HSMS Student Privacy Policy

Effective date: 7 July 2026
Last updated: 7 July 2026
Application: HSMS Student (Android package com.apexsphere_holdings.hsms_student_v2_v2)

This Privacy Policy describes how ApexSphere Holdings (Private) Limited ("ApexSphere", "we", "us") collects, uses, discloses, and protects information when you use the HSMS Student mobile application ("the App"). By using the App you agree to the terms below.

1. Who this policy applies to

The App is provided to students enrolled at schools that subscribe to the Hybrid School Management System ("HSMS"). Accounts are provisioned by your school administrator; the App is not intended for the general public.

2. Information we collect

2.1 Information you or your school provide

• Identity data: full name, username, student ID number, date of birth, gender.
• Contact data: email address, phone number, guardian contact where supplied by the school.
• School data: school affiliation, class / grade level, subjects, timetable, attendance records, grades and report cards, disciplinary records, fees status, term dates.
• Profile content: profile photograph and biographical details you enter.
• User-generated content: files you upload (e.g. assignments, documents) and text you enter into the App.

2.2 Information collected automatically

• Device data: device model, operating system version, application version, language, time zone.
• Log data: IP address, crash reports, error diagnostics, and non-identifying usage events used to improve reliability.
• Local storage: authentication tokens and cached academic data stored on your device using shared_preferences, Hive, and SQLite so the App can work offline.

2.3 Information we do not collect

• We do not collect precise or background location.
• We do not access your contacts, SMS messages, call logs, microphone, or health data.
• We do not run any background or foreground services after you close the App.
• We do not use advertising identifiers or run third-party advertising.

3. How we use information

• Authenticate you and deliver the academic services you or your school request.
• Display your timetable, grades, attendance, disciplinary records, fees, and related school content.
• Let you upload assignments and documents to your school.
• Generate PDF report cards and receipts on your device.
• Diagnose crashes, prevent abuse, and improve stability and performance.
• Comply with legal obligations and school policies.

4. Third-party service providers

We share the minimum data required with the following processors, who are contractually bound to protect it:

• Google LLC — Firebase Core & Firebase Storage. Hosts uploaded files (e.g. assignments) and supports core app services. See Firebase Privacy & Security.
• Google LLC — Google Play Services. Required by Android for app distribution and integrity checks.
• ApexSphere HSMS Servers Hosted by ApexSphere Holdings; stores your school records and syncs them to the App.

We do not sell your personal information. We do not share it with advertisers or data brokers.

5. Legal basis for processing

We process personal data under one or more of the following bases: performance of the contract between you (or your school) and ApexSphere, compliance with legal obligations, your consent (where required), and our legitimate interest in operating a secure and reliable service.

6. Data retention

We retain personal data for as long as your school account is active and for a reasonable period afterwards to meet legal, academic-record, and audit requirements. When retention is no longer required, data is deleted or anonymised. Schools may set additional retention periods for academic records under applicable education law.

7. Your rights

Subject to applicable law (including Zimbabwe's Data Protection Act [Chapter 11:12] and, where applicable, the GDPR), you have the right to:

• Access the personal data we hold about you.
• Ask us to correct inaccurate data.
• Ask us to delete your data (see Section 8).
• Object to or restrict certain processing.
• Withdraw consent where processing is based on consent.
• Lodge a complaint with your local data-protection authority.

Because academic records are owned by your school, some requests must be routed through your school administrator.

8. Account and data deletion

9. Children's privacy

The App is intended for students enrolled at subscribing schools, some of whom are under 18. Where a student is under 13 (or the equivalent age of digital consent in their jurisdiction), the App is provisioned by the school acting under verifiable parental or guardian consent obtained by the school. We do not knowingly collect personal information directly from a child under 13 without such consent. If you believe a child has provided information to us without appropriate consent, contact us and we will delete it promptly.

10. Security

We use industry-standard measures to protect your data, including HTTPS/TLS in transit, encryption at rest for cloud-stored files, role-based access controls, and periodic security review. No system is perfectly secure; you are responsible for keeping your login credentials confidential.

11. International data transfers

Data may be processed on Cloud infrastructure outside Zimbabwe. Where personal data is transferred internationally, we rely on the safeguards offered by Google's data-processing terms.

12. Changes to this policy

We may update this policy from time to time. Material changes will be communicated in-app or by email. The "Effective date" at the top of this page shows when the current version took effect.

13. Contact us

ApexSphere Holdings (Private) Limited
Email: info@hsms.co.zw
Website: https://hsms.co.zw