Privacy Policy - Bola Health

Bola Health LIMITED

This Privacy Policy (“Policy”) summarizes how Bola Health Limited, its respective officers, employees, medical staff, consultants, agents, and partners (collectively referred to as “the clinic”, “we”, “us”, or “our”) collect, use , disclose , retain , dispose , and destroy the Personal Data that we collect from our patients (“patients” or “you” or “your”) and what the clinic does to protect that Personal Data in the course of providing our Healthcare Services and/or products. It also describes the rights which our patients may have in relation to the Personal Data which is collected, used, stored, transferred and/or processed by the clinic. We are committed to complying with this Policy and with applicable local data protection legislation.

Definitions

1.1 “Healthcare Services[SM1] ” means the medical and healthcare services provided by the clinic which include but are not limited to the following:

Pediatric Care
General Family Medicine
Dental Services
Nutrition and Dietary Counseling
Mental Health Support and Counseling
Wellness Programs and Preventive Care
Chronic Disease Management
Women’s Health Services
Holistic and Integrative Health Services
Community Health and Wellness Initiatives

1.2 ‘Personal Data’ means: –

any information (however stored) relating to a living individual or an individual who has been deceased for less than thirty (30) years who can be identified
1. from the information alone; or
2. from the information and other information in the possession of, or likely to come into the possession of the Centre; or
any information (however stored) pertaining to the health record of a living individual or an individual who has been deceased for less than thirty (30) years which –
1. is in the custody or control of the clinic in connection with the care of an individual; and
2. consists of information relating to –
  1. the past or present physical or mental health, or condition, of an individual, for example,
    1. clinical information about diagnosis and treatment;
    2. genetic data or biometric data;
  2. the registration of an individual for the provision of health services and any number, symbol or code assigned to uniquely identify the individual for those services;
  3. the name of the individual’s health care provider; or
  4. payments made by, or the eligibility of, the individual for the provision of health services, or any other health related information about the individual that is collected in the course of the provision of health services to that individual.

Types of Personal Data

This Policy explains our practices with regard to Personal Data collected by the clinic. We may collect the following types of Personal Data:

Contact Information that allows us to communicate with you which include but is not limited to your name, D.O.B., mailing address, telephone numbers, and email address.
Any data or information which we are legally bound to collect to comply with local regulations, statutes or laws as well as to comply with our patient intake procedures.
Relationship Information that helps us do business with you, such as the types of products and/or Healthcare Services that may interest you.
Information on payment transactions and data which is necessary for us to make or process payments which may also include credit / debit card numbers, security code numbers and other such relevant billing details.
Health information for the purposes of providing the Healthcare Services and/or products to you such as any information concerning past or present physical or mental health or condition, clinical information about diagnosis and treatment, genetic data or biometric data.

The above is a non-exhaustive list which is reflective of the varied nature of the Personal Data processed as part of providing the Healthcare Services and/or products.

Personal Data we receive from you about third-parties

the clinic requires that where you wish to disclose the Personal Data of third-parties, you must first ensure that:

you are entitled to divulge the Personal Data to us and have obtained their consent to such disclosure; and
there are no agreements in place which would prohibit us from disclosing the Personal Data in a manner as contemplated by this Policy and that no further steps are required by our office to disclose the Personal Data.

More specifically, it is a requirement that when you disclose any Personal Data of third-parties to us, such third-parties should be made aware as to who we are, how their Personal Data will be used, what disclosure practices we have in place and the rights of any such third-party to contact our office and to inquire about the purposes for which we collect data.

Purposes for the collection, use and disclosure of your Personal Data

Generally, the clinic may collect, use and disclose your Personal Data for the following purposes:

to provide our Healthcare Services and/or products as may be requested by you;
verify your identity and patient due diligence;
managing the administrative and business operations of the clinic and complying with internal policies, standards and procedures;
audit purposes;
responding to, processing and handling your complaints, queries, requests, feedback and suggestions;
processing payments, invoicing, or providing any ancillary services to you;
for the purposes of communication with you through approved channels of communications and where necessary to keep you up to date on the status of your consultations and other requests, such as prescription orders;
for the purposes of compliance with our legal obligations such as record keeping obligations;
for the purposes of preventing, detecting and investigating a crime;
for insurance purposes;
upon receipt of instruction or request from you or any third-party authorized by you;
to comply with court orders or orders of other agencies with competent jurisdiction and to exercise and/or defend our legal rights;
to comply with any applicable rules, laws and regulations, codes of practice or guidelines, obligations, requirements or arrangements for collecting, using and disclosing Personal Data that apply to the clinic or that it is expected to comply;
to assist in law enforcement and investigations by relevant authorities;
archival management; and/or
any other purpose related and/or ancillary to any of the above or any other purpose for which your Personal Data is required by our office.

We will minimize our collection and use of your Personal Data to what is needed for the above mentioned purposes.

Retention of Personal Data

We will retain your Personal Data for as long as is necessary to meet the purposes for which it was originally collected or to satisfy our legal obligations. In order to learn more about how the clinic retains and/or disposes of your Personal Data, please review our Retention Policy which is available online at[Tb2] [ ] or a copy can be provided to you upon request.

Communications

From time to time, we may send you certain communications such as appointment reminders, administrative messages and service announcements, including policy updates.

Disclosure of Personal Data

The clinic will take reasonable steps to protect your Personal Data against unauthorized disclosure. Subject to the provisions of any applicable law, your Personal Data may be disclosed, for the purposes listed above (where applicable) to the following entities or parties whether they are located overseas or in Jamaica-

We may share your Personal Data with an affiliate or associated entity of the clinic which may only use your Personal Data for the purposes listed above and who will be bound by law or contract to protect your Personal Data and only use your Personal Data in accordance with our instructions.
We may share your Personal Data with a registered medical practitioner, a medical institution, or accredited laboratories who will be bound by law or contract to protect your Personal Data.
We may share your Personal Data to comply with applicable laws or regulations, respond to a court order, or to comply with a similar legal obligation to produce information.
We may share your Personal Data to establish or exercise the clinic’ legal rights or defend against legal claims.
We may share your Personal Data with insurance companies, insurance brokers, health facilities and other entities where it is necessary to fulfil our legal obligations as well as to protect your vital interests.
We may share your Personal Data to investigate, detect, suppress, prevent or take action regarding illegal or prohibited activities, suspected fraud or situations involving potential threats to the reputation or safety of any person.
We may disclose your Personal Data for the purposes of the due diligence required by or for the completion of a transaction such as a merger, acquisition or asset sale. We will comply with any applicable legal requirements, including notice requirements, that apply to such transactions.
We may disclose your Personal Data to agents, contractors, vendors, or third-party service providers who provide administrative or operational services to the clinic, such as courier services, telecommunications, information technology, payment, payroll, processing, training, storage, archival, or other services to the clinic.
Otherwise, we will only disclose your Personal Data where you have directed us or give us permission to do so.

Please note this list is non-exhaustive and there may be other examples where we need to share

your Personal Data with other third parties in order to provide our Healthcare Services and/or products as effectively as we can.

Transfer of Personal Data

We may need to transfer Personal Data to third-parties located in a territory outside of Jamaica for further processing in accordance with the purposes for which the Personal Data was originally collected or for purposes to which you have subsequently consented.

By registering with the clinic and/or utilizing our Healthcare Services, you hereby consent to the transfer of your Personal Data to a territory outside of Jamaica whenever such need may arise.

You shall not hold us liable for the manner in which your Personal Data is processed and/or used by any third-parties which are situated outside Jamaica.

Consent

Your knowledge and consent to the clinic’ collection, use and disclosure of your Personal Data is important. We rely on the following actions as indications of your consent to our existing and future personal data practices:

Your voluntary provision of Personal Data in person to the clinic or through any of our electronic channels;
Your consent solicited by the clinic for a specified purpose;
Your receipt of this Policy, until you notify the clinic of a withdrawal of your consent; or
Your consent given through your authorized representative such as a parent, legal guardian, agent or holder of a power of attorney.

Subject to certain legal or contractual restrictions and reasonable notice, you may withdraw your consent at any time. If you wish to withdraw consent or discuss the implications of such withdrawal, please contact us through the means described below. In some circumstances, legal requirements may prevent you from withholding consent. Your decision to withhold consent may also limit the products and/or Healthcare Services that the clinic is able to provide to you.

Safeguarding Personal Data

the clinic has put in place appropriate technical and organizational safeguards to protect your Personal Data against theft, loss and unauthorized access, use and disclosure. Your Personal Data is kept in the electronic systems of our office, in back storage systems and on paper files. the clinic’ employees, consultants, agents, independent contractors and data processors (i.e. those who process your Personal Data on our behalf, for the purposes listed above), who have access to, and are associated with the processing of your Personal Data are obligated to protect your Personal Data by adhering to our policies, practices and applicable laws.

The clinic, however, does not warrant or make any representations that your Personal Data may not be accessed, used, disclosed, altered, or destroyed by breach of such safeguards. the clinic will immediately notify you if your Personal Data has been affected by a security breach and will maintain an incident response policy that includes notifications consistent with applicable law.

Data Protection Rights

You will have the following rights with respect to your Personal Data:

Access: You are entitled to ask us if we are processing your Personal Data and, if so, you can request access to the Personal Data. This enables you to receive a copy of the Personal Data we hold about you and certain other information regarding the Personal Data.
Rectification: You are entitled to request that any incomplete or inaccurate Personal Data we hold about you is rectified. If you are entitled to rectification and if we have shared your Personal Data with others, we will notify such other persons about the rectification where possible. If you make such a request, where possible and lawful to do so, we will also tell you the persons with whom we have shared your Personal Data so that you may contact such persons directly.
Erasure: You are entitled to ask us to delete or remove Personal Data in certain circumstances such as where we no longer need it or if you withdraw your consent (where applicable). There are also certain exceptions where we may refuse a request for erasure, for example, where the Personal Data is required for compliance with local laws or in connection with claims. If you are entitled to erasure and if we have shared your Personal Data with others, we will notify such other persons about the erasure where possible.
Restriction: You are entitled to ask us to suspend the processing of your Personal Data, for example, if you would like for us to establish its accuracy or the reason for processing it.
Transfer: You may request that we transfer certain of your Personal Data to another party.
Objection: You are entitled to ask us to stop processing your Personal Data in certain circumstances, for example, where the processing is likely to cause substantial damage or distress except if we can demonstrate compelling legal grounds for the processing. You also have the right to object where we are processing your Personal Data for direct marketing purposes. You may opt-out of receiving direct marketing from us at any time.
Automated decisions: You may contest any automated decision made about you where this has a legal or similar significant effect and ask for it to be reconsidered.
Breach Notification: You have a right to receive notification in the event of a security breach.
Consent: If we rely on your explicit consent as our legal basis for processing your Personal Data, you may withdraw your consent at any time. However, we note that this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide the Healthcare Services to you. We will of course advise you, if this is the case, at the time you withdraw your consent.

Full details of these rights can be found in Part II of the Data Protection Act, 2020.

Please note that some of these rights may be limited where we have an overriding interest or legal obligation to continue to process your Personal Data.

If you wish to exercise any of the abovementioned rights, a request must be submitted in writing to our Data Protection Officer (see contact details below). In order to protect your privacy, you may be asked to provide suitable proof of identification before we can process your request.

Correcting And Updating Personal Data

You must inform us immediately where your Personal Data has changed, or where you believe that the Personal Data we hold is inaccurate, incomplete or otherwise deficient.

the clinic shall not be held responsible for any loss, damage or claim that may arise due to any inaccurate, incomplete, or otherwise deficient Personal Data which you or any third-party have provided to us.

Applicable Law

This Policy shall be governed by and construed in accordance with the laws of Jamaica.

Policy Changes

This Policy was last updated on October 5, 2024. We will update this Policy from time to time to reflect any changes to our use of your Personal Data. We may also update this Policy as required to comply with changes in applicable law or regulatory requirements. Our obligations will be determined having regards to the policy as amended from time to time and not the policy at the time we collected the Personal Data. We will post notifications of any changes to this Policy on our website and we encourage you to check our website periodically so as to become aware of any changes to this Policy.

Contact Us

If you have any questions, concerns or suggestions about our privacy practices or this Policy, please contact our Data Protection Officer at [[email protected]].