Bimarist Privacy Policy

Last Updated: 28/09/2026

This Privacy Policy explains how Bimarist ("Bimarist", "we", "us", or "our") collects, uses, stores, protects, and otherwise processes personal data when you access or use the Bimarist platform, website, applications, and related services (collectively, the "Services").

By accessing or using the Services, creating an account, or selecting "I Agree", you acknowledge that you have read and understood this Privacy Policy and agree to the processing of personal data as described herein, subject to applicable laws and regulations.

This Privacy Policy forms an integral part of the Bimarist Terms and Conditions.

1. Scope of This Privacy Policy

This Privacy Policy applies to personal data processed through the Bimarist platform, including data relating to:

• Patients and individuals receiving healthcare services.
• Doctors and healthcare professionals.
• Clinic owners and administrators.
• Clinic employees and authorized users.
• Website and application visitors.
• Individuals who communicate with Bimarist or use its services.

Where a clinic, healthcare provider, or other organization uses Bimarist to process patient information, that organization may determine the purposes and means of processing patient data and may therefore act as the Data Controller, while Bimarist may act as a Data Processor or service provider, depending on the nature of the processing and applicable law.

2. Personal Data We May Collect

Depending on how you use the Services, Bimarist may collect and process the following categories of information:

2.1 Account and Identity Information

This may include:

• Full name.
• Username.
• Email address.
• Phone number.
• Account credentials.
• Role and permissions.
• Clinic or organization information.
• Professional information.
• Account registration and authentication information.

2.2 Patient Information

Where a clinic or healthcare provider uses Bimarist to manage patient records, the platform may process information such as:

• Patient name.
• Date of birth and age.
• Gender.
• Contact information.
• Address.
• Emergency contact information.
• Appointment information.
• Medical history.
• Diagnoses.
• Symptoms.
• Clinical notes.
• Prescriptions.
• Treatment information.
• Laboratory and diagnostic information.
• Medical reports and documents.
• Allergies.
• Insurance-related information.
• Billing and payment-related information.
• Other information entered by an authorized healthcare provider.

2.3 Sensitive Personal Data

Bimarist may process sensitive personal data, including health information and, where applicable, biometric information or other categories classified as sensitive under applicable law.

Such information will be processed only where there is a valid legal basis and where the applicable requirements, permissions, consents, licenses, and safeguards required by law are satisfied.

Health data is treated as sensitive personal data under Egypt's Personal Data Protection framework.

2.4 Technical and Usage Information

When you use our website, application, or platform, we may automatically collect certain technical information, including:

• IP address.
• Device type.
• Operating system.
• Browser type.
• Application version.
• Login and session information.
• Date and time of access.
• Security logs.
• Error and diagnostic information.
• Usage and interaction information.
• Information regarding platform performance.

We use this information primarily for security, troubleshooting, analytics, service operation, and improvement.

3. How We Collect Personal Data

We may collect personal data through:

• Information you provide when creating an account.
• Information entered by authorized clinic or healthcare personnel.
• Information submitted through the Bimarist website or applications.
• Appointment and booking activities.
• Communications with Bimarist.
• Technical logs and automated technologies.
• Integrations or third-party services authorized by the user or clinic.
• Other lawful means permitted under applicable laws.

Where personal data relates to a patient, the relevant clinic or healthcare provider may be responsible for ensuring that it has the appropriate legal authority, consent, authorization, or other lawful basis to collect and provide such data to Bimarist.

4. Purposes of Processing

Bimarist may process personal data for the following purposes:

4.1 Providing the Services

To:

• Create and manage accounts.
• Provide clinic management functionality.
• Manage patient records.
• Manage appointments and bookings.
• Manage doctors and healthcare staff.
• Provide dashboards and reports.
• Manage billing and administrative operations.
• Provide notifications and service communications.
• Enable authorized users to access relevant information.

4.2 Security and Fraud Prevention

We may process information to:

• Protect accounts.
• Detect unauthorized access.
• Prevent fraud and abuse.
• Investigate security incidents.
• Monitor suspicious activity.
• Protect the platform and its users.

4.3 Service Improvement

We may use technical, statistical, aggregated, or anonymized information to:

• Analyze platform performance.
• Identify technical problems.
• Improve existing features.
• Develop new features.
• Improve user experience.
• Conduct internal analytics and quality assurance.

Where information is used for analytics or product development, Bimarist will seek to use aggregated or anonymized information where appropriate and permitted by applicable law.

4.4 Legal and Regulatory Compliance

We may process or disclose personal data when reasonably necessary to:

• Comply with applicable laws.
• Respond to lawful requests from competent authorities.
• Protect legal rights.
• Establish, exercise, or defend legal claims.
• Prevent or investigate unlawful activities.
• Comply with court orders or other legally binding requirements.

5. Legal Basis for Processing

Depending on the circumstances, Bimarist may rely on one or more lawful bases for processing personal data, including:

• The consent of the data subject.
• Performance of a contract or steps requested before entering into a contract.
• Compliance with a legal obligation.
• Protection or exercise of legal rights.
• Legitimate interests, where permitted by applicable law and where such interests do not override the rights and freedoms of the data subject.
• Other lawful bases recognized under applicable legislation.

Egypt's PDPL framework recognizes multiple lawful bases for processing, including consent, contractual necessity, legal obligations, legal rights, and legitimate interests, subject to applicable requirements.

For sensitive personal data, including health data, additional legal requirements may apply.

6. Patient Data and Healthcare Information

Bimarist provides technology and software services for managing healthcare operations and records.

Bimarist does not provide medical diagnosis, medical treatment, medical advice, or clinical decision-making.

Doctors and healthcare providers remain responsible for:

• Diagnosing patients.
• Providing medical advice.
• Prescribing medication.
• Determining treatment.
• Reviewing patient records.
• Ensuring that patient information entered into the platform is accurate and appropriate.
• Obtaining any legally required patient consent or authorization.

Where a healthcare provider uses Bimarist to manage patient records, the healthcare provider remains responsible for determining the appropriate purposes and legal basis for processing patient data, to the extent required by applicable law.

7. Sharing and Disclosure of Personal Data

Bimarist does not sell personal data to third parties.

We may share personal data only where reasonably necessary for providing the Services, fulfilling legal obligations, protecting rights, or as otherwise permitted by applicable law.

Depending on the circumstances, information may be shared with:

7.1 Authorized Clinic Users

Patient information may be accessible to doctors, nurses, administrators, receptionists, or other users authorized by the relevant clinic or organization.

Access may be controlled through user roles and permissions.

7.2 Service Providers

We may use trusted third-party service providers to support the operation of Bimarist, including providers of:

• Hosting and cloud infrastructure.
• Database services.
• Email and messaging services.
• Authentication services.
• Security services.
• Backup services.
• Monitoring and analytics.
• Payment processing, where applicable.
• Technical support.

Such providers may process personal data only to the extent necessary to provide their services and subject to appropriate contractual and security requirements.

7.3 Legal and Regulatory Authorities

We may disclose personal data where required by law, court order, regulatory requirement, or lawful governmental request.

7.4 Business Transfers

If Bimarist undergoes a merger, acquisition, restructuring, sale of assets, or similar transaction, personal data may be transferred as part of that transaction, subject to applicable legal requirements and appropriate safeguards.

8. Data Security

Bimarist takes reasonable technical and organizational measures designed to protect personal data against:

• Unauthorized access.
• Unauthorized disclosure.
• Loss.
• Destruction.
• Alteration.
• Misuse.
• Accidental or unlawful processing.

Security measures may include:

• Authentication controls.
• Role-based access controls.
• Encryption where appropriate.
• Secure communication protocols.
• Access logging.
• Security monitoring.
• Backup and recovery procedures.
• Infrastructure security controls.
• Employee and administrator access restrictions.

However, no electronic system, transmission, or storage method can be guaranteed to be completely secure.

Users are responsible for maintaining the confidentiality of their account credentials and for using appropriate security practices.

9. Data Retention

Bimarist retains personal data only for as long as reasonably necessary to:

• Provide the Services.
• Maintain and operate user accounts.
• Fulfill contractual obligations.
• Comply with legal or regulatory requirements.
• Resolve disputes.
• Enforce agreements.
• Protect the security and integrity of the Services.

Retention periods may differ depending on the type of information, the purpose for which it was collected, applicable legal requirements, and the relationship between Bimarist and the relevant clinic or organization.

When personal data is no longer required, it may be deleted, anonymized, or securely archived, subject to applicable legal and contractual obligations.

10. Data Subject Rights

Subject to applicable law and any applicable limitations, data subjects may have rights including:

• The right to know whether their personal data is being processed.
• The right to access personal data.
• The right to obtain information about the purposes and manner of processing.
• The right to request correction of inaccurate or incomplete information.
• The right to withdraw consent where processing is based on consent.
• The right to request deletion or erasure where legally applicable.
• The right to object to certain processing activities where permitted by law.
• The right to receive notifications regarding certain personal data breaches where required by law.

The Egyptian PDPC identifies rights including information, access, withdrawal of consent, rectification, and erasure among data-subject rights under the current framework.

Requests may be submitted using the contact information provided in Section 16 of this Privacy Policy.

Where Bimarist processes patient data solely on behalf of a clinic or healthcare organization, requests concerning that patient data may need to be submitted to the relevant clinic or healthcare provider, depending on the applicable legal and contractual arrangement.

11. Children's Data

Bimarist services are primarily intended for clinics, healthcare professionals, organizations, and their authorized users.

Where a clinic uses Bimarist to maintain medical records relating to children, such information may constitute sensitive personal data under applicable law.

The relevant healthcare provider or organization is responsible for obtaining any required parental or legal guardian consent and complying with applicable requirements concerning children's data.

Bimarist will process children's data only for lawful and authorized purposes.

12. Cookies and Similar Technologies

Bimarist may use cookies and similar technologies to:

• Maintain user sessions.
• Remember preferences.
• Improve functionality.
• Monitor performance.
• Analyze usage.
• Protect the platform.
• Detect suspicious activity.

Users may be able to manage cookies through their browser settings. Disabling certain cookies may affect the functionality of some parts of the Services.

Where legally required, Bimarist will request appropriate consent before using non-essential cookies or similar technologies.

13. Third-Party Services and Links

The Services may contain integrations with or links to third-party services.

Bimarist is not responsible for the privacy practices, security, or content of third-party services that are not controlled by Bimarist.

Users should review the privacy policies of third-party services before providing them with personal information.

14. International Data Transfers

Personal data may be processed or stored using infrastructure or service providers located outside the Arab Republic of Egypt, where permitted by applicable law.

Where personal data is transferred outside Egypt, Bimarist will comply with applicable requirements governing cross-border transfers, including any required licenses, permits, approvals, safeguards, or applicable exceptions.

Under the current Egyptian framework, cross-border transfers are subject to specific regulatory requirements and, in applicable cases, PDPC licensing or other permitted mechanisms.

15. Personal Data Breaches

In the event of a personal data breach, Bimarist will take reasonable steps to:

1. Detect and investigate the incident.
2. Contain and mitigate its effects.
3. Assess the nature and scope of the breach.
4. Take corrective and security measures.
5. Notify the competent authority and affected data subjects where required by applicable law.

The current Egyptian Executive Regulations provide specific breach-notification requirements, including notification to the Personal Data Protection Centre within the applicable period and notification to affected data subjects within the prescribed period.

16. Your Responsibilities

If you use Bimarist on behalf of a clinic, company, healthcare provider, or other organization, you are responsible for:

• Using the platform only for lawful purposes.
• Ensuring that you have appropriate authority to access and process the data.
• Obtaining required patient consents or other lawful bases.
• Providing accurate information.
• Maintaining account security.
• Granting access only to authorized personnel.
• Removing access when a user is no longer authorized.
• Complying with applicable healthcare, privacy, and data protection laws.

17. Changes to This Privacy Policy

Bimarist may update this Privacy Policy from time to time to reflect:

• Changes to the Services.
• Changes in applicable laws or regulations.
• Changes in our data processing practices.
• Security or operational requirements.

The updated version will be published on the Bimarist website or platform.

Where required by applicable law, we will provide additional notice or obtain consent before implementing material changes.

Your continued use of the Services after the effective date of an updated Privacy Policy may constitute acceptance of the updated policy where permitted by law.

18. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or the processing of personal data, please contact Bimarist through:

Bimarist

Email: [privacy@bimarist.com]

We will review and respond to privacy-related requests in accordance with applicable laws and regulations.

19. Acceptance

By creating an account, accessing, or using Bimarist, or by selecting "I Agree", you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein, to the extent that consent is required under applicable law.

Where processing is based on another lawful basis, your data may be processed in accordance with that lawful basis and the applicable legal requirements.

Effective Date: [Date]

Last Updated: [Date]