Privacy Policy of synergychirophysio.com

This Application collects some Personal Data from its Users.

This document can be printed for reference by using the print command in the settings of any browser.

Owner and Data Controller

Synergy Chiropractic, Physiotherapy, Acupuncture & Massage

The Marquee Plaza (between West Bay Rd & Camana Bay)
Seven Mile Beach, Grand Cayman
36 Lawrence Blvd. KY1-1204
PO Box 30916

Owner contact email: info@synergychirophysio.com

Types of Data collected

Among the types of Personal Data that this Application collects, by itself or through third parties, there are: first name; last name; email address; Usage Data; Trackers.

Complete details on each type of Personal Data collected are provided in the dedicated sections of this privacy policy or by specific explanation texts displayed prior to the Data collection.
Personal Data may be freely provided by the User, or, in case of Usage Data, collected automatically when using this Application.
Unless specified otherwise, all Data requested by this Application is mandatory and failure to provide this Data may make it impossible for this Application to provide its services. In cases where this Application specifically states that some Data is not mandatory, Users are free not to communicate this Data without consequences to the availability or the functioning of the Service.
Users who are uncertain about which Personal Data is mandatory are welcome to contact the Owner.
Any use of Cookies – or of other tracking tools — by this Application or by the owners of third-party services used by this Application serves the purpose of providing the Service required by the User, in addition to any other purposes described in the present document and in the Cookie Policy.

Users are responsible for any third-party Personal Data obtained, published or shared through this Application.

Mode and place of processing the Data

Methods of processing

The Owner takes appropriate security measures to prevent unauthorized access, disclosure, modification, or unauthorized destruction of the Data.
The Data processing is carried out using computers and/or IT enabled tools, following organizational procedures and modes strictly related to the purposes indicated. In addition to the Owner, in some cases, the Data may be accessible to certain types of persons in charge, involved with the operation of this Application (administration, sales, marketing, legal, system administration) or external parties (such as third-party technical service providers, mail carriers, hosting providers, IT companies, communications agencies) appointed, if necessary, as Data Processors by the Owner. The updated list of these parties may be requested from the Owner at any time.

Place

The Data is processed at the Owner’s operating offices and in any other places where the parties involved in the processing are located.

Depending on the User’s location, data transfers may involve transferring the User’s Data to a country other than their own. To find out more about the place of processing of such transferred Data, Users can check the section containing details about the processing of Personal Data.

Retention time

Unless specified otherwise in this document, Personal Data shall be processed and stored for as long as required by the purpose they have been collected for and may be retained for longer due to applicable legal obligation or based on the Users’ consent.

The purposes of processing

The Data concerning the User is collected to allow the Owner to provide its Service, comply with its legal obligations, respond to enforcement requests, protect its rights and interests (or those of its Users or third parties), detect any malicious or fraudulent activity, as well as the following: Contacting the User and Displaying content from external platforms.

For specific information about the Personal Data used for each purpose, the User may refer to the section “Detailed information on the processing of Personal Data”.

Detailed information on the processing of Personal Data

Personal Data is collected for the following purposes and using the following services:

Contacting the User

Contact form (this Application)

By filling in the contact form with their Data, the User authorizes this Application to use these details to reply to requests for information, quotes or any other kind of request as indicated by the form’s header.

Personal Data processed: email address; first name; last name.

Displaying content from external platforms

This type of service allows you to view content hosted on external platforms directly from the pages of this Application and interact with them.
This type of service might still collect web traffic data for the pages where the service is installed, even when Users do not use it.

Google Fonts (Google LLC)

Google Fonts is a typeface visualization service provided by Google LLC that allows this Application to incorporate content of this kind on its pages.

Personal Data processed: Trackers; Usage Data.Place of processing: United States – Privacy Policy.

Cookie Policy

This Application uses Trackers. To learn more, Users may consult the Cookie Policy.

Further Information for Users

Legal basis of processing

The Owner may process Personal Data relating to Users if one of the following applies:

  • Users have given their consent for one or more specific purposes.
  • provision of Data is necessary for the performance of an agreement with the User and/or for any pre-contractual obligations thereof;
  • processing is necessary for compliance with a legal obligation to which the Owner is subject;
  • processing is related to a task that is carried out in the public interest or in the exercise of official authority vested in the Owner;
  • processing is necessary for the purposes of the legitimate interests pursued by the Owner or by a third party.

In any case, the Owner will gladly help to clarify the specific legal basis that applies to the processing, and in particular whether the provision of Personal Data is a statutory or contractual requirement, or a requirement necessary to enter into a contract.

Further information about retention time

Unless specified otherwise in this document, Personal Data shall be processed and stored for as long as required by the purpose they have been collected for and may be retained for longer due to applicable legal obligation or based on the Users’ consent.

Therefore:

  • Personal Data collected for purposes related to the performance of a contract between the Owner and the User shall be retained until such contract has been fully performed.
  • Personal Data collected for the purposes of the Owner’s legitimate interests shall be retained as long as needed to fulfill such purposes. Users may find specific information regarding the legitimate interests pursued by the Owner within the relevant sections of this document or by contacting the Owner. The Owner does not control or process Personal Data on a large scale. 

The Owner may be allowed to retain Personal Data for a longer period whenever the User has given consent to such processing, as long as such consent is not withdrawn. Furthermore, the Owner may be obliged to retain Personal Data for a longer period whenever required to fulfil a legal obligation or upon order of an authority.

Once the retention period expires, Personal Data shall be deleted. Therefore, the right of access, the right to erasure, the right to rectification and the right to data portability cannot be enforced after expiration of the retention period.

The rights of Users based on the General Data Protection Regulation (GDPR)

Users may exercise certain rights regarding their Data processed by the Owner.

In particular, Users have the right to do the following, to the extent permitted by law:

  • Withdraw their consent at any time. Users have the right to withdraw consent where they have previously given their consent to the processing of their Personal Data.
  • Object to processing of their Data. Users have the right to object to the processing of their Data if the processing is carried out on a legal basis other than consent.
  • Access their Data. Users have the right to learn if Data is being processed by the Owner, obtain disclosure regarding certain aspects of the processing and obtain a copy of the Data undergoing processing.
  • Verify and seek rectification. Users have the right to verify the accuracy of their Data and ask for it to be updated or corrected.
  • Restrict the processing of their Data. Users have the right to restrict the processing of their Data. In this case, the Owner will not process their Data for any purpose other than storing it.
  • Have their Personal Data deleted or otherwise removed. Users have the right to obtain the erasure of their Data from the Owner.
  • Receive their Data and have it transferred to another controller. Users have the right to receive their Data in a structured, commonly used and machine readable format and, if technically feasible, to have it transmitted to another controller without any hindrance.
  • Lodge a complaint. Users have the right to bring a claim before their competent data protection authority.

Users are also entitled to learn about the legal basis for Data transfers abroad including to any international organization governed by public international law or set up by two or more countries, such as the UN, and about the security measures taken by the Owner to safeguard their Data.

Details about the right to object to processing

Where Personal Data is processed for a public interest, in the exercise of an official authority vested in the Owner or for the purposes of the legitimate interests pursued by the Owner, Users may object to such processing by providing a ground related to their particular situation to justify the objection.

Users must know that, however, should their Personal Data be processed for direct marketing purposes, they can object to that processing at any time, free of charge and without providing any justification. Where the User objects to processing for direct marketing purposes, the Personal Data will no longer be processed for such purposes. To learn whether the Owner is processing Personal Data for direct marketing purposes, Users may refer to the relevant sections of this document.

How to exercise these rights

Any requests to exercise User rights can be directed to the Owner through the contact details provided in this document. Such requests are free of charge and will be answered by the Owner as early as possible and always within one month, providing Users with the information required by law. Any rectification or erasure of Personal Data or restriction of processing will be communicated by the Owner to each recipient, if any, to whom the Personal Data has been disclosed unless this proves impossible or involves disproportionate effort. At the Users’ request, the Owner will inform them about those recipients.

Additional information about Data collection and processing

Legal action

The User’s Personal Data may be used for legal purposes by the Owner in Court or in the stages leading to possible legal action arising from improper use of this Application or the related Services.
The User declares to be aware that the Owner may be required to reveal personal data upon request of public authorities.

Additional information about User’s Personal Data

In addition to the information contained in this privacy policy, this Application may provide the User with additional and contextual information concerning particular Services or the collection and processing of Personal Data upon request.

System logs and maintenance

For operation and maintenance purposes, this Application and any third-party services may collect files that record interaction with this Application (System logs) or use other Personal Data (such as the IP Address) for this purpose.

Information not contained in this policy

More details concerning the collection or processing of Personal Data may be requested from the Owner at any time. Please see the contact information at the beginning of this document.

Changes to this privacy policy

The Owner reserves the right to make changes to this privacy policy at any time by notifying its Users on this page and possibly within this Application and/or – as far as technically and legally feasible – sending a notice to Users via any contact information available to the Owner. It is strongly recommended to check this page often, referring to the date of the last modification listed at the bottom.

Should the changes affect processing activities performed on the basis of the User’s consent, the Owner shall collect new consent from the User, where required.

Definitions and legal references

Personal Data (or Data)

Any information that directly, indirectly, or in connection with other information — including a personal identification number — allows for the identification or identifiability of a natural person.

Usage Data

Information collected automatically through this Application (or third-party services employed in this Application), which can include: the IP addresses or domain names of the computers utilized by the Users who use this Application, the URI addresses (Uniform Resource Identifier), the time of the request, the method utilized to submit the request to the server, the size of the file received in response, the numerical code indicating the status of the server’s answer (successful outcome, error, etc.), the country of origin, the features of the browser and the operating system utilized by the User, the various time details per visit (e.g., the time spent on each page within the Application) and the details about the path followed within the Application with special reference to the sequence of pages visited, and other parameters about the device operating system and/or the User’s IT environment.

User

The individual using this Application who, unless otherwise specified, coincides with the Data Subject.

Data Subject

The natural person to whom the Personal Data refers.

Data Processor (or Processor)

The natural or legal person, public authority, agency or other body which processes Personal Data on behalf of the Controller, as described in this privacy policy.

Data Controller (or Owner)

The natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of Personal Data, including the security measures concerning the operation and use of this Application. The Data Controller, unless otherwise specified, is the Owner of this Application.

This Application

The means by which the Personal Data of the User is collected and processed.

Service

The service provided by this Application as described in the relative terms (if available) and on this site/application.

European Union (or EU)

Unless otherwise specified, all references made within this document to the European Union include all current member states to the European Union and the European Economic Area.

Cookie

Cookies are Trackers consisting of small sets of data stored in the User’s browser.

Tracker

Tracker indicates any technology – e.g Cookies, unique identifiers, web beacons, embedded scripts, e-tags and fingerprinting – that enables the tracking of Users, for example by accessing or storing information on the User’s device.

Privacy protection is important to Synergy Chiropractic & Physiotherapy Ltd. In the usual course of business and business relationship with the customer/patient/client and all such interactions with the customer/patient/client or by virtue of the customer/patient/client providing Synergy with personal information that provides Synergy with personal information which constitutes Personal Data. This includes, but is not restricted to, data such as name, residential address, email address, telephone number, place of birth, date of birth, drivers license, ID, passport number, etc Further, in the usual course of business Synergy Chiropractic & Physiotherapy Ltd. (“Synergy”) and its agents, delegates and affiliates may from time to time use Personal Data for other activities that meet the legitimate interest grounds for processing under the The Cayman Islands Data Protection Law, 2017 (the “DPL”).

The DPL contains specific requirements concerning protection of Sensitive Personal Data. We may collect the below types of information;

  • Name
  • Address
  • E-mail
  • Telephone number
  • Employment Information
  • Next of Kin information
  • Health Insurance Information (name of insurance company, policy owner, identification number)
  • Appointments (details of appointments including notes of treatment and care and proposed plan including referrals)
  • Health Information (personal and family medical history)
  • Financial Information (debit and credit card information)
  • Outgoing information including correspondence with other medical practitioners and health Insurance providers
  • Incoming information including information received from other healthcare professionals and/or health insurance providers
  • Lab, diagnostic and/or test results

The personal data we collect will be adequate, relevant and not excessive in relation to the purpose(s) for which it is collected or processed. We require your personal and sensitive and confidential data in order to provide you with healthcare.

The processing is necessary to comply with the laws of the Cayman Islands.The processing is necessary to protect the Data Subject’s life.The processing is necessary to perform a public function, or a function of a public nature exercised in the public interest.The processing is necessary for legitimate interests pursued by us as data controller or a third party. The processing of sensitive personal data is necessary for legal proceedings, legal advice or legal rights.The processing of sensitive personal data by a health professional or someone who owes an equivalent duty of confidentiality is necessary for medical purposes, preventative medicine, medical diagnosis, the provision of care and treatment and the management of healthcare services.

Your information will not be further processed in any manner incompatible with the stated purposes.

We collect information in various ways, such as over the phone, in writing, in person at Synergy or over the internet if you transact with us online. This information may be collected by medical and non-medical staff. Wherever practicable we will only collect information from you personally. However, we may also need to collect information from other sources such as treating specialists, radiologists, diagnostic, pathologists, hospitals, other health care providers. In emergency situations we may also need to collect information from your relatives or friends.

We collect and hold data about you for the purpose of providing safe and effective healthcare. We will treat your personal information as strictly private and confidential. We will only use or disclose it for purposes directly related to your care and treatment, or in ways that you would reasonably expect that we may use it for your ongoing care and treatment. We may need to share information with other healthcare providers outside of Synergy when we order laboratory, diagnostic or preventative tests, communicate with health insurance providers and when we make a referral. This is done to ensure you receive the care you need. Information may be provided to:

  • Laboratories and imaging centers
  • Other medical facilities including doctors, nurses and support staff who may receive the information
  • Pharmacists
  • Other persons involved with your care such as relatives, friends and caregivers if consent has been given for information to be released to them. Or if you are the parent, caregiver, guarantor or guardian and you act on behalf of the customer/patient/client
  • Insurance providers including when we submit a claim on your behalf for services rendered or request pre certification of services.

With an official email communication and once we receive and acknowledge your request; You can withdraw consent to provide information to any one of the entities above, but this may result in a delay of care or in you having to pay for the services you receive at the Clinic or from its providers. We may also be required to share your information to third parties. This includes the Police, the Courts, insurers, attorneys, Government regulatory bodies. Whenever possible we will pass this information on in an anonymised format. We may disclose information about you to outside contractors to carry out activities on our behalf such as an IT service provider, solicitor or debt collection agent. We impose security and confidentiality requirements on how they handle your personal information. Outside contractors are required not to use information about you for any purpose except for those activities they perform.

Synergy takes all reasonable steps to secure the Personal Data from unauthorised or unlawful processing by third parties, alteration, disclosure, accidental loss, destruction, damage or any form of computer corruption. Synergy has implemented the following information security measures:

  • Access to IT servers is restricted in a secure location to a limited number of staff;
  • Access to systems is password protected;
  • A back up procedure is in operation;
  • Manual files containing Personal Data, financial information or confidential information are kept in a secure locked location with restricted access to staff; an
  • A strong emphasis is placed on the security of Personal Data when it is held on portable devices.

Personal Data may be processed by Synergy itself or it may be processed by others on its behalf. Where Synergy uses a Data Processor to undertake processing of Personal Data on its behalf it will ensure verbally or in writing that the information is confidential.

It may be necessary for Synergy to transfer Personal Data for processing, back-up or storage to an agent, delegate, subcontractor or other representative of Synergy appointed by Synergy to carry out sub-processing activities on behalf of Synergy (each a “Permitted Processor”) under an appropriate written agreement between the Permitted Processor and Synergy.

Synergy and/or its Permitted Processors may be legally obliged to share Personal Data and other financial information with respect to a Data Subject with their local authorities including regulatory, law enforcement or other governmental authorities (including tax authorities) or courts (collectively “Government Bodies”) and the local Government Bodies, in turn, may exchange this information with foreign Government Bodies including Government Bodies located inside or outside the Cayman Islands through automatic reporting, information exchange or otherwise.

Certain Permitted Processors are located within the Cayman Islands and in that case Personal Data will be stored on servers in the Cayman Islands. Where Synergy entities and Permitted Processors are located outside the Cayman Islands Personal Data will be stored on servers outside the Cayman Islands.

Personal Data may be transmitted, stored and processed on systems located outside of Synergy’s operating jurisdiction (the Cayman Islands), which systems are or may be operated by a Permitted Processor (and therefore authorities including regulatory or governmental authorities or courts in a jurisdiction (including jurisdictions where these parties are established or hold or process Personal Data) may obtain access to Personal Data which may be held or processed in such a jurisdiction or accessed through automatic reporting, information exchange or otherwise in accordance with the laws and regulations applicable in such jurisdiction).

We will make every effort and take all reasonable steps to ensure that the data we process is accurate and up to date. However, it is your responsibility to advise Synergy of any change in your information, particularly your name, mailing address, telephone number, email address, insurance provider and next of kin. You have the right to request that Synergy rectifies, blocks, erases or destroys inaccurate data without delay. You can make a request for rectification or any questions by an official email to our office. info@synergychirophysio.com The request does not have to be to a specific person or contact point but it should clearly state the subject as “Important, Patient Privacy update request”.

Synergy is not obliged to comply with the request unless supplied with that information, during a specific or reasonable period the time specified in subsections below shall automatically stand suspended.

Synergy shall not be obliged to supply any Personal Data unless Synergy has received a request in writing, and any fee that may be required, such fee being within the limits prescribed by regulations. There is a template subject access request form on the Ombudsman’s website. If Synergy reasonably requires further information in order to be satisfied as to the identity of the Data Subject making the request or to locate the information that the Data Subject seeks, and has informed the Data Subject in writing of the requirement, Synergy is not obliged to comply with the request unless supplied with that information, during which period the time specified in subsection below shall automatically stand suspended.

Synergy shall comply with a request within thirty days (or such other period as may be prescribed by regulations) of the date on which Synergy receives both the request and fee referred to above, but where Synergy has requested further information, the period shall not resume until the information has been supplied.

If Synergy cannot comply with the request without disclosing Personal Data relating to another Data Subject who can be identified from that Personal Data, Synergy is not obliged to comply with the request unless-

  • the other Data Subject has consented to the disclosure of the Personal Data to the person making the request;
  • it is reasonable in all the circumstances to comply with the request without the consent of the other Data Subject.

The reference (above) to Personal Data relating to another Data Subject includes a reference to Personal Data identifying that other Data Subject as the source of the Personal Data sought in the request. Synergy will still be expected to communicate so much of the Personal Data sought in the request as can be communicated without disclosing the identity of the other Data Subject concerned, whether by the omission of names or other identifying particulars or otherwise. In determining whether it is reasonable in all the circumstances to comply with the request without the consent of the other Data Subject concerned, Synergy shall have regard to, in particular any duty of confidentiality owed to the other Data Subject; any steps taken by Synergy to seek the consent of the other Data Subject; whether the other Data Subject is capable of giving consent; and any express refusal of consent by the other Data Subject.

If Personal Data is being processed by or on behalf of Synergy who receives a request under this section from the Data Subject, the obligation to supply the Personal Data under this section includes an obligation to give the Data Subject a statement of the Data Subject’s rights under the DPL in such form, and to such extent, as may be prescribed by regulations.

Synergy shall supply the Data Subject with a copy of the Personal Data in the format requested unless the supply of such a copy is not possible or would involve disproportionate effort; or the Data Subject agrees otherwise. If any of the Personal Data is expressed in terms that are not intelligible without explanation the copy shall be accompanied by an adequate explanation.

If Synergy has previously complied with a request for access by the Data Subject referred to therein, Synergy is not obliged to comply with a subsequent identical or similar request for access by the Data Subject unless the interval between compliance with the previous request and the making of the current request is reasonable. In determining whether the interval is reasonable, regard shall be had to the nature of the Personal Data, the purpose for which the Personal Data is processed and the frequency with which the Personal Data is altered.

Personal Data and other information supplied shall be supplied by reference to the data in question at the time when the request for the Personal Data is received, except that account may be taken of any amendment or deletion made between that time and the time when the information is supplied, the amendment or deletion being such that would have been made regardless of the receipt of the request.

Synergy does to process or control data on a large scale. Our purpose of data collection is for your private and personal health care at Synergy.

You can make a request for rectification or any questions by an official email to our office.

info@synergychirophysio.com

The request should clearly state the subject as “Important, Patient Privacy update request”.

Once Synergy has received your email you should receive receipt confirmation within 30 days otherwise please retry your communication in the event that your message has not been received.

Legal information

This privacy policy relates solely to this Application, if not stated otherwise within this document.