ZenHosp handles patient records, clinical notes and billing data every day. This policy explains exactly what we collect, why we hold it, who it is shared with, and how you get it deleted.
ZenHosp is a hospital ERP and CRM platform operated by Zengnia Technologies (“Zengnia”, “we”, “us”, “our”). Hospitals, clinics and diagnostic centres use ZenHosp to run admissions and discharges, outpatient and inpatient care, pharmacy and inventory, laboratory and radiology workflows, insurance and billing, staff scheduling, and online consultations.
This Privacy Policy applies to our mobile applications for Android and iOS, our website at zengnia.com, every hospital-specific ZenHosp portal, and our APIs (together, the “Services”).
Because ZenHosp holds medical records, we treat privacy as a clinical safety issue rather than a formality. Please read this policy carefully. By creating an account or using the Services, you acknowledge the practices described here.
The Services are provided by Zengnia Technologies, Wilmington, DE 19808, USA. We build and host the ZenHosp software; we are not a healthcare provider and we do not deliver medical care.
ZenHosp is multi-tenant. Each hospital or clinic that subscribes gets its own isolated database schema, its own subdomain and its own user accounts. One hospital cannot see another hospital's data.
This policy covers information handled by Zengnia. It does not cover the independent privacy practices of the hospital you receive care from or work for, or of third-party websites and services that link to or from the Services.
Who is responsible for your data depends on which data it is. This distinction matters when you want to exercise a right, so we set it out plainly:
| Data | Controller | Our role |
|---|---|---|
| Patient records, clinical notes, prescriptions, lab results, billing | The hospital or clinic using ZenHosp | Processor — we store and process it on the hospital's instructions |
| Your ZenHosp login, profile and account settings | Zengnia Technologies | Controller |
| Subscription, invoices and payments for the ZenHosp product itself | Zengnia Technologies | Controller |
| Website enquiries, demo requests and support tickets | Zengnia Technologies | Controller |
What this means for you. If you are a patient asking about your medical record, your hospital decides what happens to it and we act on their instruction. If you are asking about your ZenHosp login itself, we decide, and you can come straight to us. Either way, start with our deletion request form and we will route it correctly.
Held on behalf of your hospital, and only where the relevant module is in use:
Health information is sensitive personal data. It is collected only to deliver care through your hospital and is never used for advertising or sold.
Card payments for ZenHosp subscriptions are processed by Stripe. We never receive or store full card numbers, CVV codes or card expiry dates — those go directly to Stripe.
We do not collect precise device location. When you search for your hospital in the app, that search runs against hospital names and addresses — your GPS is not read.
We use your information to:
We do not sell your personal information. We do not use health information for advertising. We do not use patient records to train AI models.
We share information only where it is needed to run the platform:
We do not sell or rent personal information to third parties, and we do not share patient data between hospitals.
We rely on a small number of trusted providers. Information reaches them only when you use the relevant feature, and each handles it under their own privacy terms:
| Provider | Used for | What it receives |
|---|---|---|
| Stripe | Subscription & card payment processing | Billing contact and card details, entered directly into Stripe |
| Zoom | Video and audio consultations | Session identifiers, participant name and the audio/video stream |
| OpenAI | Optional voice assistant and website chatbot | The audio or text you submit to that feature |
| Sign-in and website analytics | Authentication identifiers and anonymised website usage data | |
| Email delivery providers | Transactional email — reminders, alerts, receipts | Recipient address and message content |
| Cloud hosting & storage | Running the platform and storing uploaded files | Encrypted platform data |
We encourage you to review these providers' own privacy policies. Where a feature is optional, not using it means no data reaches that provider.
ZenHosp is software. It is not a healthcare provider and does not provide medical advice, diagnosis or treatment. All clinical decisions are made by the licensed professionals at your hospital, who remain responsible for the care they deliver.
Online consultations run over Zoom. Where a consultation is recorded, you will be told and, where required by law, asked for consent. Recordings and consultation notes are treated as sensitive health information and stored inside your hospital's isolated schema.
Not for emergencies. ZenHosp is not an emergency service. If you are experiencing a medical emergency, call your local emergency number or go to the nearest emergency department immediately. Do not use the app to report an emergency.
ZenHosp includes an optional voice assistant that lets staff dictate and navigate hands-free, and a chatbot on our public website that answers product questions.
Please avoid dictating identifiable patient details into the voice assistant unless your hospital's policy expressly permits it. Anything you say is transcribed by a third-party provider.
Our mobile apps request device permissions only for specific features, and only with your consent:
Video consultations, scanning QR and barcodes on wristbands and stock, capturing documents and a profile photo.
Audio during consultations and, if you use it, the optional voice assistant.
Uploading and downloading reports, prescriptions, scans and attachments.
Appointment reminders, task assignments, lab result alerts and critical stock warnings.
You can review or revoke any of these at any time in your device settings. Features that depend on a revoked permission will stop working, but the rest of the app continues normally.
We apply administrative, technical and physical safeguards designed to protect your information:
No method of transmission or storage is completely secure. We work continuously to protect your data, and we will notify affected users and the relevant authorities of a data breach where applicable law requires it.
We keep information for as long as your account is active and as long as needed to provide the Services. After that:
| Type of data | How long we keep it |
|---|---|
| Account profile and login credentials | Deleted or anonymised when your deletion request is actioned |
| Medical records and clinical notes | For the period your hospital and local law require — medical record retention is typically measured in years and often cannot be shortened by request |
| Invoices, payments and tax records | As required by financial and tax law in the relevant jurisdiction |
| Support tickets and correspondence | Up to 24 months after the ticket is closed |
| Security and audit logs | Up to 12 months, for fraud prevention and clinical governance |
| Voice assistant audio | Not retained after transcription completes |
When information is no longer needed, we delete it or de-identify it so it can no longer be linked back to you.
Depending on where you live, you may have the right to:
You can update much of your information yourself from your account settings. For anything else, contact us at privacy@zengnia.com. We verify every request before acting on it and respond within the time applicable law allows.
For requests about clinical records, we act as processor for your hospital. We will forward your request to them and support them in answering it, but the hospital makes the final decision on medical records it is legally obliged to retain.
You can request deletion of your account and associated personal data at any time, in either of these ways:
Anything retained is kept only for the period the relevant obligation requires, is access-restricted, and is deleted once that period ends.
Our timeline. You receive an acknowledgement with a reference number immediately. We verify the request, then complete the deletion within 30 days and email you to confirm. If we cannot action part of the request, we tell you exactly which part and why.
If you are hospital staff. Deleting your account removes your access to the hospital's ZenHosp portal. Clinical records you authored remain in your hospital's system under their ownership, as clinical governance requires — but they are no longer linked to a live login of yours.
ZenHosp accounts are intended for users aged 18 and over. We do not knowingly create accounts for children or collect their information directly.
Hospitals do treat minors, and a child's medical record may be held in ZenHosp on the hospital's behalf. In that case the record is managed by the hospital under its own legal duties, and a parent or legal guardian acts on the child's behalf. If you believe a child has created an account without appropriate consent, contact us and we will remove it.
We and our service providers may process and store information in countries other than your own, including the United States. Where information is transferred internationally, we rely on appropriate safeguards — such as standard contractual clauses — to keep it protected in line with this policy and applicable data-protection law.
Hospitals with data-residency requirements should contact us before onboarding so we can confirm what we can support.
We may update this Privacy Policy from time to time. When we make material changes we update the “Last updated” date at the top of this page and, where appropriate, notify you in the app or by email.
Your continued use of the Services after an update means you accept the revised policy. If you do not agree with a change, you can request deletion of your account at any time.
If you have questions, concerns or requests about this policy or your data, reach us at:
We aim to answer every privacy enquiry within two business days.