Limware

1. Who We Are

Limware Technologies operates the Limware Laboratory Information Management System (LIMS), a SaaS platform designed for clinical and pathology laboratories. We are the data controller for account and usage data, and a data processor for any Laboratory Data (patient records, test results, reports) that Subscribers upload.

2. Information We Collect

We collect the following categories of information:

• Account Data: your name, email address, phone number, organisation name, and billing information provided during registration or subscription management.
• Laboratory Data: patient demographics, sample records, test orders, results, and reports entered by you or your Users. This may include sensitive health information.
• Usage Data: log files, IP addresses, browser/device type, pages visited, and feature usage metrics collected automatically when you use the Platform.
• Communications: messages, support tickets, and feedback you send to us.

3. How We Use Your Information

We use collected information only for the purposes listed below:

• To provision, operate, and improve the Platform and its features.
• To process payments and manage your subscription.
• To send transactional communications (account alerts, invoices, system notifications).
• To respond to support requests and troubleshoot issues.
• To analyse aggregated, anonymised usage patterns for product development — Laboratory Data is never used for this purpose.
• To comply with legal obligations and enforce our Terms of Service.

4. Patient & Health Data

Limware handles patient health information solely on behalf of the Subscriber (the laboratory). We act as a data processor for this information and do not access it except when necessary to provide support or ensure service integrity, and only with the Subscriber's authorisation.

Subscribers are responsible for obtaining all necessary patient consents required under applicable Pakistani law and any other regulation governing health data in their jurisdiction.

We implement technical safeguards including encryption at rest and in transit, role-based access controls, and audit logging for all access to Laboratory Data.

5. Data Sharing & Disclosure

We do not sell, rent, or trade your data. We may share information only in the following limited circumstances:

• Service Providers: trusted third-party vendors (cloud hosting, email delivery, payment processors) who process data on our behalf under confidentiality obligations.
• Legal Requirements: when required by law, court order, or to protect the rights and safety of our users or the public.
• Business Transfers: in the event of a merger, acquisition, or sale of assets, subject to the acquiring party agreeing to honour these privacy commitments.

6. Data Security

We implement industry-standard security measures including:

• TLS encryption for all data in transit.
• AES-256 encryption for sensitive data at rest.
• Regular security assessments and penetration testing.
• Role-based access control and multi-factor authentication options.
• Activity audit logs retained for a minimum of 12 months.

7. Data Retention

• Account Data is retained for as long as your subscription is active and for up to 7 years afterwards to comply with legal obligations.
• Laboratory Data is retained for the duration of your subscription and for 30 days after termination, during which you may request an export. After this period, data is securely and permanently deleted.
• Usage logs are retained for 12 months.

8. Cookies & Tracking

We use strictly necessary cookies to maintain your authenticated session and remember your preferences. We do not use third-party advertising cookies.

We use first-party analytics to understand how the Platform is used. This data is anonymised and never linked to individual patient records.

9. Your Rights

Subject to applicable law, you have the following rights regarding your personal data:

• Access: request a copy of the personal data we hold about you.
• Correction: ask us to correct inaccurate or incomplete information.
• Deletion: request erasure of your personal data where we no longer have a legal basis to retain it.
• Portability: receive your data in a machine-readable format.
• Objection: object to processing based on our legitimate interests.

10. Children's Privacy

The Platform is designed for use by healthcare professionals and organisations. We do not knowingly collect personal data directly from children under 18. Laboratory Data concerning minor patients is handled only as directed by the Subscriber in their professional capacity.

11. International Data Transfers

Your data is primarily stored on servers located in the region you select during account setup. If we transfer data internationally (for example, to cloud infrastructure providers), we ensure appropriate safeguards are in place.

12. Changes to This Policy

We may update this Privacy Policy periodically. When we make material changes, we will notify you via email or an in-app notice at least 14 days before changes take effect. The updated date at the top of this page reflects the latest revision.

13. Governing Law

This Privacy Policy is governed by the laws of the Islamic Republic of Pakistan, including the Prevention of Electronic Crimes Act 2016 and any applicable health data regulations. Disputes shall be resolved in the courts of Lahore, Punjab, Pakistan.

Privacy Enquiries

For any privacy-related questions or to exercise your data rights, contact our Data Protection Officer at:

Email: privacy@limware.io