Effective Date: June 1, 2025

This Privacy Policy (“Policy”) is issued by InTouch Therapy Bermuda (“InTouch Therapy,” “we,” “our,” or “us”), pursuant to our obligations under the Personal Information Protection Act 2016 (PIPA) of Bermuda. This document serves to inform clients, patients, and website visitors of our legal duties and procedures regarding the collection, use, storage, sharing, and protection of personal information. By engaging our services or accessing our website, you acknowledge and accept the practices described in this Policy.

1. Legal Basis and Scope

InTouch Therapy Bermuda operates in accordance with the Personal Information Protection Act 2016 (PIPA), which establishes rights for individuals regarding their personal information and sets out corresponding obligations on organizations that use such information. This Policy applies to all personal information collected, processed, stored, and disclosed by InTouch Therapy through clinical services, administrative processes, and our website (www.intouch.bm).

2. Categories of Personal Information Collected

In the course of providing physiotherapy services, InTouch Therapy may collect the following categories of personal information, as defined in Section 6 of PIPA:
• Biographical data, including full name and date of birth
• Contact details (e.g., residential address, telephone number, email address)
• Health and medical history, including past treatments and diagnoses
• Insurance information and payment details (processed securely by third-party payment processors)
• Referrals and medical reports from licensed practitioners
• Emergency contact information
• Limited website data, such as IP address and browser metadata

3. Purpose for Collection and Use of Personal Information

In accordance with Section 8 of PIPA, we collect and process personal information solely for legitimate and specific purposes, including but not limited to:
• Conducting medical assessments and physiotherapy treatment plans
• Coordinating care with physicians or specialists (with informed consent)
• Confirming appointments and facilitating administrative communication
• Processing billing and insurance claims
• Ensuring the safety and welfare of patients during treatment
• Maintaining clinical records in accordance with legal and regulatory requirements
• Complying with professional, legal, and contractual obligations

4. Consent and Lawful Processing

We obtain consent from individuals before or at the time of collecting personal information, unless otherwise permitted or required by law (Sections 7 and 10 of PIPA). Consent may be explicit or implied based on the context of the interaction. Individuals may withdraw consent at any time, subject to legal or contractual restrictions.

5. Data Minimization and Accuracy

In compliance with Sections 7 and 11 of PIPA, we only collect the minimum amount of personal information necessary to fulfill the intended purposes. We take reasonable steps to ensure that personal information is accurate, complete, and kept up-to-date.

6. Security Safeguards and Confidentiality

As mandated by Section 12 of PIPA, we implement appropriate technical, administrative, and physical safeguards to protect personal information from unauthorized access, disclosure, alteration, or destruction. These measures include:
• Secure electronic medical record systems with restricted access
• Secure email encryption where applicable
• Confidentiality agreements with employees and service providers
• Physical safeguards for any paper records

7. Disclosure and Third-Party Sharing

Personal information may be disclosed to third parties only in accordance with Section 9 of PIPA. Such disclosures may include:
• Licensed medical professionals for continuity of care (with consent)
• Insurance providers for claims processing
• Legal or regulatory authorities when required by law
• IT and administrative service providers (under binding confidentiality agreements)
We do not sell, lease, or disclose personal information to unaffiliated third parties for marketing purposes.

8. Data Retention and Destruction

We retain personal information only for as long as is reasonably necessary to fulfill the purposes for which it was collected or to comply with applicable laws and professional standards. Secure disposal methods are employed for all physical and digital records once they are no longer required.

9. Children and Vulnerable Persons

InTouch Therapy recognizes the special need to protect the privacy of minors and vulnerable individuals. We require the consent of a parent, legal guardian, or legally authorized representative prior to collecting or processing the personal information of individuals under the age of 18.

10. Your Rights Under PIPA

Under Sections 19 to 22 of PIPA, individuals have the legal right to:
• Request access to personal information in our possession
• Request rectification of inaccuracies
• Request deletion or anonymization of information no longer necessary
• Object to certain uses or disclosures of their personal data
• File a complaint with the Privacy Commissioner if unsatisfied with our handling of their data
Requests may be made in writing and will be responded to in a timely and lawful manner.

11. Contact Information

For questions about this Privacy Policy, or to exercise your rights under PIPA, please contact our Privacy Officer:

InTouch Therapy Bermuda
45 King Street, Hamilton, HM19, Bermuda
Email: office@intouch.bm
Phone: (441) 238-6824

12. Updates to this Privacy Policy

We may amend this Privacy Policy from time to time to reflect changes in legal requirements or operational practices. All updates will be posted at www.intouch.bm with the date of the last revision indicated at the top of the page.