Website Privacy Policy

We use the practical information needed to respond to enquiries, administer learning and accounts, reconcile payments, verify attendance and issue eligible certificates. Optional marketing and website measurement require their own valid choices. Refusing those optional uses does not cancel an otherwise valid learning purchase.

Do not send clinical history, identifiable case material, payment-card credentials or other people’s private records through public forms, evaluations or session chats. A private learning link grants access to its holder and should be protected like a password. A certificate verification link allows its holder to see the recipient’s name, activity and stated CE hours.

Accounts for ages 13 to 17 require an approved activity, the guardian process and any higher applicable local or provider age requirement. Direct online use is not offered to children under 13. Contact drrose.johnson@gmail.com with privacy questions or requests. You may complain directly to Jamaica’s Office of the Information Commissioner without first complaining to us.

Dr. Rosemarie Johnson, operating from Jamaica, is the controller of information collected for the purposes she determines through this website and its services. In this policy “we”, “us” and “our” mean Dr. Johnson, including authorised people assisting her. The privacy contact is drrose.johnson@gmail.com, subject “Privacy request”. This is the contact for the controller and is not a claim that a separate data protection officer has been appointed.

This policy covers website visitors, account holders, enquirers, participants, guardians, subscribers and relevant professional or organisational contacts. It covers enabled functions and information received through related operational correspondence. It does not turn a public form into a clinical intake channel or replace a separate clinical privacy notice, informed-consent arrangement, staff policy or professional engagement agreement.

An organisation paying for a participant’s place or making a referral may be a separate controller for its own records. External providers may also act independently for their own security, identity, regulatory or transaction purposes. Their roles are explained in sections 15 to 18. We remain responsible for processing for which we determine the purposes and means.

Most information comes from you when you browse, create an account, enquire, subscribe, register, pay, take part, ask for support or exercise a right. We also receive information from an authorised guardian, sponsor or professional contact where relevant, and from facilitators checking participation or correcting an operational record.

Service providers may return necessary information such as identity verification results, payment status, transaction references, meeting attendance or email delivery status. The browser and hosting infrastructure also generate technical information needed to deliver and protect requests. A provider’s technical logs are distinct from our optional public-page measurement.

The website is not a clinical intake channel. We do not ask referrers to supply a person’s identity or clinical records in an initial public enquiry. Historical information and information supplied unexpectedly remain subject to appropriate handling. If someone supplies information about you, we assess their authority and the relevant purpose, provide the information required by law and avoid collecting more than is necessary. A sponsor’s involvement does not itself authorise us to disclose private participant records back to it.

An enquiry may include your name, email, optional location, service interest and message. A professional or organisational enquiry may also identify your role, organisation and broad request. Support and refund correspondence may contain references, dates, a description of the problem and the resolution. Practical referral or current-client administrative correspondence, including historical information, remains personal information. A public submission is not a clinical record or confirmation of a referral or appointment change.

We use this information to understand, route and answer the request, establish whether a further conversation is appropriate, maintain the necessary correspondence and handle a complaint or dispute. A request for information does not automatically become permission for newsletters. We may need to retain a proportionate record of an enquiry or refusal where necessary to explain an administrative or professional decision.

Keep free-text messages brief and practical. Even a short message can reveal health-related information through its context. We assess such information as potentially sensitive where appropriate rather than assuming that a prohibition in the form prevents it from being personal or sensitive data.

Account and authentication information may include your email address, account identifier, profile details you supply, verification status, access role and sign-in or recovery records. The authentication provider handles passwords and verification mechanisms. We do not ask you to send a password or one-time verification code to staff. Authorised administrators may manage relevant access and review records needed for security or support.

If you choose Google sign-in, Google provides the identity information authorised through that sign-in flow, such as your email and basic profile details. We do not receive your Google password. Do not assume that a sign-in permission authorises unrelated access to all your Google files or messages. Check the permissions actually presented for the function you choose.

We process account and security records to establish access, prevent unauthorised use, restore legitimate access and investigate misuse. Provider infrastructure may record IP addresses, browser or device details, request times, errors and other technical identifiers. These records may be necessary even when optional measurement is rejected and may not be accessible to us in full.

Registration information includes participant and certificate names, email, country, chosen activity, registration reference, status, applicable offer conditions and consent or acknowledgement records. An offer may also request a phone number, professional role, organisation or licence number where relevant. Required and optional fields should be identified on the form. A missing genuinely necessary field may prevent a registration or certificate from being processed.

We use these records to confirm the chosen activity, check the stated requirements, administer places, communicate changes, reconcile payment and preserve the terms applicable to the booking. Organisational participation may require a purchaser or sponsor contact and the minimum information necessary to administer the arrangement.

For permitted teenage use, the approval process must record the age or age band and location information needed to apply the rules, guardian contact and declared authority, the permissions and policy versions presented, confirmation and withdrawal records and the approved activity. We seek proportionate assurance and do not routinely request identity documents through a public form. Guardian records are used for safeguarding, permission and administration, not as automatic marketing contacts.

Where paid registration is enabled, the payment provider receives the payment credentials entered in its interface and information needed to process and secure the transaction. Our operational records may include the participant or payer reference, activity, amount, currency, checkout or transaction identifiers, verified status, relevant dates, refund or dispute information and necessary reconciliation correspondence.

The website’s registration and enquiry forms do not request full card numbers, card security codes or online-banking passwords. Do not send them by email or in free text. A payment provider, card network or bank may collect additional billing, authentication, device or anti-fraud information under its own notice. A provider’s collection is not evidence that every field is copied into our learning records.

We use the necessary information to confirm payment, provide receipts or confirmations, correct duplicate or uncertain charges, process refunds, keep accounting records and deal with fraud or disputes. Refund records may remain necessary after course access ends or an account is closed. Refusing optional marketing or analytics does not prevent a lawful refund request.

Learning records may include the confirmed enrolment, included courses or bundle, access start and expiry, private access credentials, lesson requests and relevant support or error information. The learning system can issue temporary media URLs and store a private access link in browser session storage. We do not represent these operational records as a complete history of everything you watched or learned.

Attendance records may include the activity or sessions attended, verified minutes, facilitator decisions and, where used, meeting-provider join and leave information or participant identifiers. We use them to administer participation and assess the published completion requirements. Evaluations may include ratings, optional comments, registration or session identifiers and submission status. They may be linked to the participant to check eligibility and therefore should not be treated as anonymous.

We use feedback to improve the activity and administer stated certificate requirements. Giving a negative rating does not remove an otherwise earned entitlement. We may use genuinely anonymised summaries for evaluation of our services. We do not publish an identifiable comment as a testimonial without separate permission.

Certificate records may include the recipient’s name, certificate number, activity title, stated CE hours, activity or issue date, issuer, status and verification link. We keep the relevant evidence of attendance and evaluation where needed to explain eligibility, correct an error, manage a reissue or investigate a disputed certificate.

Anyone holding a valid certificate verification link or its QR code can view the recipient’s name, activity title, stated CE hours and certificate identifier on the verification page. The system also checks the certificate’s status; a valid record is displayed only as permitted by that status. The verification response may include the issue date and status as well. This is a disclosure to a link holder, even though the page is not an open directory of all participants.

Share a certificate or verification link only with people you intend to be able to verify it. A recipient may forward it. The verification function is not meant to expose your email, payment details, evaluation comments or clinical information. Contact us about an incorrect, exposed or disputed record so that we can assess an appropriate correction or other lawful action. Deletion rights are considered alongside legitimate record-verification and legal requirements.

We assess the appropriate lawful condition for each use under Jamaica’s Data Protection Act and any other applicable law. Necessary steps you request before an agreement, performance of a valid agreement, compliance with a legal obligation, valid consent and legitimate interests may each be relevant. Legitimate interests are assessed against the person’s rights and the possible prejudice; we do not treat every useful business activity as automatically justified.

Responding to a requested enquiry, administering a purchase, providing access and sending essential service messages commonly involve requested steps or contractual administration. Accounting, legal reporting and some record retention may involve legal obligations. Protecting the system, resolving disputes and checking the accuracy of a certificate may involve legal obligations or appropriately assessed legitimate interests. Optional marketing, optional measurement and identifiable promotional use require the specific permission or other basis the law requires.

Contractual necessity is not a justification for collecting unrelated information, and a guardian’s agreement must not be treated as an agreement made by a minor where the law does not support that conclusion. Sensitive personal data requires an additional applicable processing condition. We assess that separately. In a genuine emergency or safeguarding situation, another lawful condition may apply, but the website is not an emergency response service.

We should identify information genuinely needed for an account, enquiry, registration, attendance or certificate separately from optional information. If necessary information is missing or inaccurate, we may be unable to complete the requested function and will explain the practical reason. A form acknowledgement confirms that a notice was presented or a request was made; it is not unlimited permission for every future use.

Where processing depends on consent, the choice must be informed, specific and freely given. You may withdraw it through the same route where available, the unsubscribe link, Cookie Preferences or our privacy contact. Withdrawal affects future processing based on that consent and does not make earlier lawful processing unlawful. We will explain any necessary delay or separate lawful reason to retain a limited record.

Withdrawing optional marketing, recording or analytics permission does not itself cancel a purchased activity. Withdrawing a permission necessary for a particular approved minor arrangement or an essential element of a specific activity may require us to discuss continued participation or another lawful arrangement. We do not automatically treat that as forfeiture of every payment or privacy right.

The online system is not offered for direct use by children under 13. Ages 13 to 17 may use their own accounts only for expressly approved, age-appropriate activities after the guardian approval process has been completed and any higher local or provider minimum age is met. If that process is unavailable, do not create a teenage account or submit the child’s registration details; contact Dr. Johnson first about an approved arrangement.

We explain the proposed information use to the guardian and, in a form appropriate to their age, the young person. The approval must identify the relevant purposes and permissions. Learning approval is separate from optional marketing, optional measurement and promotional photography or recording. We do not use a child’s information for behavioural advertising or treat a guardian’s contact details as an automatic newsletter subscription.

A parent or legal guardian may exercise the rights allowed by law for a minor; a young person may act for themselves where the law recognises their capacity in the relevant matter. We assess authority and the young person’s rights before disclosing records and do not give every adult who claims a relationship unrestricted access. When consent is withdrawn, circumstances change or the young person becomes an adult, permissions and access should be reviewed. Contact us if information was submitted without the necessary authority.

Public enquiry, registration, support and evaluation tools are intended for operational information. Do not upload clinical histories, detailed symptoms, therapy notes, identifiable case material, identity documents or payment credentials. Do not include information about someone else unless you have the necessary authority and the particular channel is appropriate.

If sensitive material arrives unexpectedly, we will assess its context, restrict further handling to what is necessary and take appropriate steps to remove, minimise, secure or redirect it, subject to a valid legal or safeguarding reason to retain it. We may ask you to continue through a separately agreed private process. We will not reuse such material for marketing, open teaching examples or optional analytics simply because it reached the website.

Where an accessibility request needs sensitive information, discuss the practical adjustment first. Detailed health evidence should be requested only where genuinely necessary and through an appropriate process. Separate clinical services require their own privacy and professional safeguards. A privacy notice alone does not make an otherwise unsuitable public platform appropriate for clinical recordkeeping.

We use your contact information for messages necessary to respond to you or administer the service you requested. These may include verification, registration confirmation, payment or access updates, schedule changes, reminders, participation follow-up and certificate information. They are distinct from promotional newsletters. Messages may be delivered through the platform’s configured email service and the email services used for correspondence, including the Gmail address used by Dr. Johnson.

Optional learning updates use the email, name, country and topic choices you supply where relevant, together with permission, confirmation and unsubscribe records. Where a confirmation link is used, a request remains pending until the required confirmation is completed. A registration marketing checkbox is not permission for an unrelated organisation to market to you. We do not treat the mere fact of enquiring or paying as newsletter consent.

Unsubscribe through the message’s available link or contact us. We may retain the minimum suppression and permission history needed to respect the choice and demonstrate compliance. Necessary service messages may continue while there is a current service or lawful administrative reason. Marketing will be sent only through an enabled sender and a lawful recipient list; a provider connection is not authority to contact everyone in a database.

Information may be accessed by Dr. Johnson and authorised administrators or facilitators to the extent needed for their duties. Relevant recipients may include hosting, authentication, storage, payment, meeting, correspondence and email-delivery providers; professional advisers and accountants; and a sponsor or organiser where a specific authorised arrangement requires limited reporting. We aim to limit access and disclosure to the relevant purpose.

Our website application provider supplies the website application platform, authentication, database and file or function infrastructure used by the system. It may process operational records on our behalf under its applicable arrangements and process certain information for its own platform obligations. Where an activity uses HandyPay checkout, payment information is processed by HandyPay and its relevant payment partners. Banks and payment networks may have their own legal and fraud-prevention duties.

Where Zoom is used for a live activity, it processes information needed to operate the meeting and may provide attendance records. Recording is a separate matter covered by section 18. A connected records service may hold activity records, synchronised contact information or encrypted recovery copies where those functions are enabled. We do not imply that every provider receives every category of information or that a feature is active merely because code for it exists.

If an employer, institution or other organisation sponsors participation, we will identify what information is necessary for the agreed administration, such as confirming a named booking or eligible completion. Their payment, involvement or a referral does not automatically authorise sharing private evaluation comments, account credentials or clinical information. Separate authority or another valid legal basis is needed for additional disclosure. An initial website enquiry is not acceptance of a referral or permission to transmit clinical records.

We may disclose necessary information to comply with a valid legal duty, court order or authorised regulatory request, establish or defend a legal claim, address suspected fraud or protect a person where the law permits or requires it. We assess the request, authority and information needed rather than making unrestricted disclosures. Safeguarding concerns may limit confidentiality where a lawful reporting or protection duty applies.

If responsibility for the business or a service changes, any transfer of necessary records must have a lawful basis and appropriate safeguards. We will provide notice and obtain permission where required. Such a change does not create permission to sell a contact list for unrelated marketing or remove existing rights and confidentiality obligations.

Cloud hosting, authentication, file delivery, meetings, correspondence, payments and recovery services may involve processing outside Jamaica and access from more than one country. The relevant destinations and recipients depend on the services actually enabled and their contracted arrangements. Information can be subject to the lawful access requirements of the jurisdiction in which it is processed.

Transfers must meet the applicable Jamaican data protection conditions, including the assessment of adequate protection or an applicable lawful exception or safeguard. We must assess the actual recipient and arrangement; we do not claim that every destination is approved merely because a provider publishes a general security statement. Acceptance of all Terms or a website visit is not unrestricted consent to overseas processing. Contact us for information about the relevant destinations and transfer arrangements for your records.

Providers’ own current notices explain their independent processing. Contact us for our website application provider’s current privacy notice. Other relevant notices include HandyPay at https://www.handypay.me/privacy, Google at https://policies.google.com/privacy, and Zoom at https://www.zoom.com/en/trust/privacy/privacy-statement/. Contact us for details of any additional enabled service providers and their privacy notices. These external notices supplement this policy and do not replace our own responsibilities or your rights against us.

Identifiable recordings or photographs may contain a name, display name, voice, image, chat contribution or question. Before any proposed recording or photography, the activity-specific notice must explain what will be captured, why, who can access it, how long it will remain available and the relevant participation choices. We obtain the permission or other lawful basis required for the particular use.

Marketing or testimonial use of an identifiable participant requires a separate specific permission. Participation, a positive evaluation, payment or acceptance of the Terms is not that permission. For a minor, the appropriate guardian authorisation and the young person’s age-appropriate involvement are required. Where we offer an alternative to appearing in a recording, we explain its practical limits and any remaining meeting-platform processing.

Withdrawal is assessed against the particular permission and law. We can stop future use within our control where required, but cannot promise to recall every copy already lawfully received or independently shared by another person. Participants must not record, introduce transcription bots or disclose other participants’ contributions without the necessary permission. Contact us promptly about an unauthorised recording or publication.

The website and its providers use browser storage and requests needed for authentication, security, preference choices and services you request. For example, the current cookie-preference record stores the chosen optional-measurement setting and its version in this browser. Clearing storage, using a different browser or device, or a preference-version change may require you to choose again.

Private course access may be stored in session storage so that the course link can continue to work during that browser session. Treat a shared or unattended device as a potential disclosure risk. Account tokens and provider authentication cookies may be managed separately. Blocking all essential storage can prevent sign-in or another requested function, while rejecting optional measurement should not prevent registration or enquiries.

The Cookies and Preferences notice provides the supporting explanation and the footer’s Cookie Preferences control reopens the available choice. A browser privacy signal or “do not track” setting is not represented as a complete substitute for that control, and third-party destinations may operate their own essential technologies under their notices.

Optional public-page measurement is not enabled in this published release. The application’s built-in page tracking is disabled and the Cookie Preferences panel records an essential-only choice. No optional page-measurement event is sent by that panel. Necessary provider service and security processing is described separately in sections 5 and 19.

If optional measurement is enabled in a later release, it must remain off until a valid choice has been obtained. The intended limited application payload is a public page category, page-view event and day, with the applicable choice version. It must exclude names, email addresses, messages, payment information, registration references, full private URLs and private course tokens. Private checkout, learning, evaluation, certificate and administrative routes must remain excluded.

A limited measurement payload would not guarantee complete anonymity because hosting infrastructure may receive technical identifiers and platform-created metadata. Any future measurement purpose, provider and retention arrangements must be assessed and disclosed before activation, with a fresh choice where required. Optional processing for a permitted teenage user must also meet applicable guardian and local-law requirements. The site is not configured to load optional advertising or accessibility-assist trackers by default.

We retain identifiable information only while it remains necessary for its stated purpose and applicable legal, accounting, contractual, professional or dispute requirements. The relevant period depends on the category, the last meaningful contact, the service and any legal hold. We review whether a smaller or anonymised record will meet the remaining need. Contact us for the retention criteria applicable to your record.

Enquiries and support correspondence are needed while a request is active and for a proportionate period to explain its outcome or handle a related complaint. Account records are needed while an account remains active and for appropriate closure and security administration. Registration, offer, permission, guardian, attendance and evaluation records are kept as needed to administer the activity, demonstrate lawful permission, resolve disputes and support an accurate certificate history. Unnecessary evaluation free text should be removed or anonymised sooner where it no longer serves those purposes.

Payment and refund records follow applicable accounting, tax, financial and dispute requirements. Certificate records may need a longer verification period than routine enquiries. Subscription records remain relevant while you subscribe; a limited suppression record may remain after unsubscribe so that the choice is respected. Optional measurement and technical logs are reviewed separately against their operational purposes and provider arrangements. No fixed retention period is promised for every category where a different legal requirement applies.

Deletion from a live operational record does not necessarily remove a lawful accounting record, certificate history, suppression record or protected recovery copy immediately. We assess each category and explain any lawful reason for retaining information. An account-closure request and a request to erase particular records are related but different actions.

Where secondary recovery copies are enabled, they may include encrypted operational snapshots and references to files held elsewhere. They follow their own access, review and disposal arrangements. We must take deletion and correction requirements into account when using recovery copies and avoid routinely restoring information that should no longer be used. Encryption and backup status do not themselves justify indefinite retention or prove that every file is recoverable.

If a dispute, investigation or legal preservation requirement applies, we may retain the necessary information for that purpose and limit unrelated use. After that need ends, the ordinary retention review resumes. We cannot erase another independent controller’s records on its behalf, but will address requests concerning information under our control and involve relevant processors where required.

We use and review measures appropriate to the information and service, including access restrictions, authentication, limiting operational access and the platform’s available security features. Sensitive material should be kept out of public workflows, private links protected and exports limited to an authorised purpose. Where an encrypted secondary backup is enabled, it is a recovery measure rather than permission to disclose the underlying records.

No internet transmission or storage method can be guaranteed completely secure. Report a suspected compromise to drrose.johnson@gmail.com with enough information to investigate, without sending passwords, private tokens or additional exposed records. If your account or device is compromised, also use the relevant provider’s recovery and security controls.

We assess suspected incidents, take steps to contain and remedy them, preserve necessary evidence and make notifications required by law. This includes the applicable notification duties to Jamaica’s Information Commissioner and affected people. We do not promise that a provider’s security certification eliminates every risk or restrict your rights to complain or claim a remedy for unlawful processing.

Subject to the applicable law and its limits, you may ask to be informed about processing, access your personal information and relevant processing details, correct inaccuracies and withdraw consent where processing depends on it. You may also have rights to prevent or restrict particular processing, object to direct marketing, obtain rectification, blocking, erasure or destruction in appropriate circumstances, and challenge decisions based solely on automated processing that significantly affect you.

Where the law provides and the relevant conditions are met, you may request that technically transferable information be provided in a structured, commonly used, machine-readable form or transmitted to another controller. These rights are not an unconditional right to erase every accurate certificate, financial record or document needed to meet a legal obligation. We explain any lawful limitation and consider whether partial fulfilment is possible.

You may exercise a right directly or through an appropriately authorised representative. Guardian and minor requests are assessed under the rules explained in section 12. You may also seek an assessment, complaint or remedy through the appropriate regulator or court. These Terms and policies do not contract out of those rights.

Email drrose.johnson@gmail.com with the subject “Privacy request”. Tell us the right you wish to exercise, the relevant email or registration reference and enough context to locate the record. You do not need to use legal wording. Avoid sending identity documents or full payment information unless a proportionate secure verification process has been agreed.

We may ask for information reasonably needed to verify identity, authority or the record concerned. We must protect other people’s information when supplying a response. We do not disclose a participant’s records merely because someone knows their name or claims to be their employer, guardian or referrer. Ordinary privacy enquiries do not require a fee; any fee for a statutory request must be legally authorised and explained before it is required.

We respond promptly within the time applicable to the particular right. Under Jamaica’s Data Protection Act, access requests generally require compliance within 30 days, subject to the Act’s conditions; notices seeking to prevent relevant processing have a different statutory response period, ordinarily 21 days. We will explain the applicable timing and any lawful requirement for further information. We do not claim a general right to extend a legal deadline simply because a request is inconvenient. If we cannot fully comply, we give the reason and relevant legal basis and explain available complaint options.

The system applies operational rules such as payment-status checks, access expiry, attendance thresholds, required evaluations and certificate eligibility. These checks may allow, delay or prevent an operational step. They do not diagnose a health condition or independently decide whether you should receive psychological treatment. We do not present the learning system as a clinical decision-maker.

Contact us if a payment, access, attendance or certificate outcome appears wrong, and request human review. We can check the underlying information, consider a correction and explain the relevant published requirement. Where you have rights concerning a solely automated decision that significantly affects you, those rights apply independently of this support process.

We do not describe routine rule-based checks as a complete profile of your professional ability or circumstances. A human review must consider relevant facts and cannot simply repeat an inaccurate system result without investigation. Any future materially different profiling or AI-based use would require its own lawful assessment, notice and permissions where applicable.

You may raise a concern directly with Dr. Johnson at drrose.johnson@gmail.com so that it can be investigated. Explain the relevant function, what information is involved and what outcome you seek, while avoiding unnecessary sensitive detail. We will consider the concern and any applicable statutory request or deadline.

You may also complain directly to Jamaica’s Office of the Information Commissioner at https://oic.gov.jm/ or use its current official complaint route. You are not required to complain to us first, obtain our permission or complete an internal process before contacting the regulator. Check the OIC’s official website for its current contact and submission details.

If another jurisdiction’s law applies to your circumstances, you may also have a right to approach its competent authority or court. A Jamaican governing-law clause does not remove a mandatory privacy remedy that applies to you. We do not require confidentiality or a release of legal rights as the price of making an ordinary privacy complaint.

The version, last-updated information and effective date identify this policy. We will update it when the law, relevant services or information uses materially change and provide additional notice where appropriate. The information supplied when you used a function remains relevant to whether the original processing was lawful.

A new policy does not automatically provide consent for a new optional purpose or authorise incompatible use of previously collected information. Where a fresh choice is required, we must obtain it before that processing begins. Cookie-choice versions may also change so that an updated optional-processing choice can be collected.

You may keep a copy of this policy and ask us about the version applicable to your interaction. For privacy requests, contact drrose.johnson@gmail.com. Read the Website Terms and Conditions and Cookies and Preferences notice alongside this policy for the related service rules and browser controls.