Privacy Policy
Cayman Essential Care · Effective 2 November 2026
This Privacy Policy explains how Cayman Essential Care(“we”, “us”) collects, uses, shares, and protects your information in our scheduling, intake, and billing application (the “Service”). We are a mental-health practice, and we treat the information you share with the care that health information deserves.
We operate in the Cayman Islands, so this policy is grounded in the Cayman Islands Data Protection Act (2021 Revision), which is the law that governs us and is overseen by the Office of the Ombudsman. We also hold ourselves to the standards of the U.S. HIPAA Privacy and Security Rules as a best-practice framework for how we handle health information.
Information we collect
- Appointment details you or your clinician enter: name, email, phone, appointment type, time, and whether the visit is in person or virtual.
- Intake information you provide on intake or consent forms, which may include health information relevant to your care.
- Billing information such as insurer, policy number, charges, and payments.
- Clinician account credentials for staff who sign in (passwords are stored only as salted hashes, never in plain text).
- Video connection tokens when a clinician links their own Zoom or Google account so meeting links can be created for their virtual appointments.
Our legal basis for handling your health information
Under the Data Protection Act, health information is “sensitive personal data” and needs a specific condition to be processed. We rely on the provision of medical care by, or under the responsibility of, a professional who owes you a duty of confidence, together with your explicit consent, which we ask for at intake. You may withdraw consent at any time, subject to the records we are legally required to keep (see Your rights below).
How we use information
- Treatment: to schedule, manage, and remind you about appointments, to prepare your clinician for your care, and to keep clinical records.
- Payment: to bill for services and manage insurance and payments.
- Operations: to run the practice safely, including quality, security, and administration.
- To create and attach video meeting links for virtual appointments.
We do not sell your personal information, and we do not use it for advertising.
When we may share without your authorization
We may use or disclose your information without separate authorization only where the law permits or requires it, for example: when required by law or legal process; to public-health or regulatory authorities where mandated; to report suspected abuse, neglect, or a serious and imminent threat to the health or safety of you or others; and for lawful health-oversight activities. We limit any such disclosure to the minimum necessary.
Uses that need your written authorization
Any use or disclosure not described in this policy will be made only with your written authorization, which you may revoke at any time. In particular, a clinician’s private process notes (sometimes called psychotherapy notes) are kept separate from your main record and are given extra protection, and we do not sell personal information or use it for marketing.
Video meetings (Zoom and Google)
When a clinician connects their own Zoom or Google account, the Service uses that connection only to create a meeting for a virtual appointment (its topic, date, time, and duration) and to remove that meeting if the appointment is cancelled. Access tokens are stored securely and used solely for this purpose.
Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We access a clinician’s Google Calendar only to create and cancel the meetings for their appointments; we do not read other calendar data, and we do not transfer or use this data for any other purpose.
How we protect information
Sensitive information, including intake answers and client records, is encrypted at rest (AES-256) and encrypted in transit over the internet. Access is restricted to authorized staff on a need-to-know basis, clinicians see only their own clients unless they hold an oversight role, every access and change to a record is recorded in an audit log, staff sign in with their own accounts, two-step login is available, and staff sessions log out automatically after a period of inactivity.
Where your information is stored (transfers outside the Cayman Islands)
Our hosting and database run on infrastructure located in the United States, so providing the Service involves transferring your information outside the Cayman Islands. We do this under appropriate safeguards: contractual data protection terms with those providers, the technical protections described above, and your consent at intake. If you have questions about these transfers, contact us using the details below.
Sharing and service providers
We share information only as needed to provide the Service, with providers who process data on our behalf under written data-protection agreements: our hosting and database provider, our email provider (for appointment and billing messages), and the video providers (Zoom and Google) you or your clinician connect. We may also disclose information where required by law.
Data retention
We keep clinical and billing records for as long as required for your care and to meet our legal and professional obligations, and no longer than necessary, then dispose of them securely.
Your rights
Subject to the records we are legally required to keep, you have the right to:
- Access and get a copy of the personal information we hold about you (we aim to respond within about 30 days).
- Correct or amend information that is inaccurate or incomplete.
- Object to or restrict certain uses of your information, and request confidential communications (for example, that we contact you a particular way).
- Request an accounting of certain disclosures we have made.
- Withdraw consent you previously gave, and ask us to delete information where we are not required to keep it.
- Receive a paper copy of this policy on request.
- Be notified of a breach that affects your information.
How to exercise your rights, and how to complain
To exercise any of these rights, contact us at the address below and we will respond. A clinician may disconnect a linked Zoom or Google account at any time from within the Service. If you are not satisfied with how we have handled your information, you may complain to us, and you also have the right to complain to the Office of the Ombudsman (Cayman Islands) (ombudsman.ky). We will never retaliate against you for making a complaint or exercising your rights.
If information is ever exposed
If a breach affects your personal information, we will act on it without undue delay, including notifying the Office of the Ombudsman and the people affected where the law requires, in line with our breach-response plan.
Children
Where we provide care to minors, information is handled with the involvement of a parent or guardian as appropriate. The Service is not directed to children for independent use.
Changes
We may update this policy from time to time; the effective date above reflects the current version.
Contact us
Cayman Essential Care · Privacy contact
Email: Therapy@caymanessentialcare.com
Web: caymanessentialcare.com
This notice is an internal draft prepared in good faith; it is not legal advice. Because the practice is in the Cayman Islands, a Cayman-qualified attorney should confirm what applies and approve the final version before it is relied upon.