Who is responsible for your information
PASCATON INVESTMENTS provides the Medical Centre Management System (MCMS). Our business address is 1088 Southview Road, Uplands, Waterfalls, Harare, Zimbabwe. You can contact us about privacy on +263 78 659 1915.
Your healthcare facility determines why it collects patient information and how it uses that information for care and administration. PASCATON INVESTMENTS provides the platform and processes facility records to deliver the agreed service. We also handle information needed to administer our own customer accounts and support requests. Your facility’s privacy notice and service arrangements apply alongside this policy.
Information MCMS processes
Depending on the services your facility uses, MCMS may process:
- Patient and guardian names, identifiers and contact details.
- Appointment requests, verification and booking-message preferences, clinical notes, vitals, diagnoses, investigations, prescriptions and other care records.
- Billing, payment and medical-aid information and uploaded documents.
- Staff accounts, roles, access records, support requests and audit history.
- Messaging preferences, reminder content, phone numbers and delivery information.
Information is supplied by patients, guardians, authorised facility staff or connected services used by the facility. Service operation also produces technical and security records.
Why information is used
Facilities use MCMS for registration, scheduling, patient care, follow-up, billing and operational management. Platform and account information is used to operate the service, authenticate users, control access, provide support, investigate faults and protect the service.
The facility is responsible for establishing the appropriate permission or other applicable legal basis for its collection and use of patient information, including health information and children’s records. Where consent is required, it must be obtained by the responsible organisation. Required clinical or administrative information may be necessary for a facility to provide the requested service.
SMS and WhatsApp reminders
When a facility enables reminders and records your explicit opt-in for the selected channel, MCMS can send appointment reminders using SMS.to, SMSPoP or Meta’s WhatsApp Business Platform. A reminder may include your name, facility, appointment date and time, and provider name. Your phone number, message content and delivery information are processed by the selected provider to deliver and track the message.
To opt out, change your contact details or request a different recipient, contact your healthcare facility. Authorised staff can update your channel preference in MCMS. Withdrawing consent stops future reminders on that channel once the preference is updated; it does not erase clinical records or messages already delivered. Do not rely on a reply such as “STOP” being processed automatically.
Public booking links collect the patient’s name, date of birth and a verified patient or guardian contact number. Verification codes and booking-status messages use the selected channel; booking consent does not automatically enable ongoing appointment reminders. Clinic staff review requests and match or register the patient before confirming an appointment.
Messages may be visible to anyone who can access your phone, notifications or linked devices. Contact your facility directly about medical questions or changes to an appointment. Messaging is not an emergency service.
Storage, security and retention
MCMS uses access controls and audit records to help protect information. Facilities must maintain appropriate staff access, account security and operating procedures. No online service can guarantee absolute security.
Information is retained according to the type of record, the facility’s requirements, applicable legal obligations and service arrangements. Clinical records, financial records, security logs and backups may have different retention periods. Closing an account or withdrawing messaging consent does not necessarily require immediate deletion of records that must be retained. Backup copies may remain until their scheduled expiry.
Hosting and communication providers may process information outside Zimbabwe. The locations and arrangements depend on the services used. Contact your facility or PASCATON INVESTMENTS for information about the processing arrangements relevant to your service.
Your requests and choices
Contact your healthcare facility first to request access to or correction of patient information, change reminder preferences, raise an objection or ask about deletion. Requests are assessed under applicable law, including any obligations to keep clinical or financial records. Identity and authority may need to be checked before information is disclosed or changed.
Parents and guardians should contact the facility about their authority to access children’s records and the appropriate recipient for reminders. For platform-account information, support concerns or help identifying the responsible facility, contact PASCATON INVESTMENTS on +263 78 659 1915. Please do not send clinical records over this contact channel unless a suitable process has been agreed.
You may also raise a privacy concern with Zimbabwe’s Data Protection Authority, POTRAZ, through its official website.
Changes to this policy
Updates will be published on this page with a revised date. Check this policy and your facility’s notice for the arrangements that apply when you use the service. If a change requires new consent, publishing the update does not replace that consent.