Effective on: March 31st, 2023
Introduction and Scope
Remote Medicine Inc., doing business as RMI, and our subsidiaries Remote Medical International Limited; Remote Medical International UK Ltd.; Remote Medical Canada Ltd; Remote Medicine Inc. (DMCC Branch); Remote Medical International Ghana Limited; Occupational Medical Services Ghana Ltd; Remote Medical International Kenya Limited; Remote Medical International Mozambique LDA; Remote Medical International Nigeria Limited; Remote Medical International Oman LLC; Remote Medical International Tanzania Limited; Remote Medical International Malaysia Limited; Remote Medical International Sarl U; Remote Medical International Uganda Limited; Ship Security International Limited; SSI Energy Ltd; Health Pioneers Int. SPC; and Investment License Remote Medicine Inc., (collectively, “RMI”, “we”, “us”, “our”) take the protection of personally identifiable information (“Personal Data”) very seriously. This Medical Privacy Notice (the “Notice”) addresses data subjects whose Personal Data we may process in the course of providing medical staffing and support services, including providing physical examinations (sometimes referred to as “medicals”) to our clients’ employees (collectively, the “Services”).
Within the scope of this Notice, RMI acts as a data controller for the Personal Data we process.
Basis of Processing
We may process your Personal Data in order to deliver the requested Services to our client (your employer). Your sensitive Personal Data, such as medical information, is processed on the basis of:
- your explicit and fully informed consent;
- the need to perform a contract with your employer;
- the need to comply with the law; or
- any other ground, as required or permitted by law.
Where we process your Personal Data based on your consent, you may withdraw it at any time. However, this will not affect the lawfulness of our processing before you withdrew your consent. It will also not affect processing performed on other lawful grounds. In some cases, we may not be able to continue delivering Services if you withdraw consent for processing your Personal Data.
How We Receive Personal Data
We may receive your Personal Data when:
- you provide it directly to us as part of using or participating in our Services;
- we receive it from third-party services;
- our clients (including their employees, contractors, and other representatives of the company) provide it to us;
- we receive it from other companies within our corporate group;
- our service providers provide it to us; or
- we receive it from health providers.
Categories of Personal Data
We may process the following types of Personal Data:
- biographical information, such as first and last name and date of birth;
- contact information, such as email address, phone number, and postal addresses;
- account information for various communication services, such as username;
- demographic information, such as gender, race, and ethnicity;
- health information, such as overall fitness to perform necessary tasks, medical history, and health screening results; and
- professional information, such as current position and training.
Purposes of Processing
We may process your Personal Data for the purposes of:
- enabling the use of and participation in the Services;
- tracking the needs of our clients;
- tracking field injuries and medical information for fitness and health purposes for our clients; and
- responding to your requests or questions.
When the purposes of processing are satisfied, we will generally retain applicable Personal Data for a period of seven years, though some Personal Data may be retained indefinitely for regulatory purposes or as required by applicable law.
Sharing Personal Data with Third Parties
We share Personal Data with our subsidiaries and affiliates, as well as with certain service providers, who process Personal Data on our behalf, and who agree to use the Personal Data only to assist us in providing our Services or as required by law. Our service providers may provide:
- application hosting services;
- cloud storage services;
- email software;
- electronic health records;
- communication services; and
- CRM software.
We also share Personal Data with subcontractors providing similar services when necessary to meet our clients’ needs. These subcontractors typically act as data controllers in their own right. In all cases, RMI will require that our subcontractors agree to only process Personal Data received from RMI for limited and specific purposes and maintain data protection standards substantially similar to those which RMI itself is subject.
Some of these third parties may be located in other countries, some of which may have different standards for privacy and data security. However, before transferring your Personal Data to these third parties, we will either ask for your explicit consent or require the third party to maintain at least the same level of privacy and security for your Personal Data that we do. We remain liable for the protection of your Personal Data within the scope of our self-certification to the EU-U.S. and Swiss-U.S. Privacy Shield Frameworks (“Privacy Shield”) that we transfer to third parties, except to the extent that we are not responsible for the event that leads to any unauthorized or improper processing. For the purposes of data transfer, we rely on the data transfer mechanisms listed in the “Data Transfer” section below.
Other Disclosure of Your Personal Data
We may disclose your Personal Data to the extent required by law, or if we have a good-faith belief that we need to disclose it in order to comply with official investigations or legal proceedings (whether initiated by governmental/law enforcement officials, or private parties). We may also disclose your Personal Data if we sell or transfer all or some of our company’s business interests, assets, or both, or in connection with a corporate restructuring. Finally, we may disclose your Personal Data to our subsidiaries or affiliates, but only if necessary for business purposes, as described in the section above.
We reserve the right to use, transfer, sell, and share aggregated, anonymous data for any legal business purpose. Such data does not include any Personal Data. The purposes may include analyzing usage trends or seeking compatible advertisers, sponsors, and customers.
If we have to disclose your Personal Data to governmental/law enforcement officials, we may not be able to ensure that those officials will maintain the privacy and security of your Personal Data.
Data Integrity & Security
We have implemented and will maintain technical, administrative, and physical measures that are reasonably designed to help protect Personal Data from unauthorized processing. This includes unauthorized access, disclosure, alteration, or destruction.
Your Personal Data Rights
If we process your Personal Data, you may have the right to request access to (or to update, correct, or delete) such Personal Data. You may also have the right to ask that we limit our processing of such Personal Data, as well as the right to object to our processing of such Personal Data. You may also have the right to data portability.
If we have received your Personal Data in reliance on the Privacy Shield, you may also have the right to opt out of having your Personal Data shared with third parties and to revoke your consent to our sharing your Personal Data with third parties. You may also have the right to opt out if your Personal Data is used for any purpose that is materially different from the purpose(s) for which it was originally collected or which you originally authorized. To submit these requests or raise any other questions, please contact us by using the information in the “Contact Us” section below.
If Personal Data must be transferred internationally in the course of providing the Services or otherwise processing your Personal Data, one of the following transfer mechanisms will be used in the following order of precedence:
- Valid and current certification to the Privacy Shield framework or any replacement framework that has been implemented and is considered valid under the UK GDPR, the GDPR, or other applicable law;
- Executed Standard Contractual Clauses and any accompanying additional security measures and analysis, as needed; or
- Informed written consent of the data subject.
EU-U.S. and Swiss-U.S. Privacy Shield Frameworks
For Personal Data processed in the scope of this Notice, RMI complies with the Privacy Shield. For more information about RMI’s Privacy Shield certification and to learn how we comply with the Privacy Shield Principles, please see our Privacy Shield Statement located at https://rmiglobalsolutions.com/privacy-shield-statement/.
European Union and United Kingdom Supervisory Authority Oversight
If you are a data subject whose Personal Data we process, you may also have the right to lodge a complaint with a data protection regulator in one or more of the European Union member states, the United Kingdom, or your applicable jurisdiction.
If you have any questions about this Notice or our processing of your Personal Data, please write to our Legal Department at firstname.lastname@example.org or by postal mail at:
RMI Attn: Legal
1455 NW Leary Way Suite 400
Seattle, Washington 98107
Please allow up to four weeks for us to reply.
United Kingdom and European Union Representative
We have appointed Remote Medical International UK Ltd. as our representative in the United Kingdom for data protection matters. Remote Medical International UK Ltd. can be contacted on matters related to the processing of Personal Data in the United Kingdom.
Our United Kingdom representative can be contacted at:
Remote Medical International UK Ltd.
We have appointed VeraSafe Ireland Ltd. as our representative in the EU for data protection matters. VeraSafe Ireland Ltd. can be contacted on matters related to the processing of Personal Data in the EU.
Our EU representative can be contacted at:
VeraSafe Ireland Ltd.
Unit 3D North Point House
North Point Business Park
New Mallow Road
You may also contact VeraSafe through the form available at: https://verasafe.com/public-resources/contact-data-protection-representative.
Data Protection Officer
We have appointed VeraSafe as our Data Protection Officer (DPO). While you may contact us directly, VeraSafe can also be contacted on matters related to the processing of Personal Data. VeraSafe’s contact details are:
22 Essex Way #8203
Essex, VT 05451 USA