BERMUDA CANCER AND HEALTH CENTRE

DATA PRIVACY NOTICE ("NOTICE")

1) Introduction

Bermuda Cancer and Health Centre is a registered charity created under the laws of Bermuda (the "Centre").

The purpose of this document is to provide you with information on the Centre's use of your Personal Information and Sensitive Personal Information ("Personal Identifiable Information") in accordance with the Personal Information Protection Act 2016 (as amended) ("PIPA").

Personal Information means any information about an identified or identifiable individual. Examples of Personal Information include an individual's name, email address, phone number, and physical address etc.

Sensitive Personal Information means any Personal Information relating to an individual’s place of origin, race, colour, national or ethnic origin, sex, sexual orientation, sexual life, marital status, physical or mental disability, physical or mental health, family status, religious beliefs, political opinions, trade union membership, biometric information or genetic information.

Any individual, entity or pubic authority that processes Personal Identifiable Information is subject to PIPA (each an "Organisation").

If you are an individual, this will affect you directly. If you are a service provider that provides the Centre with Personal Identifiable Information on individuals connected to you, for any reason in relation to your business dealings with us, this will be relevant for those individuals and you should transmit this document to such individuals or otherwise advise them of its content.

Your Personal Identifiable Information will be processed by the Centre, and by persons engaged by the Centre.  Under PIPA, individuals have rights, and the Centre has obligations, with respect to Personal Identifiable Information. The purpose of this Notice is to explain how and why the Centre, and persons engaged by the Centre, will use, store, share and otherwise process your Personal Identifiable Information. This notice also sets out the rights of individuals under PIPA, and how they may exercise them.

2) Your Personal idenitifiable Information

By virtue of engaging the services of the Centre, you will provide us with certain Personal Information and Sensitive Personal Information within the meaning of PIPA.

In particular, you will provide us with Personal Identifiable Information as required by any forms or associated documentation that you complete when being recruited or appointed as an employee of the Centre; when engaging the services of the Centre; when you volunteer your services to the Centre, when you provide it to us or our service providers in correspondence and conversations (including by email); when you make transactions or donations with respect to the Centre; and when you engage in marketing or fundraising related events or utilise materials or make a donation to the Centre.

We may also obtain your Personal Identifiable Information from other health care providers (local and overseas) and insurance companies.

3) How the centre may use your Personal identifiable Information

The Centre, as an Organisation, may collect, store and use your Personal Identifiable Information for purposes including the following:

3.1: For the performance of a treatment, including:

(a) administering services or managing the Centre;

(b) processing your Personal Identifiable Information within the Centre, such as entering your information in the relevant medical and data management portals (as applicable);

(c) providing you with correspondence containing the results of any testing conducted; and

(d) facilitating the transfer of the Centre's medical information between service providers.

3.2 In pursuance of our legitimate interests, or those of a third party to whom your Personal Identifiable Information is disclosed, including:

(a) complying with a legal, accounting or regulatory obligation to which we or the third party are subject;

(b) assessing and processing requests you make;

(c) sending updates, information and notices or otherwise corresponding with you in connection with your services with the Centre;

(d) investigating any complaints, or pursuing or defending any claims, proceedings or disputes;

(e) providing you with, and informing you about Centre updates and fundraising initiatives;

(f) managing our risks and operations;

(g) complying with audit requirements;

(h) ensuring internal compliance with our policies and procedures;

(i)  protecting the Centre against fraud, breach of confidence or theft of proprietary materials;

(j)  seeking professional advice, including legal advice;

(k) monitoring communications to/from us (where permitted by law); and

(l)  protecting the security and integrity of our IT systems.

We will only process your Personal Identifiable Information in pursuance of our legitimate interests where we have considered that the processing is necessary and, on balance, our legitimate interests are not overridden by your legitimate interests, rights or freedoms.

The Centre continues to be an Organisation even though it may have engaged a service provider and other third parties to perform certain activities on the Centre's behalf and therefore the Centre remains ultimately responsible for the use of your Personal Identifiable Information even where service providers are using your Personal Identifiable Information.

4) Sharing your Personal identifiable Information

We may share your Personal Identifiable Information with the Bermuda Hospitals Board, service providers, and overseas healthcare providers ("Affiliates"), as well as local insurance companies and agencies of the Government of Bermuda for processing payroll tax and social insurance.

The Centre’s Affiliates may process your Personal Identifiable Information on the Centre's behalf, including with our accountants, auditors and lawyers which may be Organisations in their own right.  The Centre's service providers are processors acting on the instructions of the Centre. Additionally, a service provider may use your Personal Identifiable Information where this is necessary for compliance with a legal obligation to which it is directly subject. The service provider, in respect of this specific use of Personal Identifiable Information, may be deemed to be acting as an Organisation.

In exceptional circumstances, we will share your Personal Identifiable Information with regulatory, prosecuting and other governmental agencies or departments, and parties to litigation (whether pending or threatened) in any country or territory.

5) Sending your Personal identifiable Information internationally

Due to the international nature of the Bermuda healthcare system, your Personal Identifiable Information may be transferred to jurisdictions that do not offer equivalent protection of Personal Identifiable Information as under PIPA. In such cases, we will process Personal Identifiable Information or procure that it be processed in accordance with the requirements of PIPA, which may include having appropriate contractual undertakings in legal agreements with service providers who process Personal Identifiable Information on our behalf.

6) Retention and deletion of your Personal identifiable Information

We will keep your Personal Identifiable Information for as long as it is required by us. For example, we may require it for our legitimate business purposes, to perform our contractual obligations, or where law or regulation obliges us to. We will generally retain your Personal Identifiable Information throughout the lifecycle of your treatment with the Centre or other interaction with the Centre. Some Personal Identifiable Information will be retained after your relationship with us ends.  We expect to delete your Personal Identifiable Information (at the latest) once there is no longer any legal or regulatory requirement or legitimate business purpose for retaining your Personal Identifiable Information.

7) Rights of individuals

If you are an individual, you have certain data protection rights, including the right to:

• be informed about the purposes for which your Personal Identifiable Information are processed;
• access your Personal Identifiable Information;
• request the discontinuance of direct marketing;
• restrict or cease the processing of your Personal Identifiable Information;
• have incomplete or inaccurate Personal Identifiable Information corrected;
• be informed of a Personal Identifiable Information breach (unless the breach is unlikely to be prejudicial to you);
• complain to the Privacy Commissioner; and
• require us to delete your Personal Identifiable Information in some limited circumstances.

8) Website Use

This Notice also applies and governs the manner in which the Centre collects, uses, maintains and discloses information collected from users ("Users") of the www.cancer.bm website ("Site").  The Site is intended to provide you with information on the services and updates with regard to the Centre.

We do not sell, trade, or rent Personal Identifiable Information of the Site to others. We may share generic aggregated demographic information not linked to any Personal Identifiable Information regarding visitors and Users of the Site with our Affiliates for the purposes outlined above. We may use third party service providers to help us operate the Centre and the Site or administer activities on our behalf, such as sending our newsletters or surveys. We may share your information with the third parties listed in this Notice for the purposes provided above.

By using the Site, you signify your acceptance of this Notice. If you do not agree with this Notice, please do not use our Site. Your continued use of the Site following the posting of changes to this Notice will be deemed your acceptance of those changes.

9) Changes to this notice

The Centre has the discretion to update this Notice at any time. We encourage Users and individuals engaging the services of the Centre to frequently check this page for any changes.

10) Contact us

We are committed to processing your Personal Identifiable Information lawfully and to respecting your data protection rights. Please contact the Centre's Privacy Officer if you have any questions about this privacy notice or the Personal Identifiable Information we hold about you.

Katrina S Darrell

Bermuda Cancer and Health Centre

46 Point Finger Road

Paget DV 04

Bermuda

+1 441 236 1001

compliance@chc.bm

This document was last updated on May 15, 2024