Who we are

Paperless software (Paperless Hospital, Paperless Pharmacy, Paperless Retail and related products) is designed, distributed and supported by Paperless Integrated Solutions (Pvt) Ltd, Zimbabwe, with offices in Bulawayo and Harare. This website, paperless.co.zw, and the services described below are operated by us.

Where your information lives

Each clinic, pharmacy or shop runs Paperless on its own computers, and its records (patients, consultations, sales, stock) are kept in that site's own database. Those records are the site's, not ours, and they do not pass through this website except as described below.

The licensing service and the vendor relay

To license and support a site, this service processes:

  • licence details: the business name, licence type, expiry date, a serial number and identifiers for each licensed computer (a machine identifier and a company identifier generated by Paperless);
  • check-ins: when a licensed computer last contacted us, its Paperless version and its network address;
  • service requests a site's server relays through us so that no vendor password is kept at the site, for example WhatsApp or e-mail messages the site chooses to send, claims and membership requests to medical aid switches, update downloads and the site's encrypted backups and key escrow. We pass these on to the service the site asked for and keep only what is needed to run, secure and troubleshoot the service.

The Google connection (Google Meet)

A clinic may connect one Google account of its own to Paperless so that Paperless can create Google Meet meeting links for the clinic's remote consultations. When it does:

  • Paperless asks Google only for permission to create Meet meeting spaces (the meetings.space.created scope) and for the account's e-mail address, so the clinic can see which account is connected. Where a clinic's account cannot create meetings that way, Paperless may also ask to add events to the account's calendar, used only to create the meeting link.
  • Paperless uses that permission only to create a meeting link when the clinic asks for one. It does not read the account's mail, contacts, files or other calendar entries.
  • No patient information is sent to Google. A meeting is created without a patient's name, details or any description of the consultation; the clinic shares the link with the patient itself.
  • The permission Google gives us (a refresh token) is stored encrypted on our server and used for nothing else.
  • The clinic can disconnect at any time, from Paperless or from its Google account's third-party access settings. Disconnecting from Paperless asks Google to cancel the permission and deletes the stored token.

Paperless's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

The QuickBooks Online connection

A clinic that keeps its books in QuickBooks Online may connect its own QuickBooks company to Paperless, using an Intuit app the clinic owns. When it does:

  • The clinic's Paperless server sends each journal entry to the clinic's QuickBooks company through our relay: amounts, dates, the accounts they belong to, and what was sold or claimed (item names, tariff codes and descriptions).
  • Customers are named by name and Paperless number only - a patient as their name and patient number, a medical aid, company or supplier by its name. No telephone number, address, identity number, diagnosis or clinical note is sent.
  • Paperless reads from QuickBooks only what it needs to avoid sending anything twice: the names of accounts, customers, suppliers and items, the numbers of records it sent, the balance of invoices and bills it pays, and the company's settings.
  • The clinic's Intuit app secret and the permission Intuit gives (its tokens) are stored encrypted on our server, never on the clinic's computers, and used for nothing else.
  • The clinic can disconnect at any time, from Paperless or from the Apps section of QuickBooks; disconnecting from Paperless asks Intuit to cancel the permission and deletes the stored tokens. What was sent stays in the clinic's QuickBooks company, which is the clinic's.

What we do not do

  • We do not sell or rent any information.
  • We do not use it for advertising.
  • We share it only with the services a site asks us to reach on its behalf, with our hosting providers, or where the law requires it.

Security and keeping

Our server is reached only over encrypted connections, credentials and tokens are kept encrypted or out of reach of the sites, and access is limited to Paperless staff who need it. We keep licence records for as long as a site is our customer and as the law requires; a disconnected Google permission is deleted at once.

Questions

Write to support@paperless.co.zw or call +263 782 346 414. You can also reach us through our contact page.