1.Introduction and Application
1.1 This Privacy Policy sets out how Bahamas Mobile Medical Solutions ("BMMS", "we", "us" or "our"), of Nassau, The Bahamas, collects, uses, discloses, retains and protects personal data in connection with its website, booking system, patient portal, messaging channels and health services (together, the "Services").
1.2 BMMS is the data controller of the personal data described in this Policy. BMMS processes personal data in accordance with the Data Protection (Privacy of Personal Information) Act, 2003 (Chapter 324A) and, upon its commencement, the Data Protection Act, 2025 (No. 74 of 2025), together with the duties of confidentiality applicable to health care professionals (collectively, "Data Protection Law").
1.3 This Policy should be read together with our Terms of Service and Cookie Notice. By using the Services, you acknowledge that you have read and understood this Policy.
1.4 In this Policy, "personal data" means information relating to an identified or identifiable living individual, and "health data" means personal data concerning a person's physical or mental health, including test results.
1.5 BMMS has appointed a Data Protection Officer, who may be contacted at support@bmmshealth.com.
2.Principles
2.1 BMMS undertakes that:
(a) it shall not sell, rent or trade personal data;
(b) it shall not use health data for advertising or marketing purposes, and shall not disclose health data to social media or advertising platforms;
(c) access to health data shall be restricted to physicians, nurses and authorised personnel who require such access to provide or support the Services; and
(d) payment descriptors, booking confirmations and reminder messages shall be worded so as not to disclose the nature of the Services received.
3.Personal Data Collected
3.1 BMMS may collect the following categories of personal data:
(a) Identity and contact data, including name, date of birth, sex, telephone number, email address, visit address and emergency contact details;
(b) Booking and transaction data, including services booked, appointment times, payment method, payment status, transaction references and proof of bank transfer;
(c) Health data, including medical history, symptoms, medications, allergies, vital signs, questionnaire responses, test results, documents uploaded to the patient portal, clinical notes, referrals and prescriptions;
(d) Communications data, including the content of messages exchanged by WhatsApp, website chat, email or telephone, including messages handled by automated messaging systems;
(e) Technical data, including IP address, browser and device type, pages visited, referring QR code or link, and cookie identifiers, as described in our Cookie Notice; and
(f) Feedback data, including reviews, testimonials and survey responses, where voluntarily provided.
3.2 Personal data is collected directly from you, from a person who books a Service on your behalf with your knowledge, from BMMS clinicians in the course of providing the Services, from laboratories, and from your device as described in the Cookie Notice.
3.3 BMMS does not receive or store full payment card numbers. Card payments are processed by a third-party payment processor.
4.Purposes and Grounds of Processing
4.1 BMMS processes personal data only for specified and lawful purposes, namely:
(a) to provide the Services, including scheduling, home visits, testing, physician review, release of results, follow-up, referral and prescription review, on the basis of the performance of our agreement with you and your consent;
(b) to process payments and maintain financial records, on the basis of the performance of our agreement and compliance with legal obligations;
(c) to respond to enquiries and send confirmations, reminders and payment instructions, including through automated messaging systems, at your request or on the basis of our legitimate interests;
(d) to protect the vital interests of a client where there is a risk to life or health;
(e) to comply with legal obligations, including the notification of certain communicable diseases to public health authorities;
(f) to review and improve the quality and safety of the Services, including by producing statistics from de-identified data; and
(g) with your consent, to measure the performance of our website and marketing using non-health technical data, and to send general health information or offers, from which you may opt out at any time.
4.2 Health data is processed only with your consent in writing, which may be given electronically, obtained at booking and in the service consent form, and only by or under the responsibility of a health care professional or a person bound by an equivalent duty of confidentiality. Requests for consent are presented separately from other terms, and you are informed of your right to withdraw consent before giving it.
4.3 BMMS shall send direct marketing communications only with your consent. Each such communication shall identify BMMS and provide a means by which you may object to further communications free of charge.
4.4 BMMS shall not use personal data in any manner incompatible with the purposes for which it was collected.
5.Automated Messaging
5.1 Certain WhatsApp and website chat communications are handled initially by automated messaging systems which provide information about the Services, pricing and booking and route enquiries to BMMS personnel. Such systems do not make clinical decisions, and no decision producing legal or similarly significant effects concerning you is made solely by automated means.
5.2 Messages are recorded and may be reviewed by BMMS personnel for quality and safety purposes. Clients are asked not to submit detailed health data by chat unless requested by BMMS personnel.
6.Services Booked on Behalf of Another Person
6.1 A person who books a Service on behalf of another adult warrants that the client is aware of and consents to the booking.
6.2 Results and health data shall be disclosed only to the client, save where the client or the client's legally authorised representative has given written authorisation for disclosure to another person.
6.3 Where an adult client's ability to make informed decisions is impaired by a physical or medically certified condition, consent shall be obtained from the client's legal guardian, and BMMS shall take reasonable steps to verify the guardian's authority.
7.Disclosure of Personal Data
7.1 BMMS may disclose personal data, to the extent necessary for the purposes set out in Section 4, to:
(a) BMMS physicians, contracted nurses and authorised personnel, each of whom is bound by obligations of confidentiality;
(b) laboratories performing confirmatory or laboratory testing;
(c) health care providers to whom you are referred, with your consent;
(d) service providers acting on our behalf, including Healthie (electronic health record and patient portal), our booking system provider, our payment processor, WhatsApp Business (Meta Platforms), our accounting software provider, messaging automation providers, and website hosting and analytics providers;
(e) public health authorities, courts, regulators or law enforcement bodies where disclosure is required or authorised by law; and
(f) professional advisers and insurers, where necessary for legal, accounting or insurance purposes.
7.2 Service providers are permitted to process personal data only on BMMS's instructions and are required to maintain appropriate security. Health data is not disclosed to the payment processor or accounting software provider, and messaging templates are designed to minimise the disclosure of health data.
7.3 Transfers outside The Bahamas. Certain service providers, including Healthie, store data outside The Bahamas, principally in the United States and Canada. Such transfers are necessary for the performance of our agreement with you and are made only as permitted by Data Protection Law. BMMS protects transferred data by using providers that encrypt data in transit and at rest, restrict access to authorised personnel, and are bound by contractual data protection and confidentiality commitments.
7.4 Where BMMS is required by law to disclose your personal data, BMMS shall, where lawful and practicable, inform you in advance of the recipient, the purpose of the disclosure, and the means of recourse available to you.
8.Security
8.1 BMMS takes appropriate technical and organisational measures against unauthorised access to, or alteration, disclosure or destruction of, personal data and against its accidental loss or destruction. These measures include encrypted transmission and storage, role-based access controls, individual user accounts with multi-factor authentication where available, confidentiality agreements, and periodic security reviews.
8.2 BMMS maintains a data breach response procedure and records every personal data breach. Where a breach is likely to result in a risk to your rights and freedoms, BMMS shall notify the Data Protection Commissioner, and shall communicate the breach to you, within three (3) working days of becoming aware of it, or as otherwise required by Data Protection Law.
9.Retention
9.1 Personal data shall not be kept for longer than is necessary for the purpose for which it was collected. Subject to clause 9.2, BMMS retains personal data as follows:
(a) clinical records and test results: ten (10) years from the date of the last Service provided to the client;
(b) payment, invoicing and financial records: five (5) years from the end of the financial year in which the transaction occurred, in accordance with Bahamian tax and business record-keeping requirements;
(c) messaging and chat communications not forming part of the clinical record: twelve (12) months from the date of the communication;
(d) enquiries that do not result in a booking: twelve (12) months from the date of the last contact;
(e) marketing consent and opt-out records: for as long as consent remains in effect, and thereafter for such period as is necessary to give effect to the opt-out; and
(f) technical and analytics data: for the periods stated in the Cookie Notice.
9.2 Where personal data is required in connection with an actual or anticipated legal claim, regulatory inquiry or investigation, it shall be retained until that matter is finally resolved.
9.3 On expiry of the applicable period, personal data shall be securely destroyed or irreversibly anonymised.
10.Your Rights
10.1 Subject to Data Protection Law, you have the right, by written request to BMMS:
(a) to be informed whether BMMS processes personal data relating to you and to obtain a copy of such data, together with information on the purposes of processing, the recipients, any transfers outside The Bahamas and the applicable retention period, which BMMS shall provide within thirty (30) days of receipt of the request;
(b) to have inaccurate personal data rectified, and incomplete personal data completed, without undue delay;
(c) to have personal data erased without undue delay where it is no longer necessary, where consent has been withdrawn and no other legal ground applies, or where it has been processed unlawfully;
(d) to require BMMS to restrict the processing of your personal data in the circumstances provided by law, including where you contest its accuracy;
(e) to object to processing carried out on the basis of legitimate interests, and BMMS shall within twenty-one (21) days either comply or give reasons for not complying;
(f) to require BMMS to cease, or not to begin, processing that is causing or is likely to cause you unwarranted substantial damage or distress;
(g) to object to direct marketing at any time, which BMMS shall action promptly and in any event within twenty-one (21) days;
(h) where processing is based on your consent or on our agreement with you and is carried out by automated means, to receive the personal data you have provided to BMMS in a structured, commonly used and machine-readable format, and to have it transmitted to another data controller; and
(i) to withdraw any consent you have given at any time, without affecting the lawfulness of processing carried out before withdrawal.
10.2 Clinical and financial records may be retained notwithstanding a request for erasure where retention is required by law, is necessary for reasons of public health, or is required for the purposes described in clause 9.2.
10.3 BMMS may require verification of your identity, or further information needed to locate the data, before acting on a request, and the applicable time period shall run from receipt of that information. BMMS does not currently charge a fee for requests, save for any fee prescribed by regulations.
10.4 Requests should be sent to support@bmmshealth.com. You have the right to make a complaint to the Office of the Data Protection Commissioner of The Bahamas, and, where you have suffered damage as a result of a breach of your rights, to seek compensation through the courts.
11.Persons Under Eighteen
11.1 The Services, website and booking system are intended solely for persons aged eighteen (18) years or over. BMMS does not knowingly collect personal data from persons under eighteen through its website or booking system. Where BMMS becomes aware that it has done so, such data shall be deleted, save where retention is required for clinical safety or by law.
12.Amendments
12.1 BMMS may amend this Policy from time to time. The current version shall be published on the BMMS website with its date of last update. Material amendments shall be notified on the website or directly to affected clients.
13.Contact
13.1 Enquiries concerning this Policy or the handling of personal data should be addressed to: Privacy, Bahamas Mobile Medical Solutions, Nassau, The Bahamas. Email: support@bmmshealth.com. Telephone: (242) 821-2667.
13.2 General enquiries may be directed to info@bmmshealth.com.