References to “products” or “services” include the provision by Bupa of residential care and accommodation, residential rehabilitation services, retirement villages, medical alarms and any other healthcare related product or service offered by Bupa from time to time.
‘You’, ‘your’ and ‘customer’ refers to current, former or prospective residents, patients or customers of Bupa and includes their representatives.
When you become a customer or resident, or make an enquiry about our products or services, you agree to us handling your personal information (including any use or disclosure) as outlined in this policy. We may change this policy from time to time by making the updated version of this policy available at bupa.co.nz/privacy.
This policy applies to you in addition to any agreement, terms or condition applicable to the Bupa products and services that you obtain from us.
Applicable Privacy Laws means the Privacy Act 1993 and Health Information Privacy Code 1994.
Consent means your permission. Your consent can be express or implied. Express consent can be written (e.g. when you sign a form or send us correspondence) or verbal (e.g. when you give us your permission over the phone or in face-to-face conversations). Your consent will be implied when we can reasonably form a conclusion (for instance, from our pre-existing relationship with you) that you have given consent by either taking action or deciding not to take action.
Personal information means information about an identifiable individual.
3. Information we collect
We will only collect information that is necessary for the purposes of:
- maintaining and administering your customer record, including (where relevant) your clinical record;
- assessing your requirements and needs and how we can best provide you with our products or services;
- providing you with or facilitating the provision of healthcare services or treatments;
- ensuring the integrity and safety of our operations;
- providing our products or services to you;
- promoting our products and services to you and facilitating related companies of Bupa in promoting products and services to you;
- processing, administering and collecting payments from you;
- communicating with you in relation to any matter relating to you or any of the products or services provided to you;
- carrying out internal functions including (but not limited to) administration, accounting, audits, quality assurance, compliance and risk management, information technology and internal reporting;
- monitoring price and evaluating products and services;
- resolving complaints and reporting on complaints internally for management reporting purposes; and
- fulfilling our sales and marketing promotions;
- conducting analysis, surveys and research;
- complying with our legal obligations.
We will only collect your personal information by lawful and fair means and not in a way that may be unreasonably intrusive.
The amount and type of personal information we collect from you and hold about you will vary depending on whether you are an existing customer, have made enquiries about our products and services and also the extent to which you have used our products and services.
If you have purchased products or services from Bupa, the personal information that we hold about you may include:
- your name, address, telephone and email contact details;
- personal details such as age and gender;
- your National Health Index (NHI) number (where this information is required for one for the purposes for which the NHI number was assigned);
- records of service contacts you’ve had with us;
- census and statistical information for purposes including product development and risk assessment
- financial information (for example, payment and billing details);
- details of purchases made and professional services used, including the date;
- medical history;
- health information and records, including health assessments; and
- contact details of your next of kin, representative(s) or others acting on your behalf.
4. How Bupa collects your information
We may collect personal information directly from you in a number of ways, including:
- when you first apply to become a customer;
- when you provide information through the contact forms on our website;
- when you subscribe to newsletters or other direct marketing materials; or
- you may complete forms, send us an email, provide information during a visit to a Bupa facility or by phone;
- when your health status is assessed; and
- when we provide care and services to you in the course of your residential care stay.
We will always try to collect information from you directly. But in some circumstances we may also collect your information from third parties, including from:
- your representative, or any person you have authorised to act on your behalf;
- healthcare practitioners who are involved in your care (with your consent); and
- government agencies such as including District Health Boards, the Accident Compensation Corporation (ACC) and the Ministry of Health (with your consent).
If you have provided us with information about another person, then you must comply with your obligations under Applicable Privacy Laws, for instance, you may need to tell that other person that you have done so, that they have a right to access their information and that we will handle their personal information in accordance with this policy.
If you do not provide us with the personal information we reasonably request, we may be unable to provide you with the products or services that you are requesting.
5. How Bupa uses or discloses your personal information
5.1 Use or disclosure of personal information
5.2 Disclosure of personal information
As part of operating our business, Bupa may disclose your personal information on a confidential basis to our related companies within the Bupa Australia and New Zealand Group of companies and the global Bupa Group of companies (including our ultimate parent company, the British United Provident Association Limited, located in the United Kingdom).
In the course of our operations, we may also disclose your personal information to third parties, in a manner consistent with the purposes for which it was collected, including to:
- your authorised nominated representative(s) or any person acting on your behalf;
- government, statutory supervisors and regulatory bodies including District Health Boards, the Accident Compensation Corporation (ACC) and the Ministry of Health;
- auditors and other service providers we may appoint to ensure the integrity and clinical safety of our operations or any other person or entity engaged by us or acting on our behalf. In this case any person or entity will be contractually bound to use any personal information shared with them only to perform the services they have been hired to provide for our benefit;
- healthcare providers involved in your treatment or care;
- third party health benefit providers and insurance companies to assist in the processing of a claim for reimbursement or payment of all or part of the cost of treatment submitted by you or on your behalf; and
- any court, government agency, tribunal or other person or entity where disclosure is required or permitted by law, including in legal proceedings.
If we send your personal information outside of New Zealand, we require that the recipient of the information to comply with privacy laws and contractual obligations that are at least the same as any Applicable Privacy Laws to maintain the privacy and security of your information.
5.3 Direct marketing
From time to time, we may contact you to provide you with information about other products and services offered by us, our related entities and our business partners that may be of benefit to you and your family. When we contact you for these purposes, it may be via mail, phone, email, fax, social media or SMS.
We may share your personal information on a confidential basis with our related companies, business partners and third parties engaged by us so that they can offer you products and services and fulfil offers to you.
When you become our customer, you consent to Bupa using your personal information for direct marketing purposes (as described in this policy), including for data analytics and related activities that may help us improve our products and services and how we deliver these to you.
If you do not wish to be contacted by Bupa for marketing purposes you can contact us at any time to let us know. Our contact details are at the end of this policy. If you request not to receive marketing material, please note that we will still contact you in relation to our on-going relationship with you. For example, we will still send you any bills, statements and notices that are relevant to the products and services you have purchased from us.
If you contact us to make an enquiry, we may store your personal information and contact you in the future for direct marketing purposes.
6. Storage and security of your information
We will protect the security of your personal information using such security safeguards as are reasonable in the circumstances in relation to the security and storage of your information, and to prevent unauthorised use or disclosure of your information. We maintain data security standards, policies and procedures.
We keep your personal information for as long as it is required to provide you with the services and products you requested from us and to comply with legal requirements.
If we no longer require your personal information for any purpose, including legal purposes, we will take reasonable steps to securely destroy or de-identify your personal information except in circumstances where we are permitted or required by law to keep it. In the case of health information, we will retain your information for a minimum of 10 years from the most recent time we provided health services to you.
7. Accessing, updating and correcting your information
7.1 Access to personal information
You have the right to ask what personal information Bupa holds about you and to request access to that information. You can ask us for access to the information that we hold about you at any time. Simply contact us (our contact details are listed below) to make your request.
We will always endeavour to meet your request for access within a reasonable time and in the manner requested by you if it is reasonable to do so. However in some circumstances, access to certain information may be declined, as permitted by Applicable Privacy Laws. For example, this includes, but is not limited to, circumstances where:
- we no longer hold the information;
- disclosing the information would involve unwarranted disclosure of the affairs of another individual; and
- disclosure would be likely to endanger the safety of any individual.
If we are unable to give you access to the information you have requested, we will give you written reasons for this decision when we respond to your request.
We may charge you a reasonable fee for access to some types of information. This charge will be limited to the cost of recouping our costs for providing you with the information. For example, document retrieval, photocopy, labour and delivery to you. We will not charge you to make a request to access your information.
7.2 Correcting or updating your personal information
To enable us to provide you with the best possible service, it is important that the information we hold about you is accurate. If your details change, it is your responsibility to contact Bupa to notify us of any changes and we will not be liable for any loss or damage you suffer as a result of failing to notify us of changes to your information.
We will take reasonable steps to ensure that your personal information is accurate, complete, up-to-date and not misleading at the time of using it. If you believe any information we hold about you is inaccurate, incomplete, out-of-date or misleading, you should contact us to let us know. We will respond to your request within a reasonable period and will take reasonable steps to amend your records if appropriate. If we decline to or are unable to provide you with the requested correction, we will notify you of our reasons for declining to do so and at your request take reasonable steps to attach a statement to your personal information setting out that you have requested that the information be corrected.
8. Website Security
Our website does not provide facilities that guarantee secure transmission of information over the internet. You should be aware that there are risks in transmitting information across the internet, including online forms and email. If you are concerned about conveying sensitive or personal material to us over the internet, contact us by telephone to discuss the matter.
Our website contains links to other websites. You should take care in providing personal information to external websites linked to our website. We are not responsible for the privacy practices of other websites or external websites linked to this website.
We collect standard web server/visitor traffic information, commonly referred to as aggregate information, regarding overall website traffic patterns. Normally, web servers collect this type of basic information as part of their web log processes. We only use this information for statistical, reporting and website administration and maintenance purposes. It is not used in a way that individually identifies you, and we do not report on individual users.
A cookie is a block of data that is shared between a web server and a user's browser. Cookies give the server information about a user's identity and website visiting patterns and preferences. You can find more information about cookies at the Microsoft website.
10. How to contact us
You can contact us at any time if you have any questions or concerns about this policy, about how your personal information has been handled, or if you would like to request access to any personal information we hold about you.
You can contact us by calling us on 0800 608 099 or via email firstname.lastname@example.org. If your query relates to the handling of your personal information by a Bupa Care Home, you should contact the Privacy Officer at that Care Home. The contact details for our Care Homes are available at bupa.co.nz/care-homes/.
Bupa will manage any concerns internally, directly with you.
If you are not happy with our response, or if you do not feel your complaint has been resolved, you are able to seek advice from the New Zealand Office of the Privacy Commissioner on 0800 803 909 or by visiting privacy.org.nz.