HIPAA/PHI Policy

Jade is committed to protecting the privacy, confidentiality and security of personal and health information collected, stored, processed or transferred through its Services.

Jade operates internationally and recognises that the collection, use, storage, disclosure and protection of personal and health information may be subject to different privacy and data protection laws, regulations and contractual requirements depending on the location of the individual, the nature of the information, the services provided and the parties involved.

Jade applies appropriate technical, organisational and administrative safeguards to protect information against unauthorised access, use, disclosure, alteration, loss or destruction.

Where appropriate, Jade uses recognised de-identification, anonymisation, aggregation and other privacy-enhancing methodologies. The methods and safeguards applied will depend on the nature of the information, its intended use, the risk of identification and applicable legal and contractual requirements.

Where Jade provides services to healthcare organisations, technology providers or other commercial partners, additional privacy, security and data-handling obligations may apply under relevant agreements.

Jade handles personal and health information in accordance with applicable privacy and data protection laws, relevant contractual obligations and the policies and safeguards described in this document.

Client Data Policies

Client Data includes data stored by Clients in Jade applications, information about a Client’s usage of the application, data instances in the CRM system that we have access to, or data that the Client has supplied to use for support or implementation. Here are the special considerations we take into account when managing Client Data:

1. Client Data must not be disclosed outside of Jade except:
   1. To the Client who owns or controls the relevant account.
   2. To a Partner contracted by the Client to manage or support their account.
   3. Where disclosure is authorised by the Client or otherwise permitted by applicable law.
   4. Where information has been appropriately de-identified or anonymised and converted into De-identified and Aggregated Data in accordance with Jade’s Privacy Policy, in which case it may be used or disclosed for the purposes described in that policy.
2. Client Data should only be shared using a secure sending method. Approved sending and sharing methods include Dropbox, Google Drive, emailing of encrypted files or use of a Client-provided secure transfer method.
3. Client Data should only be stored temporarily outside of the Jade Application if at all. If there is a need to archive Client Data (for example, data provided by a Client during implementation or training), the data should be stored on a central file server and deleted from any personal computers. This includes report exports, contact lists, and presentations that contain Client information, and Client agreements.
4. Client Data should only be accessed on a need-to-know basis. Specifically, a Client’s account should only be accessed to provide support, troubleshoot a problem with that account, or for supporting the system as a whole.
5. Client Data should never be changed except with the explicit permission of the Client, with the exception of repairing data quality issues.

PHI Handling Policy

All Jade staff members are made aware of relevant external regulations as part of their induction process, and all staff who may come into contact with PHI are trained in our PHI handling processes.

Jade applies appropriate de-identification and anonymisation procedures to health information where appropriate and technically feasible.

Where information remains identifiable, or cannot reasonably be de-identified for operational, technical or support purposes, access is restricted to authorised personnel with a legitimate business need. Such information is retained, returned or securely destroyed in accordance with applicable legal requirements, contractual obligations and Jade’s data retention policies.

De-identified and Aggregated Data may be retained and used by Jade for the purposes described in its Privacy Policy, subject to appropriate safeguards and applicable laws.

Jade requires Clients, collaborators and partners providing health information to ensure that they have the necessary rights, permissions and consents to provide that information to Jade for the purposes for which it is supplied.

Jade will independently assess its own obligations when using or disclosing health information, including for secondary purposes, research, analysis and the creation or commercialisation of De-identified and Aggregated Data.

The provision of information to Jade does not, by itself, establish that Jade has permission to use or disclose that information for every subsequent purpose.

Where a Business Associate agreement or similar contract relating to PHI is in place, Jade staff members work under the terms of that agreement. Where no such agreement exists, the Jade PHI handling policy and process are followed.

Jade conducts periodic internal audits on compliance with this policy.