CBHS HEALTH FUND LIMITED PRIVACY POLICY

 

CBHS Privacy Policy

 

1 Scope

1.1 Who we are and what we do

CBHS Health Fund Limited ABN 87 087 648 717 (CBHS) is a restricted-access private health insurer and employer. It provides Insurance Policies or products to Persons who are eligible to become members of CBHS.

1.2 Purpose of this document

This document is CBHS’ privacy policy (Policy). It sets out how CBHS collects Personal Information that is necessary for its functions and activities.

The term “Personal Information” is defined in section 2 (Definitions) below.

The Policy is based on the relevant requirements in:

  1. CBHS’ “Customer First” values;
  2. The Privacy Act (as defined in section 2 (Definitions) below) and its APPs (as defined in section 2 (Definitions) below); 
  3. The privacy legislation of Australian States and Territories; and
  4. The GDPR (as defined in section 2 (Definitions) below).
The terms “APPs”, “GDPR” and Privacy Act are defined in section 2 (Definitions) below.

1.3 When rights under the GDPR apply

The relevant requirements in the GDPR apply to a Person whose Personal Information We Collect while the Person is resident in a EU Country. 

The terms “Collect”, “EU Country”, “GDPR”, “Person” and “Personal Information” are defined in section 2 (Definitions) below.

1.4 Information in this Policy

Our privacy policy is set out under the following headings:

 

2 Definitions

The words in bold in this section have the following meanings in this Policy:

  1. APPs means the Australian Privacy Principles in the Privacy Act.

  2. Collect includes use, disclose, disclosure, holding and Processing of Personal Information. “Collects”, “collecting”, “collected” or “collection” has a corresponding meaning. The terms “Processing” and “Personal Information” are defined below.

  3. Correct includes “rectification” of inaccurate personal data as described in Article 16 of the GDPR. “Correction” or “corrected” has a corresponding meaning. The term “GDPR” is defined below.

  4. De-identify means removing or altering information that identifies a Person or is reasonably likely to identify a Person and includes the meaning of “pseudonymisation” given in Article 4 (5) of the GDPR. The term “Person” is defined below.

  5. Destroy includes “erasure” of personal data as described in Article 17 (1) of the GDPR. “Destroyed” or “destruction” has a corresponding meaning.

  6. EU Country means a current Member State of the European Union.

  7. GDPR means the General Data Protection Regulation (Regulation (EU) 2016/679) of the European Parliament and of the Council.

  8. Health Hub means a CBHS interactive health and wellness assessment centre set up at various locations in Australia, which provides an assessment of a user’s health status. “Health Hubs” has a corresponding meaning.

  9. Information means Personal Information, as defined below, unless the context indicates otherwise.

  10. Insurance Policy means private health insurance policy, Overseas Visitor Health Cover or Overseas Student Health Cover taken with CBHS. “Insurance policies” has a corresponding meaning.

  11. Person means a natural person and includes a “data subject” as described in Article 4 (1) of the GDPR. “Persons” has a corresponding meaning.

  12. Personal Information means information or a statement or opinion about an identified Person (as defined above), or from which a Person is reasonably identifiable. Personal Information includes Sensitive Information (as defined below) and “personal data” as defined in Article 4 (1) of the GDPR.

  13. Policy means this document, unless the context indicates otherwise.

  14. Privacy Act means the Privacy Act 1988 of the Commonwealth Government of Australia.

  15. Processing has the meaning given in Article 4 (2) of the GDPR unless the context indicates otherwise. “Process” or “processed” has a corresponding meaning.

  16. Sensitive Information means Personal Information (as defined above), that is health, wellbeing, biometric, genetic, sexual orientation or practices information or biometric templates. Sensitive  Information includes information of similar nature mentioned in Article 9 (1) of the GDPR.

  17. Supervisory Authority has the meaning given in Article 4 (21) of the GDPR.

  18. You or Your means any Person (as defined above) whose information We (defined below) Collect.

  19. We, Us or Our means "CBHS"  (as identified in section 1.1 (Who we are and what we do) above).

 

3 Individuals whose information we collect

We Collect Information from or about the following persons:

 

4 Types of information we collect

Depending upon Your needs or circumstances or Your relationship with Us, We will Collect the following types of Information:

4.1 General

4.2 Sensitive information

The circumstances in which CBHS collects Sensitive Information, (as defined in section 2 (Definitions) above), includes when You:

Whenever practicable, We will require Your express consent to Collect Your Sensitive Information.

4.3 Visitors to our website

CBHS collects information that is not Personal Information of visitors to Our website, section 11 (Information we collect when you use our website) below. Such information is collected regardless of whether You complete a form from Our website.

 

5 Purposes for which we collect information

5.1 Products and services

We Collect Information (including Sensitive Information) for the purposes of providing, administering and marketing Our products and services. These purposes include: 

5.2 Compliance with laws

We also Collect Information to meet Our compliance and reporting obligations in various Australian Commonwealth Government laws including the:

5.3 Specialised health and wellbeing programs

CBHS develops specialised health and wellbeing programs and initiatives to assist members with day-to-day health and wellbeing issues such as dieting and exercise as well as chronic disease management. 

We use Sensitive Information, as (defined in section 2 (Definitions) above), to identify members who can be enrolled in these programs. Participation in the programs is not mandatory. You may choose to or not to participate in them. If You join a program, You can withdraw from it at any time.

5.4 Consequences if information we ask for is not provided

CBHS has assessed Information it will Collect as reasonably necessary for the purposes set out in sections 5.1, 5.2 and 5.3 above. Your individual needs or circumstances determine the set of Information We will Collect from or about You.

We cannot compel You to provide any Information We ask for. However, in most cases, We will be unable to provide or continue to provide You with Our products or services if You fail or refuse to provide the Information We ask for. Also, if You later withdraw Your consent for Your Information to be handled in accordance with all or some requirements of this Policy, We may not be able to provide or continue to provide You with Our products or services.

 

6 When and how we collect information

CBHS collects Information in the following ways or circumstances.

6.1 Collecting information directly from you

Where practicable, We will Collect Information directly from You, including, when You: 

6.2 Collecting information from someone else

Sometimes, We Collect Information about You from another Person or organisation including in the following circumstances:

If You wish to deal with any Person or organisation we have engaged to act on Our behalf, We strongly advise You to first read their Privacy Policy before providing them Your Information.

 

7 Dealing with us anonymously or using a pseudonym

When You are dealing with Us, and it is lawful and practicable to do so, You can remain anonymous (that is, without providing information that identifies You), or use a pseudonym (that is, use a name, term or descriptor that is different to Your actual name).

Examples of when You can remain anonymous or use a pseudonym are when You:

However, there are many circumstances in which it will not be lawful or practicable for Us to deal with You if you do not provide your actual name. Examples are when You wish to:

If You wish to remain anonymous or use a pseudonym, tell Us at the time and We can confirm whether You can do so in the circumstances.

 

8 Who we disclose information to

The types of persons or organisations We usually disclose Information to are:

AHSA’s privacy policy and contact details can be accessed from the following link: https://www.ahsa.com.au/web/ahsa/privacy_policy.

You can make a privacy breach complaint to the AHSA or ask them for access to or request them to correct the Information they hold about You.

 

9 Disclosing information outside Australia

If business needs require Us to disclose Information to an overseas recipient, We will take all reasonable steps to ensure that the overseas recipient will not breach the APPs, the Privacy Act or the GDPR in relation to the Information.

Other circumstances in which We will disclose Information to an overseas recipient are:

9.1 Managing requests for information to be disclosed overseas

If you request Us to disclose Your Information to an overseas recipient, We will provide You a clear statement explaining the potential consequences of disclosing the Information to the overseas recipient.

 

10 Direct marketing

We or organisations acting for Us may contact You from time-to-time about Our products and services. Such contact may be via regular mail, email, phone or SMS. 

10.1 Request not to be sent direct marketing

You may, at any time, request Us not to send You direct marketing communications. Also, You can request Us to send such communication to You via a preferred channel of communication including by regular mail, email, phone or SMS. You can use any or the following means to make any such request:

 We include in all direct marketing communications, information on how You can request us not to send You such communication in the future. A request will be updated as soon as reasonably practicable after receiving it.

Note that while You cannot opt out of receiving information or notices We are required by law to send to You, You can tell Us how You would like Us to send such information or notices to You.

 

11 Information we collect when you use our website

The CBHS website uses “cookies”. A “cookie” is a packet of information that allows the website server to identify and interact more effectively with Your computer. 

When You use the website, We send a cookie that gives Your computer a unique identification number. Cookies do not identify You, although they enable Us to identify Your browser type and internet service provider. Your browser may be configured to accept all cookies, reject all cookies or notify the user when a cookie is sent. If You reject all cookies, You may not be able to use the CBHS website or the Member Service Centre. 

We use third-party service providers such as Google to undertake demographic analysis of visitors to Our website ('Google Analytics'). We Collect and use information from cookies and Google Analytics to:

By using Our website, You consent to the processing of data about the use of Your computer by Google in the manner described in Google's Privacy Policy and for the purposes set out above. You can opt out of Google Analytics if You disable or refuse the cookie, disable JavaScript, or use the opt-out service provided by Google. 

CBHS also uses interfaces with social media sites such as Facebook. If You choose to "like" or "share" information from this website through these services, You should review the privacy policy of that service. If You are a member of a social media site, the interfaces may allow the social media site to connect Your visits to this site with other Information.

 

12 How we hold and protect information

We primarily store Information in electronic form in information technology systems on Our premises.

To meet legislative, regulatory and business continuity requirements, We store copies of some documents containing Information in remote, secure locations in Australia.

If We convert paper-based documents to electronic form, We destroy the originals securely. Paper-based documents We hold on temporary basis are held securely at Our premises or by third-party document management and mail processing service providers in Australia. 

We maintain physical and operational security over Our paper and electronic data stores. We also maintain computer and network security for Our information technology systems. For example, We use firewalls and other security systems such as user identifiers and passwords to control access to Our information technology systems. 

12.1 Information we no longer need

We destroy or De-identify Information We no longer need.

Under our documents destruction and retention policy, we use the following criteria to determine the period we will keep Information:

12.2 Dealing with information we did not ask for or require

If We receive Information We did not ask for and We determine it is not required for any of Our functions or activities, We will attempt to return it to the sender if it is contained in a document. If We cannot return the document to the sender, or the Information is contained in a voice recording, We will destroy the Information or document securely as soon as reasonably practicable.

 

13 Accessing and requesting correction of your information

13.1 Reasons for seeking access

You can request access to Your Information at any time by using the contact details set out in section 15 (Contacting us about this Policy) below. Your reason for seeking access could be simply to know what information We hold about You, to request a copy the Information, to request its correction or to exercise any right You have under the GDPR, including the rights to request correction, destruction or restriction of Processing of the Information (see section 1.3 (When rights under the GDPR apply) above).

13.2 Request for access to information

When You request access to Your Information, We will first identify You to ensure You are the right Person to be given access to the Information.

Requests for access are actioned as soon as practicable, and in any case within 30 days of receiving the request.

If We refuse to give access to Information, We will give You a written notice setting out Our reasons, Your right to make a complaint about Our refusal and any matter we are required by law to notify You about.

13.3 Fee for providing access

While requests for access to Information are free of charge, administrative fees may be charged for retrieving some types of Information and providing it in the form You have requested. If the circumstances apply in Your case, We will inform You and request payment of the fee before giving You access to the Information.

13.4 Requesting correction of information

If You believe Information We hold about You is inaccurate, out-of-date, incomplete, irrelevant or misleading, You can request Us to Correct the Information at any time by using the contact details set out in section 15 (Contacting us about this Policy). 

13.5 Responding to requests to correct information

We will respond to the request as soon as practicable, in any case within 30 days of receiving it.

If We refuse to Correct Your Information as requested, We will give You a written notice setting out Our reasons (unless it is unreasonable to do so), how You can make a complaint about Our decision and any matter we are required by the law to notify You about.

13.6 Associating a statement if we refuse to correct information

 If We refuse to Correct Your Information, You can ask Us to associate a statement with the Information that You believe the Information is inaccurate, out-of-date, incomplete, irrelevant or misleading. We will respond to the request as soon as practicable, in any case within 30 days of Us receiving the request.

13.7 Notifying others about correction of your information

You may ask as to notify another Person We previously disclosed Your Information to that We have corrected it. We will action Your request as soon as reasonably practicable.

If the GDPR applies to your Information, (see section 1.3 (When rights under the GDPR apply) above), We will notify any such Person as soon as practicable unless this proves impossible or involves disproportionate effort.

 

14 Complaints about your privacy

CBHS has policies and procedures for the handling of members’ complaints including privacy complaints. Information on these is available at: https://www.cbhs.com.au/contact-us/disputes-and-complaints

You may make a complaint about a breach of Your privacy under the Privacy Act or under the GDPR (if the latter applies to You, see section 1.3 (When rights under the GDPR apply) above). You can contact Our Privacy Officer through the contact details set out in section 15.1 (Privacy Officer’s contact details) below. You should first make Your complaint in writing.

Our Privacy Officer will first determine whether, on the information available at this stage, CBHS has breached Your privacy, and if so, take immediate steps to resolve the complaint within 3 days of receiving it.

The Privacy Officer may request additional information from You if the complaint requires more detailed consideration or investigation. In such a case, the Privacy Officer will endeavour to resolve the complaint as soon as reasonably practicable and, in any case, within 30 days.

If You are not satisfied with Our response to Your complaint, You may take the complaint to either the Private Health Insurance Ombudsman (PHIO) or the Office of the Australian Information Commissioner (OAIC). Their contact details are set out below.

14.1 PHIO’s contact details:

Telephone: 1300 362 072 (option 4 for private health insurance)

Online complaint form:

https://forms.business.gov.au/smartforms/servlet/SmartForm.html?formCode=oco-complaint-form

Email: phio.info@ombudsman.gov.au
Address:
The Private Health Insurance Ombudsman

Office of the Commonwealth Ombudsman

GPO Box 442

Canberra ACT 2601

Fax: (02) 6276 0123 

Website: www.ombudsman.gov.au

Additional information:

http://www.ombudsman.gov.au/making-a-complaint/complaints-overview

14.2 OAIC contact details

Email: enquiries@oaic.gov.au
Address:
The Office of the Australian Information Commissioner

GPO Box 5218

Sydney NSW 2001 

Additional information

 http://www.oaic.gov.au/privacy/making-a-privacy-complaint

14.3 Information regulated by GDPR

If Your complaint is based on Information to which the GDPR applies (see section 1.3 (When rights under the GDPR apply) above), You may make a complaint directly to the Supervisory Authority in the relevant EU Country or make the complaint to Our Privacy Officer whose contact details are set out in section 15.1 (Privacy Officer’s contact details) below.

 

15 Contacting us about this Policy

You may contact Us for any reason related to this Policy including, to:

15.1 Privacy Officer’s contact details

Email: privacy@cbhs.com.au

Address: 
Privacy Officer

CBHS Health Fund Limited

Locked Bag 5014

Parramatta NSW 2124

15.2 Other contact details

Phone: 1300 654 123

Fax: (02) 9843 7676

Email: us at help@cbhs.com.au

Complaints: complaints@cbhs.com.au

 

16 Your consent

16.1 Consent required

Whenever practicable, CBHS will obtain Your express consent for Your Information to be collected in accordance with the requirements of this Policy.

16.2 Withdrawal of consent

You may withdraw Your consent to the collection of Your information at any time after giving it in the following circumstances:

16.3 Consequences if you withdraw consent

In some cases, We may not be able to provide You or continue to provide You Our products or services after You have withdrawn Your consent.

Also, if we are required by law or an internal policy to retain Your Information for a period (see section 12.1 (Information we no longer need) above), we will retain the Information for that period after You have withdrawn Your Consent.

16.4 If we refuse your request to withdraw consent

If We refuse to allow You to withdraw Your consent in accordance with section 16.2 (Withdrawal of consent) above, We will provide You our written reasons for the refusal and include information on Your right to make a complaint about Our refusal and any matter We are required by law to inform You about.

 

17 Changing and notifying changes to this Policy

We may review this Policy at any time and notify members of the changes by posting an updated version of the Policy on Our website at: https://www.cbhs.com.au/policies/privacy-policy.

You can request a copy of this Policy free of charge by contacting Us: see section 15.1 (Privacy Officer’s contact details); or section 15.2 (Other contact details) above. If it is practicable to do so, We will provide a copy of the Policy in the form You have requested it.

Public document - Last updated in September 2019