Bermuda Pharmacy Group Ltd (BPG) uses personal information to provide safe pharmacy and retail services and to operate its business. This notice explains what we use, why we use it, who we share it with, how we protect it and how you can exercise your rights under Bermuda’s Personal Information Protection Act 2016, as amended (PIPA).
1. Who we are
Bermuda Pharmacy Group LTD three pharmacy locations
| Pharmacy | Address | Telephone |
|---|---|---|
| Par-La-Ville Pharmacy | 2 Church Street, Hamilton HM 11 | 441 296 5510 |
| City Pharmacy | Cumberland House, Victoria Street, Hamilton HM 11 | 441 296 5511 |
| Point Finger Road Pharmacy | 16 Point Finger Road, Paget DV 02 | 441 236 2859 |
Registered office: Quorum, Thistle House, 4 Burnaby Street, Hamilton HM 11. General contact: bpg@pharmacy.bm.
2. Privacy Officer
BPG’s Privacy Officer is Kiran Shah, Managing Director. Questions, concerns and written PIPA rights requests may be sent to bpg@pharmacy.bm or delivered to any BPG pharmacy for prompt forwarding to the Privacy Officer.
3. Personal information we use
Depending on your relationship and the service requested, we may use:
- identity and contact information, including name, date of birth, address, telephone number and email address;
- prescription, medication, refill, allergy, health, prescriber and pharmacy-service information;
- insurance, plan, claim, eligibility, payment and billing information;
- transaction, charge-account and customer-service information;
- a masked or tokenised payment reference for the limited number of approved card-on-file arrangements;
- communications, complaints, requests, delivery or collection instructions and identity-verification information;
- CCTV images and related incident information at our pharmacies; and
- website, online-refill and app information, which may include device, log, IP-address and cookie information where the relevant technology is enabled.
We may receive information directly from you or your authorised representative, or from a physician, hospital, other pharmacy, insurer, public authority, payment provider, service provider or another source permitted by law.
4. Why we use personal information
- to provide safe and accurate pharmacy services, dispense and refill medication, review interactions and allergies, communicate with prescribers and source specialty medication;
- to verify identity, process insurance claims, receive payment and administer charge accounts or approved card-on-file arrangements;
- to provide retail services, online refill functions, collection or delivery arrangements and customer support;
- to meet professional, regulatory, public-health, product-recall, adverse-event, controlled-drug, audit, tax, accounting and other legal obligations;
- to protect our patients, customers, employees, premises, systems and assets, including through CCTV and incident investigation; and
- to answer questions, handle complaints, exercise or defend legal rights, improve services and operate our business.
5. Conditions for using personal information
BPG uses personal information only where a condition permitted by PIPA applies. Depending on the purpose, this may include your knowing consent, steps taken at your request, performance of a contract, a provision of law, insurance-plan provisions, an emergency affecting life or health, debt collection, legal proceedings or another permitted condition. We do not rely on the PIPA reasonable-expectations condition for sensitive personal information.
6. Who we may share information with
Where necessary and permitted, we may share relevant information with:
- authorised BPG personnel who require it for their work;
- physicians, hospitals, pharmacists, other pharmacies and healthcare professionals involved in your care or prescription;
- insurers, benefit-plan administrators and claims processors;
- public authorities, regulators, professional bodies, courts, law enforcement or others where authorised or required;
- payment processors, banks, accountants, auditors, legal advisers and debt-collection providers; and
- technology, pharmacy-software, hosting, communications, website, refill-service, delivery, security and specialist-medicine providers acting for or with BPG.
BPG does not sell or rent personal information.
7. Service providers and overseas transfers
Some software, hosting, payment, communications, technical-support, insurance or specialist-medicine providers may process information outside Bermuda. Before an overseas transfer, BPG assesses the recipient, country, purpose, information, safeguards and contractual or other protections. BPG remains responsible for information transferred to a service provider and maintains further details in its vendor and overseas-transfer register. You may request information about relevant transfer arrangements from the Privacy Officer.
8. Payment-card arrangements
For the limited number of approved card-on-file arrangements, a PCI-compliant payment provider holds the full payment-card details. BPG retains only a masked or tokenised payment reference and the account information needed to administer the arrangement. Please do not send full card details to us by ordinary email or message.
9. Website analytics and online services
Our website and online refill services may use essential technology and, where enabled, analytics cookies or similar tools. These services may process technical information such as IP address, browser, device, log and cookie information. Available cookie choices and the information shown when the technology is used form part of this notice.
10. CCTV
BPG uses CCTV at all three pharmacies for premises security, health and safety, loss prevention and incident investigation. Cameras are not intended for areas where a person reasonably expects a high degree of privacy. Access is restricted to authorised persons, and footage may be disclosed where necessary for an investigation, insurance matter, legal claim or lawful request.
11. How long we keep information
We keep personal information only as long as necessary for the service or purpose and for applicable pharmacy, health, professional, insurance, tax, accounting, regulatory, contractual, complaint and legal requirements. Prescription and patient records, transaction and account records, employee records, CCTV footage and rights-request records may therefore have different retention periods. CCTV is normally retained for the period set in our internal schedule unless footage is needed for an incident or legal matter. Information that is no longer required is securely erased or destroyed.
12. How we protect information
BPG uses organisational, physical and technical safeguards proportionate to the sensitivity and risk. These may include access controls, individual credentials, locked storage, encryption and secure transmission, device and network protections, controlled vendor access, staff confidentiality and training, secure destruction and incident-response procedures. No method of storage or transmission is entirely risk-free, so we review safeguards as our services and risks change.
13. Your rights
Subject to the conditions and exemptions in PIPA, you may have the right to:
- receive information about BPG’s use of your personal information;
- access your personal information and medical records;
- ask us to correct an error or omission;
- ask us to stop or not begin using personal information for advertising, marketing or public relations;
- ask us to stop a use likely to cause substantial damage or substantial distress; and
- ask us to erase or destroy personal information that is no longer relevant for use.
Send a written request to bpg@pharmacy.bm or deliver it to any BPG pharmacy. Please describe your request sufficiently and provide information that allows us to verify your identity and, if applicable, your authority to act for another person. We will acknowledge the request and respond to a completed request within 45 days unless a permitted extension applies. Rights are not absolute, and we will explain any refusal or partial refusal in writing.