliates include joint venture partners or other companies that We control or that are under common control with Us.

• With your consent: We may disclose Your personal information for any other purpose with Your consent.

Legal Purposes: If we are legally compelled to disclose information about you to a third party, we will attempt to notify you by sending an email to the email address in our records unless doing so would violate the law or unless you have not provided your email address to us. We may disclose information to respond to subpoenas, court orders, legal process, law enforcement requests, legal claims or government inquiries, and to protect and defend the rights, interests, and security of PMS263, our affiliates, users, or the public.

Any third parties with whom we share personal information are contractually required to implement appropriate data protection and security measures to protect personal information and are not permitted to use personal information for any purpose other than the purpose for which they are provided with or given access to personal information.

• As a data subject you have certain rights under section 14 of the CDPA relating to your personal information which are:
• The right to be informed of the use your personal data will be put.
• The right to access your personal information in our custody.
• The right to object to ways we are using all or parts your personal data.
• The right to correction of inaccurate personal data or incomplete.
• The right to deletion of false or misleading information.
• The right to withdraw consent if we are using your data based on your consent.
• The right to complain to the designated Data Protection Authority which is the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ).
• You can exercise these rights in relation to your personal data by writing to us using the contact details below.

PMS263 is committed to protecting your personal information from accidental or unlawful destruction, damage, loss, alteration, unauthorised access or disclosure by using reasonable, appropriate, physical, administrative and technical safeguards and contractually requiring that third parties to whom we disclose your personal information do the same.

Local storage. The Software is installed and runs entirely on the Healthcare Service Provider’s own servers and infrastructure. All data entered into, processed by or generated through the Software, including Personal Data, is stored only on the Healthcare Service Provider’s systems at the Healthcare Service Provider’s chosen location. NH263 does not host, store, back up or have access to this data.

No cross-border transfer by the NH263. NH263 does not collect, receive or transfer any Healthcare Service Provider’s data, including Personal Data, outside Zimbabwe or to any third party. If the Healthcare Service Provider’s decides to move, replicate, back up or host its data outside Zimbabwe, the Healthcare Service Provider’s does so as the data controller. The Healthcare Service Provider’s alone is responsible for making sure that transfer complies with the Cyber and Data Protection Act [Chapter 12:07] and any other applicable law.

Healthcare Service Provider’s responsibility and limitation of liability. The Healthcare Service Provider controls the environment where its data is stored, so the Healthcare Service Provider is solely responsible for the security, integrity, availability and backup of that data. This includes access controls, network security, encryption, hardware, operating systems and staff access. To the fullest extent permitted by law, NH263 is not liable for any loss, corruption, unauthorised access, disclosure or breach of Healthcare Service Provider’s data that arises from, or relates to, the Healthcare Service Provider’s systems, infrastructure, personnel or third parties engaged by the Healthcare Service Provider.

Support access. If the Healthcare Service Provider asks for technical support that requires access to its systems or data, NH263 will access only what the Healthcare Service Provider expressly authorises, for that purpose and for that session only. NH263 will not copy, keep or transfer any Personal Data outside the Healthcare Service Provider’s environment.

• Our Internet Services may contain links to third party websites and applications.

We are not responsible for and make no representations or warranties in relation to the privacy practices or content of any third-party websites and applications. Your use of such sites and applications is subject to the applicable third-party privacy policy or statement and is at your own risk.

We will retain your personal information for as long as is necessary to fulfil the purpose for which it was collected unless a longer retention period is required to comply with legal obligations, resolve disputes, protect our assets, or enforce agreements. The criteria we use to determine retention periods include whether:

• We are under a legal, contractual or other obligation to retain personal information, or as part of an investigation or for litigation purposes;

Personal information is needed to maintain accurate business and financial records the extent required by government agencies including tax authorities and in compliance with court orders, other quasi-judicial directives and regulatory authorities.

• You have consented to us retaining your personal information for a longer retention period, in which case, we will retain personal information in line with your consent.

• We may update this Privacy Policy at any time. If we do, we will update the “last modified” section of this Privacy Policy.
• We encourage you to regularly review this Privacy Policy to stay informed about our privacy practices.

If you have any complaints, requests or questions about how your personal information is handled by PMS263, you have a privacy concern or you wish to make a request or a complaint relating to your personal information, please contact us.