Your information deserves responsible handling.

Zanexa Solutions is a technology company headquartered in Zanzibar, Tanzania. We design, implement and support digital platforms for healthcare, legal practice, asset management and enterprise operations.

For the purposes of this policy, “Zanexa,” “we,” “our” and “us” refer to Zanexa Solutions. References to “you” mean a website visitor, business contact, prospective customer, authorized platform user or any other person whose personal data we process.

Zanexa is registered with Tanzania’s Personal Data Protection Commission in the data protection roles applicable to its operations.

This policy applies when you:

• visit zanexa.co.tz or another Zanexa-owned website;
• submit a contact, support or demonstration request;
• communicate with our commercial, implementation or support teams;
• attend a Zanexa event, training or product session;
• receive authorized product or company communications from us; or
• use a Zanexa platform where Zanexa determines the purpose of the relevant processing.

Customer organizations may have their own privacy notices explaining how they use information within Zanexa products. If you are a patient, employee, client or other data subject of one of our customers, you should first direct questions about your records to that organization.

Zanexa’s role depends on the context in which personal data is processed.

The information we collect depends on how you interact with us. It may include:

• Identity and contact data: name, organization, role, work email, telephone number and region.
• Inquiry information: product interests, operational requirements, organization type, preferred contact method and messages you submit.
• Account and access data: authorized user identifiers, roles, authentication events and access records.
• Technical data: IP address, browser and device information, operating system, referring page, timestamps and security logs.
• Support information: support requests, correspondence and technical diagnostic information supplied during issue resolution.
• Event and training data: registration details, attendance, feedback and related communications.

Please do not place patient records, passwords, financial credentials or other sensitive information in a general contact or demo-request form.

We may use personal data to:

• respond to inquiries and arrange demonstrations;
• assess whether a Zanexa product is suitable for an organization;
• provide implementation, training, maintenance and support;
• manage accounts and authorized platform access;
• monitor availability, performance, security and misuse;
• maintain business records and customer relationships;
• improve our websites, products, documentation and services;
• send relevant product information where permitted;
• investigate incidents, prevent fraud and protect our legal rights; and
• meet regulatory, contractual and other legal obligations.

We do not use personal data for unrelated purposes without an appropriate legal basis and, where required, further notice.

Depending on the activity and applicable law, we process personal data where it is necessary:

• with your valid consent;
• to respond to a request or take steps connected with a contract;
• to perform our contractual obligations;
• to comply with a legal or regulatory obligation;
• for legitimate business and security interests that do not override your rights; or
• for another ground permitted by applicable data protection law.

Where processing is based on consent, you may withdraw that consent. Withdrawal does not affect processing lawfully completed before the withdrawal.

Some Zanexa products, particularly ZeHMS, are capable of processing health and other sensitive personal data. In most customer deployments, the healthcare facility determines the purposes of that processing and Zanexa acts as its technology service provider and data processor.

Access to customer-controlled sensitive data is restricted to authorized purposes such as implementation, support, security, backup, recovery or other documented customer instructions. Zanexa personnel are not permitted to access such information merely because it is technically available.

Product-specific contracts, data processing agreements, access controls, audit records and confidentiality requirements supplement this policy.

We may share limited personal data with:

• service providers supporting hosting, email, communications, analytics, security or technical operations;
• professional advisers such as auditors, accountants and legal counsel;
• regulators, courts, law-enforcement authorities or public bodies where disclosure is legally required;
• an organization involved in a legitimate restructuring, investment, acquisition or transfer of business, subject to appropriate confidentiality; or
• another party where you or the relevant customer has authorized the disclosure.

Service providers are expected to process information only for agreed purposes and to apply appropriate confidentiality and security controls. Zanexa does not sell or rent personal data.

Some technology providers may operate infrastructure outside Tanzania. Where personal data is transferred across borders, Zanexa assesses the proposed transfer and applies the legal, contractual and security safeguards required by applicable law.

Where regulatory authorization or a cross-border data transfer permit is required, the transfer will be handled through the applicable approval process.

We retain personal data only for as long as it is reasonably required for the purpose for which it was collected, including support, security, contractual, audit, dispute and legal requirements.

Retention periods vary by record type. We consider the nature and sensitivity of the information, the relationship involved, legal requirements, operational need and the risk associated with continued storage.

Customer-controlled platform data is retained and deleted in accordance with the applicable customer agreement, documented instructions and legal requirements.

Zanexa applies technical and organizational controls intended to protect personal data against unauthorized access, loss, alteration, disclosure or misuse.

Depending on the system and processing risk, controls may include:

• encrypted network communication;
• role-based and least-privilege access;
• multi-factor authentication;
• tenant and customer-data separation;
• security and activity logging;
• backup and recovery procedures;
• controlled administrative access;
• staff confidentiality obligations; and
• security monitoring and incident response procedures.

No internet-connected service can guarantee absolute security. We therefore review and improve controls according to system risk, operational experience and legal requirements.

Subject to applicable law and any lawful limitation, you may request:

• confirmation that we process your personal data;
• access to personal data we hold about you;
• correction of incomplete or inaccurate information;
• deletion or restriction where the legal requirements are satisfied;
• withdrawal of consent;
• information about relevant processing and disclosures;
• objection to certain processing where the law provides that right; or
• another remedy available under applicable data protection law.

We may need to verify your identity before acting on a request. If the data is controlled by one of our customers, we may direct the request to that organization or assist it in responding.

We will not discriminate against a person for making a legitimate privacy request.

Our corporate website and business inquiry forms are not directed to children. Do not submit a child’s personal data through a general website form.

Where a customer uses a Zanexa platform to provide services involving children, the customer is responsible for establishing the appropriate authority and purpose for the processing. Zanexa applies the agreed product, security and data-processing controls.

Our website may use strictly necessary cookies for security, session management and basic functionality. Where analytics are enabled, we aim to limit collection to information needed to understand website performance and improve content.

Non-essential cookies or similar technologies will be managed through appropriate notice and choice where required. Zanexa does not use website cookies to sell personal profiles.

Zanexa maintains procedures for identifying, assessing, containing and responding to suspected personal data incidents.

Where an incident creates a notification obligation, Zanexa will notify the relevant customer, regulator or affected person as required by the applicable role, agreement and law.

Suspected security or privacy incidents may be reported to [email protected].

We may revise this policy as our products, processing activities or legal obligations change. The latest version will be published on this page with an updated review or effective date.

Where a change materially affects how we use personal data, we will provide additional notice where reasonably practical or legally required.

Privacy questions, data-subject requests and suspected privacy incidents may be submitted using the details below:

Please describe your request clearly and avoid sending unnecessary sensitive information. We may request additional details solely to verify identity, locate the relevant records and respond securely.

If you remain dissatisfied with how a data protection matter has been handled, you may have the right to submit a complaint to Tanzania’s Personal Data Protection Commission.