Privacy Policy

We collect a few categories of information from users of our website and products:

• Personally identifiable information (name, email, phone) that you voluntarily provide.
• Information about your internet connection, your device, and how you use our site.
• Non-personal information like browser type, language preference, referrer, and request timestamps.

We use the information we collect to:

• Operate, maintain, and improve our services.
• Answer inquiries and fulfil requests you make.
• Send administrative information — updates, security alerts, support replies.
• Personalise your experience on our website.
• Analyze usage patterns and improve site functionality.

We may disclose personal information that we collect or that you provide:

• To our subsidiaries and affiliates.
• To contractors, service providers, and other third parties supporting our business.
• To comply with a court order, law, or legal process.
• To enforce rights arising from any agreements with you.
• If we believe disclosure is needed to protect the rights, property, or safety of Zimam, our customers, or others.

We have measures in place to protect your personal information from loss, unauthorized access, alteration, or disclosure. No system is perfect — transmission over the internet is never fully secure — so we can't guarantee absolute security, but we take it seriously and treat any incident as the most important thing on our plates.

We use cookies (small files placed on your device) to remember preferences and improve the site. You can refuse cookies in your browser settings; doing so may disable some functionality.

Our site may link to third-party sites we don't control. We aren't responsible for their content or their privacy practices — please review their policies before sharing data with them.

The Zimam Connect iOS and Android apps follow the same Privacy Policy. The app requires sign-in. What it collects:

• Account information — email and display name, used to authenticate you and identify you to teammates on shared tickets.
• Authentication tokens — short-lived tokens stored on-device in iOS Keychain (expo-secure-store) or Android Keystore. They never leave your device except in Authorization headers to our own API.
• Support content — ticket subjects and bodies, replies, and any files or screenshots you attach.
• Push notification token — an opaque device identifier from Expo's push service, used to deliver notifications about ticket activity.
• Diagnostics — none. No third-party analytics, no crash reporting.

The app does not collect your precise location, contacts, microphone, calendar, health data, financial information, browsing history outside the app, or advertising identifiers. It does not display advertising.

Zimam Health is a patient-facing iOS and Android app for viewing records supplied by participating hospitals and booking appointments. It requires a Zimam ID. It processes:

• Account and identity information — email, display name, national ID, date of birth, phone number, sex, a hospital-issued verification code, and an internal patient identifier. National ID and verification code are used to link the account to the correct hospital records.
• Health information — encounters, diagnoses and summaries, laboratory results, medications, imaging reports, and the hospitals linked to the patient. Hospitals remain the source and controller of their clinical records.
• Appointment information — selected hospital, department, clinician, date and time, booking status, and any reason the patient chooses to provide.
• Authentication tokens — short-lived tokens stored on-device in iOS Keychain or Android Keystore and sent only to our own API for authentication.
• Push notification token — an opaque device identifier used through Expo Push Notifications, Apple APNs, or Google FCM to deliver appointment and record alerts. Notification previews are kept minimal and do not include detailed clinical results.
• Diagnostics — none. The app does not use third-party analytics, advertising SDKs, or third-party crash reporting.

Zimam Health does not collect precise location, contacts, microphone, calendar, financial information, browsing history outside the app, or advertising identifiers. It does not display advertising or sell health data.

The Zimam platform is self-hosted on infrastructure we operate. A handful of third parties process limited data on our behalf:

• Expo Push Notifications (Exponent, Inc.) — relays pushes from our backend to APNs and FCM. Receives the device token and the notification payload (typically the ticket title and a short summary). It does not receive your account email or ticket history.
• Apple APNs / Google FCM — operating-system-level relays your device subscribes to in order to receive notifications.
• Keycloak — our self-hosted identity provider, used to authenticate you. Email and authentication tokens are managed in Keycloak. No third party is involved in this layer.

You can delete a Zimam Connect account from the app or web, and remove a Zimam Health account link directly from the Health app. These actions are permanent and cannot be undone. Account Deletion guide.

If you cannot sign in, email privacy@zimamsys.com from the address registered on your account and we'll action a deletion request within 30 days.

Zimam Connect is not directed at children. Zimam Health is intended for people who can lawfully manage their own health account; it is not designed for child-directed use and currently has no parent or guardian account flow. We do not knowingly allow children below the applicable digital-consent age to create their own account. Contact privacy@zimamsys.com if you believe a child's information was submitted improperly.

We may update this policy from time to time. Material changes will be posted on this page with a notice that the policy has been updated.

Questions or concerns about this policy?

Emailprivacy@zimamsys.com