In this privacy policy, ‘we’, ‘us’, ‘our’ ‘Bupa’, refers to Bupa Care Services NZ Limited (NZCN 1662622) and its related entities and bodies corporate. Bupa is part of the Bupa Asia Pacific Group of companies, and part of the global Bupa Group of companies.
References to “products” or “services” include the provision by Bupa of residential care and accommodation, retirement villages and any other healthcare related product or service offered by Bupa from time to time.
‘You’, ‘your’ and ‘customer’ refers to current, former or prospective residents, patients or customers of Bupa and includes their representatives.
We may collect, hold and use your personal information in accordance with this Privacy Policy.
1. About this Privacy Policy and how it applies to you
Your privacy and maintaining the confidentiality of your personal information is important to us. We are committed to safeguarding your personal information. This privacy policy explains how:
- we collect, store, use, handle and protect your personal information;
- your personal information may be disclosed to third parties;
- your rights for requesting access to or amending your personal information; and
- you can provide us with feedback or make a complaint.
We collect and hold personal information about:
- Current, potential and former customers or resident, and their families and other representatives;
- Service providers, suppliers and their employees and contractors
- Funders, district health boards, government agencies and their employees or contractors;
- Current and prospective employees and contractors of Bupa, and their next of kin or emergency contacts;
- Individual we deal with in the course of carrying on our business; and
- Other people who come in contact with Bupa.
By making an enquiry about our products or services, supplying products or services to us or interacting with us you agree to us handling your personal information (including any use or disclosure) as outlined in this policy. We may change this policy from time to time by making the updated version of this policy available at bupa.co.nz/privacy.
This policy applies to you in addition to any terms applicable to the Bupa products and services that you obtain from us, products or services you supply to us or any other contractual arrangement or understanding.
2. Definitions
applicable privacy laws mean the Privacy Act 2020 and Health Information Privacy Code 2020.
consent means your permission. Your consent can be express or implied. Express consent can be written (e.g. when you sign a form or send us correspondence) or verbal (e.g. when you give us your permission over the phone or in face-to-face conversations). Your consent will be implied when we can reasonably form a conclusion (for instance, from our pre-existing relationship with you or where you contact us) that you have given consent by either taking action or deciding not to take action.
government agencies include any ministry, government department, or other crown entity, such as District Health Boards, the Accident Compensation Corporation (ACC), the Ministry of Health and Ministry of Social Development
personal information means information about an identifiable individual.
3. Information we collect
We collect your personal information in order to manage and conduct our business, to provide and market our services and to meet our legal obligations. This will be by lawful and fair means and not in a way that may be unreasonably intrusive.
The amount and type of personal information we collect from you and hold about you will vary depending on whether nature of our relationship with you.
The personal information that we hold about you may include:
- your name, address, contact details and documents that verify your identity and other personal details;
- personal details and diversity information such as date of birth, gender, ethnicity, languages spoken, relationship status, religious beliefs, affiliations, tax status and citizenship or residency details;
- records of service contacts you’ve had with us or which we create in the course of our relationship with you, including purchases made and services used;
- census and statistical information for purposes including product development and risk assessment;
- financial information (for example, payment and billing details) and tax information (for example, IRD and GST numbers and tax payments);
- medical history, health information and records, including health assessments and treatment plans;
- any other information which assists us in conducting our business, providing and marketing our services, receiving products or services from you and meeting our legal obligations.
For prospective or current residents, this will include information collected as part of the application process and to enable us to provide our products and services. This may include:
- details of your family medical history;
- your NHI number;
- name and contact details of your family/whānau, visitors, next of kin, representative(s), emergency contacts and others acting on your behalf or others acting on your behalf. We may also collect copies of any relevant enduring powers of attorney or court orders; and
- any relevant details relating to your residence at our facilities. For current or prospective staff members, contractors, suppliers, funders and government agencies this may include information for the purpose of conducting a business, employment, regulated or other relationship with you. This may include:
- information about your occupation, employment history, education and suitability for the role or relationship, including criminal history and social media profiles;
- name and details of emergency contacts;
- information about your performance in the role or relationship.
4. How Bupa uses your information
We will only collect information that is necessary for the purposes of:
- communicating with you;
- to conduct our business, including entering into supplier, funding and other contracts;
- providing and helping us manage and improve our products and services;
- providing you with our products or services, including verifying your identity;
- subject to your consent (in accordance with the Unsolicited Electronic Messages Act 2007), to market and promote our products and services to you, including contacting you electronically (e.g. by text or email);
- ensuring the integrity, safety and security of our operations;
- to process, administer, collect payments form or make payment to you and, if applicable, make appropriate tax deductions, including through third party debt collection agencies or conducting credit checks;
- carrying out internal functions including administration, employment processes, accounting, audits, credit checks, quality assurance, compliance and risk management, information technology and internal reporting;
- resolving complaints and reporting on complaints internally for management reporting purposes;
- conducting data analysis, surveys and market research;
- complying with our legal obligations, including protecting and/or enforcing our legal rights and interests.
For prospective and current residents:
- to assist you to apply and to live in our villages and care homes;
- assessing your requirements and needs and how we can best provide you with our products or services; and
- providing you with or facilitating the provision of healthcare services, treatments or care, including maintaining your records and assessing your requirements and needs.
For current or prospective staff members, contractors, suppliers, funders and government agencies:
- to assess your suitability, performance or management;
- to manage and meet contractual and statutory obligations;
- to purchase goods and services; and
- to receive funding.
In addition, CCTV footage specifically may be used for the following purposes:
- detecting and deterring criminal or inappropriate behaviour on our premises;
- monitoring the safety and security of our staff, residents, contractors and visitors, and completing incident investigations; and
- reviewing the actions of any person at any of our site, including our staff, contractors or visitors.
5. How Bupa collects your information
We will always try to collect information from you directly. But in some circumstances, we may also collect your information from:
- you indirectly (including through the enquiry about or use of services and facilities, including through our websites and social media channels);
- your representative, or any person you have authorised to act on your behalf;
- healthcare practitioners who are involved in your care (with your consent); or
- government agencies (with your consent)
- from current, potential and former residents, residents’ families/whanau, service providers, suppliers and their employees, contractors or agents and individuals we deal with in the course of our business;
- third parties used to analyse traffic at our websites and social media channels or the use of cookies.
- an employment reference, recruitment and labour hire company;
- from publicly available sources, including websites;
- from CCTV cameras that may be placed on our premises.
If you have provided us with information about another person, then you must comply with your obligations under applicable privacy laws, for instance, you may need to tell that other person that you have done so, that they have a right to access their information and that we will handle their personal information in accordance with this policy.
If you do not provide us with the personal information we reasonably request, we may be unable to provide you with the products or services that you are requesting.
6. How Bupa discloses your personal information
6.1 Accuracy of personal information
Before we use or disclose your personal information in accordance with the purposes of this Privacy Policy, we will take all reasonable steps (if any) to ensure that the information is accurate, up to date, relevant and not misleading.
6.2 Disclosure of personal information
As part of operating our business, Bupa may disclose your personal information on a confidential basis to our related companies within the Bupa Australia and New Zealand Group of companies and the global Bupa Group of companies (including our ultimate parent company, the British United Provident Association Limited, located in the United Kingdom).
In the course of our operations, we may also disclose your personal information to third parties, in a manner consistent with the purposes for which it was collected, including to:
- your authorised nominated representative(s) or any person acting on your behalf;
- government agencies, statutory supervisors and regulatory bodies;
- auditors and other service providers we may appoint to ensure the integrity and clinical safety of our operations or any other person or entity engaged by us or acting on our behalf. In this case any person or entity will be contractually bound to use any personal information shared with them only to perform the services they have been hired to provide for our benefit;
- healthcare providers involved in your treatment or care;
- third party health benefit providers and insurance companies to assist in the processing of a claim for reimbursement or payment of all or part of the cost of treatment submitted by you or on your behalf;
- any business that supports our products and services, including any person that hosts or maintains any underlying IT system or data centre that we use to provide website or other services or products;
- any credit reference agency for the purpose of credit checking you or debt collection agency;
- any person or agency involved in any complaint or dispute, including any retirement village, health and disability, contractual or employment disputes process; and
- any court, government agency, tribunal or other person or entity where disclosure is required or permitted by law, including in legal proceedings.
If we send your personal information outside of New Zealand, we require that the recipient of the information to comply with privacy laws and contractual obligations that are at least the same as any applicable privacy laws to maintain the privacy and security of your information.
6.3 Marketing
From time to time, we may contact you to provide you with information about other products and services offered by us, our related entities and our business partners that may be of benefit to you and your family. We will obtain your consent before we contact you using an electronic message.
We may share your personal information on a confidential basis with our related companies, business partners and third parties engaged by us so that they can offer you products and services and fulfil offers to you.
When you become our customer, you consent to Bupa using your personal information for marketing purposes (as described in this policy), including for data analytics and related activities that may help us improve our products and services and how we deliver these to you.
If you do not wish to be contacted by Bupa for marketing purposes, you can contact us at any time to let us know. Our contact details are at the end of this policy. If you request not to receive marketing material, please note that we will still contact you in relation to our on-going relationship with you. For example, we will still send you any bills, statements and notices that are relevant to the products and services you have purchased from us.
If you contact us to make an enquiry, we may store your personal information to contact you in the future in relation to the product or service you enquired about.
7. Storage and security of your information
We will protect the security of your personal information using such security safeguards as are reasonable in the circumstances in relation to the security and storage of your information, and to prevent unauthorised use or disclosure of your information. We maintain data security standards, policies and procedures.
We keep your personal information for as long as it is required to provide you with the services and products you requested from us and to comply with legal requirements.
If we no longer require your personal information for any purpose, including legal purposes, we will take reasonable steps to securely destroy or de-identify your personal information except in circumstances where we are permitted or required by law to keep it. In the case of health information, we will retain your information for a minimum of 10 years from the most recent time we provided health services to you.
8. Accessing, updating and correcting your information
8.1 Access to personal information
You have the right to ask what personal information Bupa holds about you and to request access to that information. You can ask us for access to the information that we hold about you at any time. Simply contact us (our contact details are listed below) to make your request.
We will always endeavour to meet your request for access within a reasonable time and in the manner requested by you if it is reasonable to do so. However, in some circumstances, access to certain information may be declined, as permitted by Applicable Privacy Laws. For example, this includes, but is not limited to, circumstances where:
- we no longer hold the information;
- disclosing the information would involve unwarranted disclosure of the affairs of another individual; and
- disclosure would be likely to endanger the safety of any individual.
- If we are unable to give you access to the information you have requested, we will give you written reasons for this decision when we respond to your request.
We may charge you a reasonable fee for access to some types of information. This charge will be limited to the cost of recouping our costs for providing you with the information. For example, document retrieval, photocopy, labour and delivery to you. We will not charge you to make a request to access your information.
8.2- Correcting or updating your personal information
To enable us to provide you with the best possible service, it is important that the information we hold about you is accurate. If your details change, it is your responsibility to contact Bupa to notify us of any changes and we will not be liable for any loss or damage you suffer as a result of failing to notify us of changes to your information.
We will take reasonable steps to ensure that your personal information is accurate, complete, up-to-date and not misleading at the time of using it. If you believe any information, we hold about you is inaccurate, incomplete, out-of-date or misleading, you should contact us to let us know. We will respond to your request within a reasonable period and will take reasonable steps to amend your records if appropriate. If we decline to or are unable to provide you with the requested correction, we will notify you of our reasons for declining to do so and at your request take reasonable steps to attach a statement to your personal information setting out that you have requested that the information be corrected.
9. Website Security
Our website does not provide facilities that guarantee secure transmission of information over the internet. You should be aware that there are risks in transmitting information across the internet, including online forms and email. If you are concerned about conveying sensitive or personal material to us over the internet, contact us by telephone to discuss the matter.
Our website contains links to other websites. You should take care in providing personal information to external websites linked to our website. We are not responsible for the privacy practices of other websites or external websites linked to this website.
We collect standard web server/visitor traffic information, commonly referred to as aggregate information, regarding overall website traffic patterns. Normally, web servers collect this type of basic information as part of their web log processes. We only use this information for statistical, reporting and website administration and maintenance purposes. It is not used in a way that individually identifies you, and we do not report on individual users.
10. Cookies
We use cookies on our website, but only for the operation of the website. We do not use cookies to capture any personal information such as name, phone, passwords etc. The types of information captured by cookies may include the user's server address, the user's operating system, the date, time and duration of the visit and the type of internet browser used.
A cookie is a block of data that is shared between a web server and a user's browser. Cookies give the server information about a user's identity and website visiting patterns and preferences. You can find more information about cookies at the Microsoft website.
11. How to contact us
You can contact us at any time if you have any questions or concerns about this policy, about how your personal information has been handled, or if you would like to request access to any personal information we hold about you.
You can contact us by calling us on 0800 00 09 74 or via email info@bupa.co.nz. If your query relates to the handling of your personal information by a Bupa Retirement Village or Care Home, you should contact the Privacy Officer at that Village or Care Home.
The contact details for our Care Homes are available at bupa.co.nz/care-homes/.
Bupa will manage any concerns internally, directly with you. If you are not happy with our response, or if you do not feel your complaint has been resolved, you are able to seek advice from the Office of the Privacy Commissioner on 0800 803 909 or by visiting privacy.org.nz.