Introduction

Convergence Med (hereafter referred to as "we", "us", or "our") is committed to protecting the privacy and security of the personal information provided by our clients. This Privacy Notice explains how we process personal information when acting as a data processor on behalf of our clients in compliance with the Personal Information Protection Act 2016 (PIPA) of Bermuda. 

Definitions

• Personal information: any information about an identified or identifiable individual 
• Process, use or using: the carrying out of any operation on personal information, including collecting, obtaining, recording, holding, storing, organizing, adapting, altering, retrieving, transferring, consulting, disclosing, disseminating or otherwise making available, combining, blocking, erasing or destroying it 
• Individual: a natural person 
  

Purpose of Processing

We process personal information solely for the purposes defined by our clients, the medical practitioners, which includes: 

• Health insurance claim eligibility 
• Health insurance claim submission 
• Health insurance payment verification 
• Health insurance payment reconciliation 

Legal Basis for Processing

Our processing activities are based on the instructions provided by our clients, who determine the legal basis for processing personal information.  We do not process personal data provided by our clients for our own purposes, which includes, but is not limited to, data analytics or marketing. 

Categories of Personal Information

We may process the following categories of personal information on behalf of medical patients as requested by our clients: 

• Identification Details (e.g. Full Name, Policy Number) 
• Demographic Details (e.g. Date of Birth) 
• Contact Details (e.g. Telephone Number, Address) 
• Employment Details (e.g. Employer Name) 
• Financial Details (e.g. Service Charges, Fee Paid) 
• Medical Details (e.g. Diagnosis) 

Data Sharing

We do not share personal information with third parties except as instructed by our clients or as required by law. 

Data Security

We implement appropriate technical and organizational measures to ensure the confidentiality, integrity and availability of personal information, including encryption, access controls, staff training, and regular security assessments. Our security measures are regularly reviewed and updated to ensure ongoing protection. 

Data Retention and Disposal

We retain personal information only for as long as instructed by our clients or as required by law.  Once the purpose for which personal information is processed has expired or our contracts are terminated with our clients, we dispose of the personal information or return it to our clients, respectively. 

Rights of Individuals

As a data processor, we assist our clients in responding to requests of individuals, including: 

• Access to personal information 
• Access to medical records 
• Rectification of personal information 
• Blocking of personal information 
• Erasure of personal information 
• Destruction of personal information 

We do so in a timely manner to allow our clients to respond within the forty-five (45) days required by law. 

Changes to This Privacy Notice

We may update this Privacy Notice from time to time. Any changes will be communicated to our clients, who will inform individuals as necessary. 

The date of the last update is January 21, 2025.