NHF’s QMS is ISO 9001:2015 Certified

Government of Jamaica

Data Rights & Protection

Privacy Notice

Effective Date: November 30, 2023

This privacy notice (“Privacy Notice”) explains what personal data (information) we will hold about you, how we collect it, how we will use and may share your information. It applies to all individuals who benefit from our services, interact with us or visit our website. We are required to notify you of this information under the Jamaican Data Protection Act. We encourage you to carefully read this notice and any other similar notice(s) we may provide to you whenever we collect or process personal information about you.

Who we Are?

The National Health Fund (hereinafter referred to as “NHF”, “we” and “us”) is the data controller and is responsible for your personal data. The NHF was established under the National Health Fund Act (“NHF Act”) and operates as a statutory entity.  As a data controller, the NHF is committed to safeguarding your data and respects the privacy of its users (hereinafter referred to as “you” or “your”).

If you have any questions about our privacy practices, please refer to the contact information at the end of this Privacy Notice. . 

What personal data do we collect?

Personal data means any information about an individual from which that person can be identified. It does not include data where personal identifiers have been removed (anonymized data).

We collect, use, store and transfer different types of personal data about you which we have grouped as follows:

    1. Identity Data which includes your full name, date of birth, gender, occupation, and tax registration number.
    2. Contact Data which includes your address, email address and telephone number(s).
    3. Health Records which includes your medical condition or diagnosis, your prescription, details about your medical provider, facilities registration number, and your NHF card number.
    4. Benefits Data which includes details about your NHF and JADEP drug limits.
    5. Marketing and Communications Preferences which includes your preferences in receiving marketing communication from us.
    6. Technical Data which includes internet protocol (IP) address, browser type and version, location, operating system and platform, and other technology on the devices you use to access our website.
    How is your personal data collected?We collect your data through several methods including:
    1. Direct Interactions. You may give us your Identity, Contact and Health Data when you fill out forms or by corresponding with us by phone, email or otherwise. This includes personal data you provide when you:
      1. Complete any of our forms such as thebeneficiary application form;
      2. Create and maintainan account in our Quick Prescriptapplication or any other applications utilised in the provision of our services;
      3. Submit a query through our “Ask Your Pharmacist” programme;
      4. Participate in our mobile screenings; or
      5. Participate in research studies.
    2. Third Parties or other Sources. We will receive personal data about you from various third parties including but not limited to private pharmacies which participate in our Provider Programmes or other partners when we jointly provide services.
    3. Automated Technologies or Interactions. When you interact with our website, we will automatically collect Technical Data about your equipment, browsing actions and patterns. We will collect this personal data by using cookies. Please see our cookie policy for further details. 
    Lawful Basis for ProcessingThe services provided by the NHF are largely governed by the NHF Act. The execution of our functions under this legislation is the primary legal basis for the processing of your personal data. In addition to our statutory functions, we may also process your personal data under other lawful bases. We have set out below, a description of all the ways we plan to use your personal data, and the legal bases we rely on to do so:
Purpose/ActivityType of dataLawful basis for processing including basis of legitimate interest
To register you as a new customer/beneficiary(a) Identity 
(b) Contact
(c) Health Records
(d) Signatures
(a) Exercise of our legal obligation under the NHF Act.
(b) Performance of a contract with you
(c) Necessary for Medical Purposes
(d) To protect your vital interests
(e)Our legal obligations in connection with the provision of social security benefits under law.
To fulfil your prescription orders, send necessary correspondence and improve your experience(a) Identity 
(b) Contact 
(c) Health Records
(d) Benefits
(a) Exercise of our legal obligations under the NHF Act.
(b) Performance of a contract with you
(c) Necessary for Medical Purposes
(d) To protect your vital interests
(e)Our legal obligations in connection with the provision of social security benefits under the law.
To manage our relationship with you which will include:(a) Notifying you about changes to our terms or privacy notice(b) Asking you to leave a review or take a survey(a) Identity 
(b) Contact 
(c) Marketing and CommunicationPreferences
(a) Performance of a contract with you 
(b) Necessary to comply with our legal obligations under the NHF Act.
(c) Necessary for our legitimate interests (to keep our records updated and to study how customers or beneficiaries use our products/services)
To monitor benefits and conduct audits (including for fraud prevention)(a) Identity 
(b) Contact 
(c) Health Records
(d) Benefits
(e) Signatures
(a) Necessary for our legitimate interests
(b) Necessary for the exercise of any functions conferred on the NHF under the NHF Act.
(c) Necessary for the purposes of disclosure to an anti-fraud organisation or otherwise in accordance with arrangements made by such an organisation. 
(d) Necessary for the purposes of preventing fraud
To facilitate marketing and health promotion (a) Identity 
(b) Contact
(c) Marketing and CommunicationPreferences
(a) Consent
(b) Exercise of our legal obligations under the NHF Act.
(c) Necessary for the exercise of other functions of a public nature exercised in the public’s interest by the NHF
To conduct research (internally and externally)(a) Identity
(b) Contact
(c) Health Records
(a) Necessary for Medical Purposes (Medical Research)
(b)  Necessary for the exercise of any other functions of a public nature exercised in the public interest.
(c)   Explicit written Consent

How Your Personal Data May Be Used for Research

The NHF may use your personal data to conduct research internally or external entities or individuals (such as medical or pharmacy students fulfilling requirements of programs at tertiary institutions) may submit requests to the NHF to have access to you and/or your data to conduct research. The NHF has set standards and protocols in place to ensure that your privacy is protected, and researchers comply with the law when they are engaged in research. 

The Individual Benefits and Research Department of the NHF reviews research requests to ensure that the processing of your personal data for the purposes of research meets ethical standards and are covered by lawful bases for processing sensitive data and the conducting of statistical research under the Data Protection Act. Researchers must demonstrate that their research is in alignment with the objectives of the NHF and is for the benefit of health services in Jamaica. Please see our external research evaluation guidelines for more information on how the NHF evaluates research requests, please review our research protocol

Where your personal data will be used in the research process, your explicit written consent will be always requested by the external researcher which will, in most instances, act as an independent data controller of your data.  The NHF may keep a copy of the information collected about you by external researchers. In most cases, your personal data will be anonymised prior to being shared as an aggregate dataset.

Retention Period:

Whenever we collect or process your data, we will only keep it for as long as is necessary for the purpose it was collected. The NHF complies with the Pharmacy Act and its regulations which prescribe a two (2) year minimum retention period for written and electronic prescriptions. All other personal data (your medical history and benefits transactions with the NHF)  are retained for a minimum period of seven (7) years following the end of your contract or provision of services to you. As a public authority, we may retain some of your personal data for a longer period where we have a legal obligation under the NHF Act or other legislation or a legitimate interest in such retention. 

How We Share Your Information:

We do not share your personal information with  non-affiliated third parties, except as described in this Notice. We will only share your personal data with companies, organizations, government bodies and individuals outside of NHF as described below. 

  1. Our Network of NHF/JADEP Benefit Providers and other Medical Professionals

These include public and private pharmacies, medical professionals who assist with diagnostic testing as well as laboratories which assist us in providing NHF/JADEP benefits. You may view our full listing of NHF Providers here which list may be amended from time to time.

  1. Our Service Providers

We work with third parties and suppliers (data processors) to enable us to provide our services to you. Some providers may require international transfers solely for the purposes of storage or back-up and where otherwise will use communication dispatch services to aid in our marketing and communication about our services. We undertake an evaluation as to the necessity of these international transfers and an assessment of the jurisdictions to which your personal data may be sent.

Security of your personal data 

We have put in place the appropriate technical and organizational precautions to mitigate against the loss, misuse, or alteration of your personal information. All the personal information you provide is stored in our protected systems. All electronic transactions you make to or receive from us will be encrypted. While we prioritize data protection, it is essential to note that, data transmission over the internet is inherently insecure, and we cannot guarantee the security of data sent over the internet. 

Changes to the Notice

This Notice may undergo periodic revisions. If we make significant changes in the way we treat your personal information, especially in relation to sensitive data, we will seek your additional consent. We strongly encourage you to periodically review this privacy statement for the latest information on our privacy practices. 

How to contact us

If you have any questions about this Privacy Notice, please contact us by email or postal mail as follows: 

Latoya Peddie 
Data Protection Officer
National Heath Fund 
The Towers, 6th Floor 
25 Dominica Drive, 
Kingston 5 
Tel #: 1876-832-7761
Email address: [email protected]

How to access your Personal Data  

How to make a request for personal data that we hold about you and how to make a request about your other data protection rights.

Requests may be made in writing, by email or by speaking to us. 

How to contact us above. 
All requests will be recorded, and you may need to provide information to verify your identity and enable us to locate the information. 

Please provide: • Full name, address, date of birth, NHF Card number (if applicable), TRN  (requests for health records only) • An indication of what information you are requesting to enable us to locate this in an efficient manner. 

Issue date: Nov 30, 2023                           Approved by: CEO                                                Ver #: 1

National Health Fund © 2024. All Rights Reserved.