Fibromyalgia Privacy Policy

---

Fibromyalgia Care Society of America, Inc.

Internal Data Protection Policy

1. Purpose

Fibromyalgia Care Society of America, Inc. (“FCSA”) has developed this internal Data Protection Policy (the “Policy”) to safeguard the Personal Information (“PI”) it collects, receives, uses, maintains, or otherwise Processes in the context of its activities and operations, to minimize data privacy and security risks, to protect against reputational harm, and to comply with Applicable Data Protection Laws. This Policy is reasonably designed to safeguard PI from unlawful and unauthorized access, use, modification, processing, disclosure or destruction consistent with FCSA-’s high standards for privacy and security and in compliance with Applicable Data Protection Laws.  

1. Scope and Application

This Policy applies to 

• All PI collected, accessed, received, maintained, used, disclosed or otherwise Processed by FCSA whether in electronic, paper or other form.
• All FCSA workforce members (e.g., directors, employees, contractors, interns, staff, volunteers) and all third-party vendors, service providers, and others working on behalf of FCSA, as applicable. 

1. Changes and Updates

FCSA reserves the right to update and amend this Policy at any time. Notice of changes will be updated as/when needed/required.

1. Definitions

The terms used within this Policy shall have the meaning ascribed to them by the Applicable Data Protection Law including but not limited to the terms Personal Information, Reasonable Safeguards, and Personal Data Breach.

Notwithstanding, for purposes of this Policy: 

Applicable Data Protection Laws mean all U.S. federal, state, and local laws regulating the privacy and security of Personal Information collected, Processed and or maintained by FCSA and to which FCSA is subject. 

Data Subject means a consumer, individual, employee or other person contemplated by the Applicable Data Protection Law.

Process means all operations and activities which involve Personal Information including collecting, handling, updating, storing, deleting, sharing, accessing, using, transferring and deletion of Personal information.  

1. Data Protection Principles 

FCSA shall Process Personal Information in compliance with the following data protection principles:

• Transparency and fairness: FCSA shall ensure, where required by Applicable Data Protection Laws, Data Subjects are aware that Personal Information concerning them is collected, used, maintained or otherwise Processed, the purpose for Processing, the period of time FCSA will retain the Personal Information, with whom FCSA may share/disclose the Personal Information, and any applicable Data Subject rights. 
• Lawfulness: FCSA shall only Process Personal Information 
• for compliance with its legal or regulatory obligations
• upon the written consent of the Data Subject, if required by law
• for the establishment, exercise or defense of a legal claim
• for its legitimate business and operational purposes
• to perform the services requested by the Data Subject
• to enter into or perform a contract with the Data Subject
• where otherwise permitted by applicable law 
• Security: FCSA shall implement reasonable and appropriate technical and administrative measures to protect the confidentiality, integrity, availability of Personal Information.  
• Accuracy: FCSA shall ensure the Personal Information it collects, uses, maintains or otherwise Processes is accurate and, where necessary, kept up to date. Data Subjects shall have the right to update, complete, and amend inaccurate or incomplete Personal Information that FCSA maintains, in accordance with Applicable Data Protection Laws.
• Data retention: FCSA shall maintain Personal Information in a form which permits identification of Data Subjects for no longer than is necessary to achieve the purposes for which the Personal Information is Processed, subject to compliance with FCSA’s legal obligations and as necessary for its legitimate business purposes. FCSA shall maintain and implement a data retention schedule, a records management policy, and a data destruction policy to ensure compliance, as necessary. 
• Accountability: FCSA shall adopt effective measures to evidence FCSA‘s compliance with this Policy including maintaining a Personal Data Breach response plan, responding to Data Subject access requests, and providing relevant employee training as required by Applicable Data Protection Laws.  

1. Data Security

FCSA shall adopt reasonable and appropriate measures to safeguard the confidentiality, integrity, availability of the Personal Information it Processes. This includes but is not limited to ensuring the continuous resilience of the systems and services that Process Personal Information and iimplementing: 

• Reasonable administrative and technical controls to safeguard data from unlawful or unauthorized access, use, loss, or destruction 
• Workforce training regarding applicable requirements of this Policy
• Sanctions and enforcement of this Policy
• Personal Data Breach Incident Response Plan (IRP)
• Vendor management to ensure FCSA engages only vendors able to implement appropriate security safeguards to protect FCSA’s Personal Information to which they may have access or Process, and contractually obligates them to do so
• Periodic risk assessments
• Ongoing Policy monitoring and evaluation

1. Data Subject Rights

Where required by Applicable Data Protection Laws, FCSA shall provide notice to Data Subjects of their rights regarding their Personal Information; provide Data Subjects with a mechanism to exercise those rights; implement procedures to timely respond to and document Data Subject requests, and; provide employees with relevant training to recognize and responds to Data Subject requests to exercise rights.

1. Data Retention

FCSA shall retain Personal Information in accordance with FCCSA’s record retention policy and Applicable Data Protection Laws. 

Where the FCSA record retention policy calls for the destruction of Personal Information, such information shall be securely destroyed such that the Personal Information is unreadable or undecipherable prior to discarding it. 

1. Vendor Management and Data Sharing

When FCSA engages a third-party vendor or subcontractor (“third-party”) who will have access to, Process, receive or collect Personal Information on behalf of FCSA, FCSA shall 

• take reasonable steps to verify the third-party has the capacity to protect such Personal Information in accordance with Applicable Data Protection Laws
• contractually ensure the third-party applies security measures at least as stringent as those required to protect the Personal Information in accordance with this Policy and Applicable Data Protection Laws 

Reasonable steps may include one or more of the following:

• reviewing the vendor’s data privacy and security program 
• entering into a stand-alone agreement or adding provisions to the underlying services agreement with the vendor that require safeguarding of such information consistent with Applicable Data Protection Laws

From time to time, FCSA may monitor or inquire about the status of the vendor’s data privacy and security program and, if applicable, compliance with the terms of the agreement entered into. 

1. Personal Data Breach Response

FCSA workforce members shall promptly report to executive Director any suspected or known accidental or unauthorised destruction, loss of access to, alteration, disclosure or access to any Personal Information (“Security Incident”) held by or under the control of (including loss of or damage to equipment containing such data).  

As soon as executive management learns of a suspected or actual Security Incident, he or she shall coordinate such actions as necessary and appropriate to investigate and, if necessary, respond to the Security Incident. This may include: 

• investigating the nature and scope of the Security Incident 
• contacting and coordinating with law enforcement or others, as appropriate
• securing PersonaI Information from further unauthorized access, use, disclosure, modification or destruction
• determining whether the Security Incident constitutes a Personal Data Breach requiring notification
• reasonably mitigating, to the extent practicable, harmful effects of the Security Incident that are known to FCSA, which may include providing Personal Data Breach notification letters in accordance with Applicable Data Protection Laws 
• documenting FCSA’s efforts to investigate and respond to the Security Incident 
• reviewing FCSA’s internal policies and procedures to determine whether modifications or additional policies and procedures could minimize future similar Security Incidents.

1. Training 

FCSA workforce members must be familiar with this Policy and any documents related to data protection developed by FCSA. Each workforce member who Processes Personal Information must attend FCSA training. Training shall be conducted regularly and at least once every 12 months. Workforce members must undergo Personal Information protection and security awareness training during onboarding. 

1. Non-compliance and sanctions

Failure to comply with this Policy may lead to disciplinary actions, including dismissal.

1. Reporting Potential Misconduct 

Any workforce member who is aware of a breach of this Policy or Applicable Data Protection Laws must report it immediately to executive management.

1. Guidance 

Workforce members to whom this Policy applies should consult executive management with any questions about this Policy.

1. Monitoring implementation and effectiveness of Policy. 

FCSA compliance with this Policy shall be periodically monitored and reviewed by Mildred Ramos.