Privacy notice

Rehoboth Physio & Paincare is a physiotherapy, chiropractic and wellness practice with clinics in Grand Cayman. Under the Cayman Islands Data Protection Act (2021 Revision) the clinic is the data controller for your patient record: it decides what is collected and what happens to it, and it is the clinic you hold responsible.

Most of what we hold about you is health information, which the Act calls sensitive personal data. It is treated as such throughout: it is not used for marketing, it is not sold, and it is not shared with anyone outside the clinic except in the narrow circumstances set out below.

Almost all of it comes from you: on the phone when you book, on the booking form on this site, on the intake form you fill in before your first visit, and in what you tell your practitioner in the room.

The rest is written by the clinic in the course of treating you - the assessment, the notes, the treatment plan, the invoice and the claim. Where your insurer tells us what your policy covers, or what it has settled, that answer is recorded too.

We never sell your information, and we do not use it for advertising. It leaves the clinic in three situations only.

• The insurer you named. When we submit a claim, the insurer you named on your intake form receives what it needs to assess and pay it: who you are, your policy or member ID, the dates of your visits, and the treatment and diagnosis codes for them. This is the disclosure you authorise in the Assignment and Release section of the intake form, and it goes to that insurer and its agents for the purpose of payment - no other insurer, and no other purpose. That consent ends when your treatment plan is complete or one year after you sign it, whichever comes first.
• The practitioners and staff treating you. Your record is open to the practitioner treating you and to the clinic staff who book you in, take payment and submit your claim. It is not open to anyone else at the clinic who has no reason to be in it.
• The service that sends our email. Confirmations, reminders, receipts, portal sign-up links and password resets are delivered through an outside email provider, [TO CONFIRM: name of the email provider the clinic sends patient email through], which necessarily handles your name, your email address and the contents of that message. A record a practitioner shares with you is never attached to the email: it says only that something is waiting for you and asks you to sign in to read it.

If we are ever required by law, by a court, or by a regulator to disclose part of a record, we will comply, and we will tell you unless we are prohibited from doing so.

The Act does not allow us to keep your information for longer than we need it. A clinical record, though, is needed long after your last visit: an injury that returns is assessed against what was found the first time.

The clinic keeps your clinical record for [TO CONFIRM: clinical record retention period the clinic applies — typically several years after the last visit under Cayman practice; confirm with the clinic's regulator or lawyer], after which it is destroyed. Invoices, claims and payment records are kept for as long as the clinic is required to keep financial records. If you create a portal account and ask us to close it, the account and its password are removed without touching the clinical record behind them.

• Everything you send us through this site, and everything it sends back, travels over an encrypted connection.
• Your portal password is never stored in a form anybody can read, here or anywhere else. It is put through a one-way scrambling function with a random salt before it is saved, so a stolen copy of our records does not hand over your password. Nobody at the clinic can look it up and tell you what it is.
• Patient records are reachable only by clinic staff who are signed in, and what a member of staff can open depends on their role: a practitioner or receptionist sees the patients of the clinic they work in, and access to the practice's whole record set is limited to its administrators.
• The patient portal shows you your own record and nothing else: which record it loads is decided by the signed-in account, never by anything in the address bar.
• A clinical note reaches the portal only when a practitioner deliberately shares it, so nothing becomes visible because a setting was left wrong.

No system is perfect. If personal data we hold is lost, stolen, or disclosed to somebody who should not have it, the Act requires us to report it to the Office of the Ombudsman and to tell the people affected, without undue delay, and we will.

To use any of these, contact us as set out below. Please say what you are asking for - a copy, a correction, erasure - so we can deal with it properly.

Questions about this notice, and requests about your own record, go to [TO CONFIRM: name/title of the clinic's data protection contact] at Rehoboth Physio & Paincare:

• Phone +1-345-329-8585 or 525-8686
• Email rehobothphysiopaincare@gmail.com
• Or ask at reception at any of our clinics in Grand Cayman

Please do not send clinical details or anything urgent by email. The clinic's inbox is not monitored continuously - call us instead.

The terms that apply to the patient portal and to booking online are set out in our terms of use.