Data Protection & Your Rights
NurseLink is designing its personal-data programme around Jamaica’s Data Protection Act, 2020 and guidance from the Office of the Information Commissioner.
1. Data controller registration
The NurseLink operating entity must maintain the registration required for data controllers that process personal data. Fraternal Ventures Limited is currently recorded as the NurseLink operating/data-controller entity in Jamaica. Registration status will be maintained and published as the production service is finalized.
2. Data Protection Officer
Because NurseLink is intended to process sensitive health and care information, Fraternal Ventures Limited is recorded as the DPO organization for NurseLink and Nickeisha Christopher is the designated individual DPO contact. The appointment remains subject to the applicable conflict-of-interest and independence requirements. The DPO function is distinct from the Super Admin technical role, which is assigned separately.
3. Data-protection standards
NurseLink's programme is being designed around fair and lawful processing, defined purposes, data minimization, accuracy, security, appropriate retention, respect for data-subject rights and controlled international transfers.
4. Access and correction
Individuals may request information about personal data held about them and may request correction of inaccurate information, subject to applicable legal rules and exceptions. Identity verification may be required before a request is fulfilled.
5. Preventing certain processing and marketing
Requests concerning direct marketing or other processing restrictions will be handled separately from essential account or care operations. Marketing consent will not be bundled into necessary care functionality.
6. Automated decisions
NurseLink will not treat Bronze, Silver or Gold verification, ratings, reliability indicators or automated matching as a substitute for human review where a decision could materially affect a nurse or client. The production design will provide review pathways for consequential automated decisions.
7. Security incidents and breaches
NurseLink will maintain procedures to investigate security incidents and determine whether notification to the Office of the Information Commissioner and affected individuals is required. The incident process will be designed around the applicable 72-hour reporting requirement after becoming aware of a reportable breach or contravention.
8. Data Protection Impact Assessments
Before real patient records are enabled, NurseLink will complete a production DPIA covering the intended health-data processing. The operating entity will also maintain the annual DPIA process required for data controllers.
9. International transfers
Providers or systems located outside Jamaica will be documented and assessed before sensitive-data processing. Transfer arrangements must provide the protections required by Jamaican data-protection law.
10. Exercising rights
For the MVP, submit a privacy request through the NurseLink privacy request form. The DPO organization is Fraternal Ventures Limited, Mandeville, Jamaica P.O., and Nickeisha Christopher is the designated individual DPO contact. The DPO can be contacted at nickeisha.muir@fvservices.com or 876-568-4010.
11. Official resources
Users can learn more from Jamaica's Office of the Information Commissioner at oic.gov.jm and the official Data Protection Act, 2020 published by the Ministry of Justice.