Who we are

Paperless software (Paperless Hospital, Paperless Pharmacy, Paperless Retail and related products) is designed, distributed and supported by Paperless Integrated Solutions (Pvt) Ltd, Zimbabwe, with offices in Bulawayo and Harare. This website, paperless.co.zw, and the services described below are operated by us.

Where your information lives

Each clinic, pharmacy or shop runs Paperless on its own computers, and its records (patients, consultations, sales, stock) are kept in that site's own database. Those records are the site's, not ours, and they do not pass through this website except as described below.

The licensing service and the vendor relay

To license and support a site, this service processes:

  • licence details: the business name, licence type, expiry date, a serial number and identifiers for each licensed computer (a machine identifier and a company identifier generated by Paperless);
  • check-ins: when a licensed computer last contacted us, its Paperless version and its network address;
  • service requests a site's server relays through us so that no vendor password is kept at the site, for example WhatsApp or e-mail messages the site chooses to send, claims and membership requests to medical aid switches, update downloads and the site's encrypted backups and key escrow. We pass these on to the service the site asked for and keep only what is needed to run, secure and troubleshoot the service.

The Google connection (Google Meet)

A clinic may connect one Google account of its own to Paperless so that Paperless can create Google Meet meeting links for the clinic's remote consultations. When it does:

  • Paperless asks Google only for permission to create Meet meeting spaces (the meetings.space.created scope) and for the account's e-mail address, so the clinic can see which account is connected. Where a clinic's account cannot create meetings that way, Paperless may also ask to add events to the account's calendar, used only to create the meeting link.
  • Paperless uses that permission only to create a meeting link when the clinic asks for one. It does not read the account's mail, contacts, files or other calendar entries.
  • No patient information is sent to Google. A meeting is created without a patient's name, details or any description of the consultation; the clinic shares the link with the patient itself.
  • The permission Google gives us (a refresh token) is stored encrypted on our server and used for nothing else.
  • The clinic can disconnect at any time, from Paperless or from its Google account's third-party access settings. Disconnecting from Paperless asks Google to cancel the permission and deletes the stored token.

Paperless's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

What we do not do

  • We do not sell or rent any information.
  • We do not use it for advertising.
  • We share it only with the services a site asks us to reach on its behalf, with our hosting providers, or where the law requires it.

Security and keeping

Our server is reached only over encrypted connections, credentials and tokens are kept encrypted or out of reach of the sites, and access is limited to Paperless staff who need it. We keep licence records for as long as a site is our customer and as the law requires; a disconnected Google permission is deleted at once.

Questions

Write to support@paperless.co.zw or call +263 782 346 414. You can also reach us through our contact page.