Privacy Policy

1. Introduction

Volunteers Incorporated (“Volunteers Inc.”, “we”, “us”, or “our”) is committed to protecting the privacy and personal data of participants in the 2000 Vision Screening Programme. This Privacy Policy explains how we collect, use, share, store, and protect personal data in accordance with the Jamaica Data Protection Act, 2020 (“the Act”).

This policy applies to all personal data processed through the 2000 Vision Screening Programme, including data collected from parents/guardians, students, schools, and programme personnel.

2. Data Controller

The data controller responsible for the personal data processed under this programme is:

3. Personal Data We Collect

We collect and process the following categories of personal data:

Student Data

• Full name, date of birth, gender, and grade level
• School name and parish
• Photographs (for identification purposes during the programme)

Health & Medical Data (Sensitive Personal Data)

• Vision screening results (visual acuity measurements)
• Diagnostic examination findings and diagnosis codes
• Prescription data for corrective eyewear
• Referral details for follow-up care
• Autorefractor measurements (sphere, cylinder, axis, pupillary distance)

Parent/Guardian Data

• Full name, phone number, and email address
• Digital signature and consent records

Programme Personnel Data

• Full name, email, phone number, and assigned role
• Activity logs and access records

4. Lawful Basis for Processing

We process personal data on the following lawful bases under the Act:

• Express consent: Parents/guardians provide informed, written consent before their child's data is collected or processed. For health and medical data (classified as sensitive personal data under the Act), we obtain written consent as required by law.
• Legitimate purpose: Data is processed solely for the purpose of delivering the vision screening programme, including screening, diagnosis, provision of corrective eyewear, and programme monitoring and evaluation.
• Medical purposes: Health data is processed by or under the supervision of qualified medical professionals who owe a duty of confidentiality.

5. How We Use Personal Data

Personal data collected is used exclusively for the following purposes:

• Conducting vision screenings and diagnostic examinations
• Producing and delivering prescription eyeglasses
• Communicating with parents/guardians about their child's results and follow-up care
• Programme monitoring, evaluation, and statistical reporting (using aggregated, anonymised data where possible)
• Reporting to programme stakeholders and funders on programme outcomes
• Public awareness and event promotion (photographs/media, with consent)

6. Who We Share Data With

Personal data may be shared with the following prescribed stakeholders, solely for the purposes described in this policy:

• National Education Trust (NET) — programme partner and co-administrator
• Ministry of Education and Youth — programme oversight and reporting
• Participating schools — coordination of screening events and follow-up
• Licensed medical professionals — ophthalmologists, optometrists, and screening technicians involved in delivering clinical services
• Optical partners — for the production and delivery of prescription glasses
• Authorised programme sponsors and funders — aggregated and anonymised data for programme evaluation and reporting

We do not sell personal data to any third party. All parties who receive personal data are expected to handle it with appropriate confidentiality and in compliance with the Act.

7. Cross-Border Data Transfers

Data collected under this programme is processed and stored on secure servers provided by our technology platform provider, which may be located outside of Jamaica, including in the United States of America. We take reasonable steps to ensure that any cross-border transfer is subject to appropriate safeguards and that data remains protected in accordance with the Act. By consenting to participate in the programme, you consent to this transfer.

8. Data Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction, or damage, including:

• Encryption of clinical and medical data at rest using authenticated encryption (NaCl secretbox)
• Encryption of all data in transit via TLS/HTTPS
• Role-based access controls limiting data access to authorised personnel only
• Row-level security policies ensuring users can only access data within their scope (parish, school, role)
• Comprehensive audit logging of all data access and modifications
• Rate limiting and input validation to prevent abuse
• Authenticated access required for all student photographs and medical records

9. Data Retention

Personal and medical data will be retained only for as long as is reasonably necessary to fulfil the purposes described in this policy, including programme delivery, follow-up care, and statutory reporting obligations. Upon expiry of the applicable retention period, data will be securely deleted or anonymised.

Consent records are retained for the duration required to demonstrate compliance with the Act.

10. Your Rights Under the Act

Under the Jamaica Data Protection Act, 2020, you (as a parent/guardian exercising rights on behalf of your child) have the following rights:

• Right of Access: You may request a copy of the personal data we hold about your child.
• Right to Rectification: You may request correction of any inaccurate personal data.
• Right to Erasure: You may request deletion of your child's personal data, subject to any legal obligations requiring us to retain certain records.
• Right to Withdraw Consent: You may withdraw consent at any time by notifying the school or Volunteers Inc. in writing. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
• Right to Prevent Processing: You may object to data processing in certain circumstances as provided by the Act.
• Right to Complain: You have the right to lodge a complaint with the Office of the Information Commissioner of Jamaica if you believe your data protection rights have been violated.

To exercise any of these rights, please contact us at info@volunteersinc.org.

11. Children's Data

This programme is specifically designed to serve children. We recognise the heightened sensitivity of children's personal data and process it only with the written consent of a parent or legal guardian. All rights under the Act relating to a child's data may be exercised by the child's parent or legal guardian.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. Any material changes will be communicated through the programme's consent process. The date of the most recent update is shown at the top of this page.

13. Contact Us

If you have any questions about this Privacy Policy, wish to exercise your data protection rights, or have concerns about how your data is being handled, please contact:

You may also contact the Office of the Information Commissioner of Jamaica if you wish to lodge a complaint regarding the handling of your personal data.