Who we are

The Health Services Authority, the Ministry of Health, Environment, Culture & Housing, and the Department of Public Safety Communications are Data Controllers in monitoring your location and promoting your compliance with public health requirements relating to quarantine and isolation.

We are also Data Controllers in relation to assessing and reporting on the innovative technology and enhanced safety protocols that have been implemented in order to safely reopen our borders to international travel and allow for persons to participate in the Quarantine at Residence programme.

We are committed to making sure your data is secure. This privacy notice explains how we use personal data we collect when you participate in the Quarantine at Residence programme and isolate at your residence or other approved accommodation in accordance with public health requirements.

Any questions regarding this notice and our privacy practices should be sent by email to the Health Services Authority’s Director of Corporate Services at datacompliance@hsa.ky.


What personal data we collect and why we collect it

For the purposes of surveillance by the Medical Officer of Health, Regulations under the Public Health Law require certain persons to remain at a place of isolation specified by the Medical Officer of Health and subject to directions that may be provided. Anyone who arrives in the Cayman Islands during the COVID-19 pandemic is subject to quarantine under these Regulations.

The personal data we will collect includes:

  • Your full name and the unique identifier that will be assigned to you for the programme
  • Your telephone number(s)
  • Your age range (i.e. 18 and older, 10-17, under 10)
  • Your approved physical address for your quarantine period
  • Your current location

Your name, unique identifier, telephone number(s), age range and physical address will be collected from Travel Cayman (which is a temporary function established under the Ministry of District Administration, Tourism & Transport), which approved your application to travel to the Cayman Islands.

Your current location will be collected using location services on the mobile device you receive as part of this monitoring programme. Your location history will only be recorded and stored if your current location breaches your agreed quarantine location at any point.

We will also assign you two devices with unique identifying numbers: a wristband and a mobile device to pair with the wristband. The mobile device will also have an assigned mobile telephone number.


Additional data we are likely to collect

While you are being monitored and our team is helping you to comply with public health requirements, we may need to collect additional information. When we receive an automatic alert that you are not in compliance with an isolation requirement, you will receive the same alert on the mobile device issued as part of this programme. This will be the most common reason we need to collect more personal data.

As part of our procedures to follow up on alerts and to provide you with support while you are in quarantine, we may contact you and ask for certain personal data. This includes information about your current, previous or intended location as well as sensitive personal data about your physical or mental health or condition. This information will generally be collected directly from you and used to determine whether you are in compliance with isolation requirements, how we will respond to alerts generated from the monitoring system, and/or whether you require additional support or services.

If you are unavailable or unresponsive to attempts to contact you and it is necessary to obtain these personal data indirectly, information about you may also be collected from any other authorised person. This includes another individual who resides at the same place where you are isolating.


Data relating to children

Personal data relating to children under the age of 18 may be collected from the child’s parent or legal guardian. Children under the age of 10 will not be monitored using this technology and their names will not be collected from Travel Cayman. However, we will need to be aware if there are any children under the age of 10 in your traveling party or residing at the place where you are isolating.


Who Are Our Data Processors?

Government’s Computer Services Department provides IT business and technical solutions to meet business aims and objectives and will provide necessary support this programme.

Amazon Web Services (AWS) is a private company providing on-demand cloud computing platforms. Our monitoring system will be hosted in Ireland and AWS will process only pseudonymised personal data. Your name and contact details will not be stored in this system, only your unique identifier.

Hexnode is a private company providing the Mobile Device Management solution to control the device issued to you and run the software application and location services. They will not have access to your name or contact details. Pseudonymised personal data will be stored in their servers in Germany.


What are your data protection rights?

We want to make sure you are fully aware of all of your data protection rights. Every individual who participants in the Quarantine at Residence programme is entitled to the following:

  • The right to access – You have the right to request copies of your personal data and other information related to our processing.
  • The right to rectification – You have the right to request that we correct any information you believe is inaccurate, including to ensure it is complete or up to date.
  • The right to erasure – You have the right to request that we erase your personal data, under certain conditions.
  • The right to stop or restrict processing – You have the right to request that we stop or restrict the processing of your personal data, under certain conditions.
  • The right to complain – You have the right to complain to us or the Ombudsman if you believe we are processing your personal data in a way that breaches the Data Protection Law.

You can submit any questions or complaints to us at datacompliance@hsa.ky.

Information about the Cayman Islands Data Protection Law, including how to complain to the Ombudsman, is available at ombudsman.ky/data-protection.


Who has access to your information?

Your personal data will be stored securely and only accessed by authorised employees and other persons who act on our behalf.

We will never sell or pass your information to third parties. However, we may disclose your personal data to third parties who are also working to promote compliance with public health requirements, including the Royal Cayman Islands Police Service. The Health Services Authority may also use personal data collected as part of this monitoring programme for related purposes, including promoting your compliance with requirements or patient management.

If your personal data are disclosed for enforcement purposes, we will endeavour to inform you before this happens and only disclose the minimum amount of data necessary for that purpose. The mobile device we have issued to you will also display the same alert we will receive if the technology detects you are not complying with the terms and conditions of your participation in this programme.

While we will mainly use the information collected as part of our monitoring programme to monitor your location and promote your compliance with public health requirements during your quarantine period, we may also use this information to provide you with further support or services. This includes advice and medical care relating to COVID-19 or an unrelated concern or condition.

In certain circumstances, we may have a legal obligation or other reason to disclose your personal data to a third party that is unrelated to this monitoring programme. This includes if we are required to comply with an audit; to participate in legal proceedings, obtain legal advice, or defend or exercise legal rights; or to comply with information security or records and information management requirements.


How do we keep your personal data safe?

We take appropriate technical and organisational measures to keep your personal data confidential and secure, in accordance with our internal policies and procedures regarding storage of, access to and disclosure of personal data.

We may keep your personal data in our electronic systems, in the systems of our Data Processors, or in paper files. Unless it is necessary for someone to know who you are, your personal data will be pseudonymised, which means a unique identifier will be used instead of your name.


Changes to our Privacy Notice

This Privacy Notice was last updated on 2 November 2020. Changes included the new minimum age to participate in the Quarantine at Residence programme and updating our list of Data Processors.

We have the right to update the contents of this Privacy Notice from time to time to reflect any changes in the way in which we process your personal data or to reflect legal requirements as these may change.

In case of updates, we will provide you with a copy of the revised Privacy Notice as soon as possible.