Privacy Policy

Welcome to your Jora Health - Decisively Account. This privacy notice tells you how your Personal Data is used. This is so you can decide whether or not to give your consent to Jora Health; to create your Decisively Account and for the Service to use your personal data. The privacy notice is not a user guide, so it does not tell you how to use the Service or Account.

The DECISIVELY user guide is available within the Help section of the application.

Terminology

“Service Recipient” is a user on the system who receives a service from a Service provider otherwise called a professional
“Service Provider” is a user on the system who provides a service to a Service Recipient
“You” This means the user and the person giving their consent to see or share their record
“Decisively Account” is an online account that lets you gather, edit, store, and share personal health information
“The Service” is the IT platform used to provide your online account
“Carers” are friends, family or other people that help you with your care
“Professionals” are employees of organisations using DECISIVELY whose identity and qualifications have been legally verified, for example, doctors and nurses
“Organisations” are customers of DECISIVELY that are involved in your care and that you trust to view your records, for example, hospitals
“Encryption” secures data in such a way that only those with the correct credentials can access it

Purpose and features of DECISIVELY

Decisively is a citizen-centric health and wellness portal that allows you to connect with your health and wellness team at your convenience.

The key features of your portal are:

Dashboard: Gives an overview of key metrics like Tasks, health status, appointments, etc.
Notification: The feature enables care providers and care recipients to receive system notifications and alters.
Messages: The feature allows care providers and care recipients to communicate effectively and securely.
Appointments: Allows care recipients to request in-person or virtual appointments with their care team members. The tool allows service providers to schedule appointments and book resources like clinic rooms.
Task Management: The feature allows the care providers to schedule tasks for their care recipient or for the care recipient to schedule tasks for themselves. Care providers can schedule tasks only for those patients who have connected with them.
Health Record: The solution provides the ability to store and view key health-related information for the user like diagnosis, allergies, health documentation, clinical observation, and wellness trackers. The Health Record of Service Recipients can only be accessed by providers after the necessary consent is obtained and, on a need-to-know basis. All access is logged.
Decision Tree: The logic-driven SMART questionnaire and is used to evaluate wellness and care.
Administrative Features: Like access to billing, reset password.

Types of DECISIVELY Service Users

You can use DECISIVELY as three types of user:

Service Providers
Service Recipients
Organisations

Service Providers: are professionals who provide a health or wellness service. Each Professional registers for a Decisively Account. Professionals would need to complete the ‘Onboarding’ process to complete their staff profile by providing contact information, educational credentials and service details. The account is only activated after these details have been verified by a DECISIVELY administrator.

Service Recipients: Users use the service to maintain their health and wellness record. The solution allows them to interact with their service provider. They are normally invited by a Service Provider to register.

Organisations: The account allows the organisation which could be a 3rd party organisation to view reports like gain corporate wellness insights.

Will my information be used for anything else?

Information access by professionals is strictly on a Need-to-Know basis. You decide who can see your record. If registering as part of an Organisation and participating in a corporate wellness programme, you decide if you would like to share anonymised data you provide in questionnaires about the company for them to gain insights on organisation wellness. No personally identifiable data is revealed to the organisation. If we tell you about a research trial, you can decide to take part. Your information is not shared until you have told us you want to share it.

Data disclosure and use

To help you with your query, Jora Health may use personal information:

To provide you with important information about the Service, such as important updates and notifications
To send you the Jora Health e-mail newsletter (if you choose to receive it)
To determine your age and location to help determine whether you meet the criteria for an Account

Is DECISIVELY free?

DECISIVELY is paid for by organisations such as your hospital, health board or local practice or an individual care provider. Service providers are charged a subscription to use the solution. The service is for the patients is free via their provider. Carers or individual professionals you invite to view your record. The system may charge you a nominal subscription charge to continue to use the application after your relationship with all your service providers have ended.

Can I delete or hide my DECISIVELY account if I change my mind?

Because Professionals make medical decisions based on the information in your DECISIVELY record, it is a medical record. Data cannot be deleted for 8 years after last usage, in case there is a legal case about medical safety. You are in control of access to your record unless the law stipulates access by another individual or authority is required. Professionals accessing your record must declare the consent they have, this is recorded in DECISIVELY .

You can only edit or hide data you have added. You cannot edit or hide data others have added. If you would like to change or hide information that has been added about you, or if it is incorrect, you can contact the Organisation and request this.

How is my information protected?

Jora Health is committed to protecting your privacy.

DECISIVELY administrators cannot see your medical record and has no control over your record. We keep the information on secure servers. We encrypt the data so no one can see your medical record except the people you choose or those with a lawful basis.

Tracking, Cookies and Analytics

You can opt-in to receive the DECISIVELY newsletter which has updates about DECISIVELY . DECISIVELY tracks software usage to improve software quality. DECISIVELY does not track identifying information or records. DECISIVELY uses cookies to improve website operation and usage; for example, we use cookies to set a Users language and to monitor usage trends. Cookies do not contain identifying information such as IPs, health data or personal details.

This Privacy Notice

This privacy notice applies to the Jora Health Service (referred to in this privacy notice as the "Service"), which you access by logging into your account.

This privacy notice does not apply to any other online or offline Jora Health sites, products, or services.

The privacy notice is written generally as if you are the patient, ie you use your own Account to manage your health records. If you are a Carer who manages the patient’s records for them, you must read the privacy notice on the basis that it refers to you using your Account to manage the patient’s health records

Agreement and Further Information

A User's continued use of the Service constitutes the User’s agreement to this privacy notice. If you feel you require further information before you are able to provide consent – please refer to The User Information and Security Statement section below or contact support@jorahealth.com.

Full User Information and Security Statement

This User Information and Security Statement explains how the Service works and how we keep the Service secure.

Explanation of Terms Used in This Statement

“User” is the person giving their consent to see or share their record
“Account-holder Information” is your contact details (including your e-mail address, postal address and postal code) and your account password, security question and security answer.
“Jora Health (DECISIVELY ) Account” is an online account that that lets you gather, edit, store, and share personal health information
“The Service” is the IT platform used to provide your online account
“Carers” are friends, family or other people that help you with your care
“Professionals” are employees of organisations using DECISIVELY whose identity and qualifications have been legally verified, for example doctors and nurses.
“Organisations” are customers of DECISIVELY that are involved in your care and that you trust to view your records, for example: hospitals
“Encryption” secures data in such a way that only those with the correct credentials can access it

Creating an Account

To create an Account, the User must provide the Account Holder Information. This includes your full name, email address, and a valid mobile numer. We will use the e-mail address provided to send the User an e-mail requesting that they validate the e-mail address.

Existing Health Care Records

If an Organisation has data about the User and the Organisation agrees to release the data to Jora Health, Jora Health will show the data in the User Account.

For example, Organisations can automatically send their discharge letters to the record. When a User logs in, DECISIVELY software will search external databases. Organisations can publish a database of research trials for the Patient to consent to share their data with an Organisation.

User-managed personal information

An Account allows you to manage health records as the Patient or Carer. Any User can add data, for example:

diagnoses, medications and allergies;
fitness-related activities like steps;
measurements such as blood glucose and blood pressure;
patient diaries;
laboratory test results you have received;
health and wellness history.

A User can only edit or hide data they have added. The User cannot edit or hide data others had added. The User must ask Organisations or Professionals to edit or hide data they have added to the User Account.

Sharing health records

When sharing a record, the User must decide in the person who they are sharing their information has a need-to-know. For example, a Patient might want their Professional (a doctor) to have access to all the information in their health record but for a Carer (a family member) might only be able to access certain parts of the record on a need-to-know basis

The Organisation, Carer, Professional or User is responsible for the legal basis of their sharing and access. You can at any time you can stop sharing with any service provider or user you have shared this with.

Children’s records

The legal age to register on Divisively is 18. We do not at present hold any Children’s record.

Deleting health records

Once a Patient’s record has been verified by a Professional it is a medical record on which the Professional can make medical decisions. Therefore, Jora Health will maintain the record for a minimum of 8 years after last usage and/or last data addition (whichever is later) to provide a medico-legal audit trail.

Disclosure and use of personal data

We do not use or disclose Personal Data except as described in this notice. If we receive a help request to support@jorahealth.com we may be provided with a name and email address. Occasionally, although we ask Users not to, Users may tell Jora Health clinical information about themselves (e.g. "I cannot access my message from Dr Smith" or “I cannot see the report my doctor uploaded”).

Only Clinical Administrators with strick access control policies have access any clinical information in the health records because the health records are encrypted and there is no facility for removing the encryption for the purpose of answering such enquiries.

In support of these uses, Jora Health may use personal information:

To provide important information about the Service, including critical updates and notifications;
To send the Jora Health e-mail newsletter (if you opt in via your Account preferences);
To determine age and location to help determine whether The User meets the criteria for an Account.

Third parties

DECISIVELY does not use third-party services to provide support.

Lawful disclosures

Jora Health may access and/or disclose Account-holder information if such action is necessary to:

Comply with the law or orders served on Jora Health;
Protect or defend the rights or property of Jora Health (including the enforcement of our agreements); or
Act in urgent circumstances to protect the personal safety and welfare of users of Jora Health services or members of the public.

Data storage

DECISIVELY 's data centers are in stored in Azure cloud in a UK location. Data for European customers remain stored in the European Economic Area (EEA).

How we use aggregated information and statistics

Jora Health may use aggregated information from the Service to improve the quality of the Service and for marketing of the Service (for example, to tell potential advertisers how many Service users' data are stored in the United Kingdom data centre).

This aggregated information is not associated with any individual Account.

Jora Health does not use Account-holder information for marketing purposes without Jora Health first asking for and receiving User opt-in. The only information we aggregate is usage data, e.g. how many people are using the Service, how many messages they are sending, how many test results they are receiving.

We have no access to actual health records or communications, i.e. which Users are sending messages via the Service, what the content of their message is, or what the test result was.

Newsletter

To keep Users informed of the latest improvements, the Service will send a newsletter. The newsletter is sent on an opt-in basis. If Users do not want to receive the newsletter, they do not check the box that requests the newsletter when signing up for the Service. Users can unsubscribe at any time with one click through a link at the bottom of the newsletter. If Users later decide that they want to receive the newsletter, the newsletter can be requested by signing up in on the web portal page.

Security of personal information

Jora Health is committed to protecting the security of personal information. We use a variety of security technologies and procedures to help protect personal information from unauthorized access, use, and disclosure. For example, we store Account-holder information and health records on computer servers with limited access that are located in controlled facilities. The Service stores all clinical data using encryption so that only Users, and the people Users grant access to, are able to read health records. The Service sends all communications, except e-mail, using HTTPS. The Services keep a log of all access and actions to any health record, and Users can view the full log for any health record for which they are a Patient or Professional. E-mail messages are not encrypted, so when we send email notifications, the message only contains:

The patient or Account-holder’s name.
The fact that they have new clinical data.
The type of clinical data they have, eg a new test result, a new message from a doctor.
A link to log in securely to the Account to see the data.

When we replace our servers we erase the old equipment completely as part of ISO 27001 compliance and in line with NCSC guidelines.

Use of Cookies

We use cookies with this Service to enable Users to sign in and to help personalise the Service. A cookie is a small text file that a web page server places on the device Users use to access their Account. For information about how we use cookies, please see our Cookie Policy at: https://www.joraclinic.com/technology/cookiepolicy

Changes to this privacy notice

We may update this privacy notice at any time. When we do, we will change the "last updated" date at the bottom of the privacy notice. If there are material changes to this privacy notice we will notify Users, either by placing a prominent notice on the home page of the Jora Health web site or by sending a notification by email or directly to the

User Account.

We encourage Users to review this notice periodically. Users' continued use of the Service constitutes the Users' agreement to this privacy notice, as amended.

Contact information

The name “Jora Health” is a registered trademark of Jora Health Limited, which is a private company limited by shares and registered in the UK with company number 6517382. You can find our registered office address and contact telephone number in the footer of our website at www.jorahealth.com

Comments

Jora Health welcomes comments regarding this notice. If you have questions about this notice or believe that we have not adhered to it, please contact us by using our web form. If you have a technical or general support question, please visit https://www.joraclinic.com to learn more about Jora Health Support offerings.

Privacy Notice - Version 1.0 - Updated: [31st July 2023]