DRAFT — NOT FOR PUBLICATION. The factual sections below (what is collected, why, and who it reaches) are derived from the BIMA app's actual data flows and are accurate as of 8 October 2026. The sections marked [LEGAL] state positions that Milvik's legal counsel and data protection officer must confirm before this is published or linked from the app.
BIMA is operated in Pakistan by Milvik AB and its local partners. This policy explains what personal data the BIMA mobile app collects, why, and who it reaches.
What we collect
To identify you and sign you in
- Your mobile number, and the one-time passcodes sent to it
- An anonymous device identifier, your device platform, model and app version
Your profile and household
- Your name, date of birth and gender
- The name, date of birth, gender and relationship of any dependants you add
- Your preferred language
Your cover
- The policies and subscriptions held against your mobile number, their status, premiums and payment history
When you consult a doctor
- The patient the consultation is booked for, the symptoms and reason you give
- The clinical record created by the doctor: notes, diagnoses, prescriptions, test requests and any documents you upload
- Whether the consultation was by call or video, and when it took place
When you make a claim
- What happened, when, and where, including the hospital or facility involved
- Who is claiming and their relationship to you
- The documents you upload in support, which may include medical and identity documents
- The bank account the payout should reach
To send you notifications
- A push token issued by your handset's operating system, and whether you have turned notifications off
Why we use it
To verify who you are; to show you your cover; to arrange and record medical consultations; to assess and pay claims; to tell you when something needs your attention; to meet our obligations as an insurer and the record-keeping those obligations require; and to keep the service secure.
[LEGAL] The lawful basis for each purpose under Pakistan's data protection regime needs to be stated here.
Who it reaches
- Within BIMA and Milvik, the systems that run the service: the app's backend, the medical record system that holds consultation records, the claims system, and the messaging system that sends your notifications.
- Your mobile operator or payment partner, where your cover was sold through them, for subscription and premium handling.
- Doctors and healthcare providers we engage to deliver consultations, and the hospitals or laboratories a consultation refers you to.
- The insurer underwriting your policy, for assessing and paying claims.
- Technology providers who process data on our behalf, including the push notification service that delivers banners to your handset and the video provider that carries a video consultation.
We do not sell your personal data, and we do not use your health data for advertising.
[LEGAL] Each named recipient needs confirming against the live contracts, and any transfer of data outside Pakistan must be described here with its safeguards.
How long we keep it
[LEGAL] Retention periods per data category — insurance records, clinical records and claims documents each carry their own statutory minimum, and these must be stated rather than summarised.
Your choices
- You can turn push notifications off, on the handset or in the app. Messages we must send you about your cover or a claim may still reach you by SMS.
- You can correct your profile details in the app.
- You can ask us what we hold about you, ask us to correct it, and ask us to delete it where the law allows. We cannot delete records we are required to keep as an insurer.
[LEGAL] The full list of statutory rights, how to exercise each, our response deadline, and the complaint route to the regulator.
Contact
[LEGAL] The controller's registered name and address in Pakistan, and a working contact address for privacy requests.
Changes to this policy
When we change this policy we will update the version shown in the app. If a change materially affects you, we will ask you to accept the new version when you next sign in.