Our promise to you is that 'When you need us, we're there'. In order to fulfil that promise, and to provide you with suitable products and services, we need to get to know you and what your needs are.

This means that we collect certain information about you in the course of operating our business. This notice sets out details of the information that we collect, how we process it and who we share it with. It also explains your rights under data protection law in relation to our processing of your data.

Vhi Insurance DAC, whose registered address is Vhi House, Lower Abbey Street, Dublin 1, is the company that controls and is responsible for personal data that is collected in relation to our health insurance products. If you have any queries in relation to the processing of your personal data, we have appointed a data protection officer that you can contact as follows: by post at Data Protection Officer, Vhi, Vhi House, Lower Abbey Street, Dublin 1 or by email at dataprotection@vhi.ie. 

In order to provide our services to you we need to process certain personal data in relation to you, which includes:

·         Biographical data – We collect the following biographical data: name, assumed names, address, phone number, email address, gender, family relationships (e.g. spouse/partner, family members including children), date of birth, PPS number, and if you are a student or in college.

·         Payment data – if you pay by direct debit or receive payments through electronic funds transfers, we will collect the IBAN, BIC and the name of your bank/building society or your credit card details where relevant.

·         Claims data – if you make a claim we will process details of your medical history, details of services claimed, treatment dates, payments made, details of other insurance that may cover aspects of your claim, and the original or copy receipts that you submit in support of your claims. If necessary we will access further medical information/ medical records relating to your claim.

·         Interactions with us – if you interact with us we will record details of those interactions (e.g. phone calls and logs of phone calls, email correspondence and hard copy correspondence).  If you make a complaint we will process details in relation to that complaint.

·         Online services - when you interact with us online (by computer, tablet or smartphone), you will often provide personal data to us, which you will be aware of when using the services or for which you give consent. We also automatically collect data about your use of our services, such as the type of device you are using and its IP address, and how you interact with the services.  Further details are available in the cookies policy and/or the Data Protection Statement that accompanies the relevant service.

·         Claims data – where you also hold a Vhi Dental policy and where you have made a Dental claim that has a shortfall that may be covered by your Vhi Insurance private health insurance policy, in some eligible circumstances we will process personal data received from the Vhi Dental policy provider relating to that Claim in order to pay eligible benefits under your Vhi Insurance private health insurance policy.

Most of your personal data that we collect will be provided by you through our application forms, claims forms and your interactions with us.  However, certain information may be provided by third parties on your behalf, including the following:

·         Group schemes or insurance broker – many members avail of our services through a group scheme or insurance broker that is operated by their employer or insurance broker.  In order to sign you up as a member your employer or insurance broker may give us certain details, such as your name, address, gender, date of birth, contact details, details of dependants that will be included on a policy, their relationship to the Policyholder, previous insurance details, employee and group scheme number and PPS number. This information may be provided electronically.

·         Dependants – if you are covered on a policy, the policyholder may have provided us with certain details, such as your name, address, gender, date of birth, contact details, relationship to the policyholder, previous insurance details and PPS Number, this could also include names and dates of birth of children that may not be a dependant of the policy holder e.g. grandchildren.

·         Hospital and primary care providers – if you are making a claim or using one of our services, you have probably had some interactions with a hospital or primary care provider.  We have arrangements with these entities under which they provide us with details of the services that you have received, so that we can properly assess and process your claim. Details may be provided electronically.

·         Online services – when you access our online services we will collect the information that you provide to us online. We will also automatically collect certain data in relation to your use of our services, such as the type of device you are using and its IP address and how you interact with the services.

·         Other insurers – we may receive your personal data from other insurers to verify your previous insurance details as well as for other regulatory reasons. In some limited circumstances we may receive your personal data from the insurer of the Vhi Dental policy in order to pay shortfalls which may be covered by the Vhi Insurance private health insurance policy. This will be on the basis that it is necessary and proportionate for the purposes of administering your health insurance policy.

We process your personal data in order to provide you with our services and to assist us in the operation of our business.  Under data protection law we are required to ensure that there is an appropriate basis for the processing of your personal data, and we are required to let you know what that basis is. 

There are various options under data protection law, but the primary bases that we use are (a) processing necessary for the performance of our contracts with you, (b) processing necessary in order for us to pursue our legitimate interests, (c) processing where we have your and/or your dependants’ consent, (d) processing that is required under applicable law, and (e) we process health related data using Section 50 of the Data Protection Act 2018.

Here are further details of our processing of your personal data below, together with the basis for that processing:

• Administering your policies – We will process your personal data in order to administer your policy.  This includes processing your personal data in order to make and receive payments, and to maintain our records of the insurance products that you have purchased.  Where we process your personal data in order to administer your policy this will be on the basis that it is necessary in order for the performance of our contract with you.
• Providing you with quotes – We will process your personal data in order to provide you with a quote for insurance and to provide communications regarding this quote. Where we process your personal data in order to provide you with a quote this will be on the basis that it is necessary for the performance of our contract with you or to process this data at your request prior to entering into a contract.
• Providing you with services - Vhi provides different channels to engage with you in order to perform our contractual obligations, including where you have opted to avail of electronic channels such as MyVhi, our mobile app and Snap and Send. The MyVhi section of our website, and our mobile applications, give you access to your policy documents and information in one secure place, anytime, anywhere.  We also provide a Snap and Send feature that allows you to send us your day to day receipts on the go. Where we process health related claims data in the context of providing these services, this will be on the basis that it is necessary and proportionate for the purposes of providing health insurance policies as part of our business.
• Processing claims – In order to process a claim that you make under a policy we will need to process personal data in relation to the claim.  This includes the underlying medical condition that is treated, your medical history, the medical services that you receive and details of previous policies you may have had (in order to calculate waiting periods and determine coverage for pre-existing conditions).  We will also need to process your personal data in order to deal with queries about your level of cover, to highlight benefits under your policy that are most relevant to you, for pre-certification/approval of treatment, or to deal with complaints from you or a medical services provider. To process health related data we use Section 50 of the Data Protection Act 2018. When we process a claim on a child under the age of 18 years of age that is insured on your policy, we will communicate with the policyholder in relation to that claim, if the child turns 18 during the processing of that claim we will continue to communicate with the policyholder for the duration of the claim.  
• If your claim is successful, we will process your personal data in order to refund you fees that you may have incurred or pay the medical services provider.  Where we process health related claims data, this will be on the basis that it is necessary and proportionate for the purposes of administering your health insurance policy.
• Running our business – Like all insurance companies it is essential to ensure that we can manage the costs of claims and determine what treatments and services each of our policies can cover. In order to do this we undertake extensive modelling of the current and historic claims made by our customers, which we use to identify patterns in claims, to try to predict future trends and how they might affect our business, and to undertake pricing and profitability and studies. This information may be used to help us develop new product benefits and services.  We also carry out auditing and quality control to check that our processes are robust and are being followed.  In addition, we also need to process your data to meet certain regulatory and legislative obligations that apply to our business.
• We try to do all of the above by using aggregated or anonymous data where possible, so you won’t be identifiable from the data, but some of this work involves processing your data without anonymising it. Where we process health related claims data, this will be on the basis that it is necessary and proportionate for the purposes of providing health insurance policies as part of our business.
• Marketing – We may send you marketing communications about our products and services that are relevant to you and which would be in the legitimate interest of Vhi. You can opt out of these marketing communications at any time by contacting us using the contact details at the bottom of this notice or using the contact details at the bottom of each marketing communication.
• Where we process any health related data in relation to you for marketing communications, this will be based on consent. This consent is completely optional and you are free to withdraw your consent at any time.
• We also undertake market research and surveys, which provide us with market insights and measure patient experience. This helps us to advocate for an improved health system by measuring patient experience, and while we try to carry out this process using aggregated or anonymous data, in order to measure the success of these campaigns we may process your personal data.
• Fraud prevention and claims management – It is an unfortunate feature of any insurance and health systems that fraud can occur from time to time. We have a number of systems and procedures in place to monitor for potentially fraudulent claims, or claims for inappropriate treatments and procedures. If we identify a suspicious claim or pattern of claims, we will process your personal data in order to investigate the claim and to take appropriate measures to protect Vhi and its members and on occasion this may require further access to medical information/medical records. Where we process health data in connection with fraud prevention and claims management, this will be on the basis that it is necessary and proportionate for the purposes of administering your health insurance policy. If your part of a company paid group scheme and your policy is cancelled we will notify your company that the policy has been cancelled.
• Administering our computer systems – Vhi relies on state of the art technology and computer systems to run our business and to process claims.  We have an extensive team of developers and support engineers who are constantly testing our systems, running trials of new software, and providing support to our users.
• Where possible we try to use test data or anonymised data, but on occasion we may have to access live data directly, or we will often make a copy of some of the data that sits in our live systems and run our tests on that to make sure everything is working before we roll out a change.  These copies may include your personal data, including details in relation to claims you have made.  In general this processing of your personal data is justified by our legitimate interests in making sure our computer systems run properly and are safe and secure.  If we process health data when running these tests or providing support services to our users, this will be on the basis that it is necessary and proportionate for the purposes of providing health insurance policies as part of our business.

In order to process certain personal data in relation to you, (which may include health data), for certain purposes such as surveys, direct marketing, we may need to get your consent. When we process your personal data on the basis of your consent, you are free to withdraw that consent at any time. You can withdraw your consent by contacting us using the contact details at the bottom of this notice. Please note that if you withdraw your consent we may not be able to continue providing you with the service to which the consent related.

We require certain information from you in order to be able to enter into a contract with you and to provide you with our services. Where this is the case we will indicate on relevant forms what personal data is required in order to enter into the contract with you. If you do not provide the information, we will not be able to provide you with our services.

When we receive a claim we want to make sure that we process it as quickly as possible. We have therefore developed a system that undertakes an initial assessment of your claim automatically. Most of the time the system will be able to identify that a claim should be paid out, at which point the claim is then processed automatically. The algorithms we use for automated processing are simply the Terms and Conditions and Table of Benefits relevant to your plan, written into software code. Each claim is then assessed under the rules relevant to the treatment/procedure in question along with the information you have provided (the invoices, receipts etc.). If your claim is rejected through automated processing we will always send you the reason in plain English that reflects the relevant rule under your Terms and Conditions and/or Table of Benefits that triggered the rejection. The explanation provided would be the same as if the claim had been manually adjudicated, because the same software coding is used for manual adjudication on our systems. If the rejection occurred because we need you to provide some further information to us we will explain exactly what we need and you can then re-submit your claim accordingly. Also, you always have the right to object or appeal a claims decision by contacting us at either of the following:

Post: Vhi Healthcare, IDA Business Park, Purcellsinch, Dublin Road, Kilkenny.

Phone: (056) 444 4444 

We share your personal data with the following third parties:

• Hospitals and primary care providers - we will provide hospitals and primary care providers with information that allows them to verify your current level of cover.
• Service providers - We rely on trusted third parties to help us run the Vhi business and to provide us with specialised services. These can include companies that provide IT services (e.g. scanning and uploading letters from customers and hosting data when providing software services). These can also include legal advisors, accountants and consultants. Where our service providers have access to your personal data, we ensure they are subject to appropriate contracts and other safeguards.
• Group schemes and insurance brokers - Many members avail of our services through a group scheme that is operated by their employer or an insurance broker. In order to administer your policy Vhi may exchange certain details, such as your name, address, gender, date of birth, contact details, details of dependants that will be included on a policy, their relationship to the Policyholder, previous insurance details, employee and group scheme number and PPS number. This information may be provided electronically.
• Regulators - In certain circumstances Vhi is obliged to provide information to a regulator, (e.g. in the investigation of complaints).
• Group companies - Vhi consists of a number of separate companies. Some of these companies provide services to each other which may involve the sharing of your personal data between one or more group companies.
• Other insurers - We may share your personal data with other insurers in order to verify your level of cover as well as for other regulatory reasons.

There are certain circumstances where we will transfer your personal data outside of the EEA to a country which is not recognised by the European Commission as providing an equivalent level of protection for personal data as is provided for in the EEA. If we transfer your personal data outside of the EEA please rest assured that we will ensure that appropriate measures are in place to protect your personal data and to comply with our obligations under applicable data protection law. This may mean that we enter into contracts in the form approved by the European Commission, or use such other GDPR compliant transfer mechanisms that may be approved from time to time. If you would like further details about the measures we have taken in relation to the transfer of your personal data, or copies of the agreements that we have put in place in relation to the transfers, please contact us using the details at the bottom of this notice.

Vhi will retain your personal data in accordance with our record retention policy. This policy operates on the principle that we keep personal data for no longer than is necessary for the purpose for which we collected it. It is also kept in accordance with any legal requirements that are imposed on us. This means that the retention period for your personal data will vary depending on the type of personal data. For further information about the criteria that we apply to determine retention periods please see below:

• Statutory and regulatory obligations - As we work in a highly regulated industry, we have certain statutory and regulatory obligations to retain personal data for set periods of time.
• Managing legal claims - When we assess how long we keep personal data we take into account whether that data may be required in order to defend any legal claims which may be made. If such data is required, we may keep it until the statute of limitations runs out in relation to the type of claim that can be made (which varies from 2 to 12 years).
• Business requirements - As we only collect personal data for defined purposes, we assess how long we need to keep personal data for in order to meet our reasonable business purposes.

You have various rights under data protection law, subject to certain exemptions, in connection with our processing of your personal data:

• Right to access the data - You have the right to request a copy of the personal data that we hold about you, together with other information about our processing of that personal data.
• Right to rectification - You have the right to request that any inaccurate data that is held about you is corrected, or if we have incomplete information you may request that we update the information such that it is complete.
• Right to erasure - You have the right to request us to delete personal data that we hold about you. This is sometimes referred to as the right to be forgotten.
• Right to restriction of processing or to object to processing - You have the right to request that we no longer process your personal data for particular purposes, or to object to our processing of your personal data for particular purposes.
• Right to data portability - You have the right to request us to provide you, or a third party, with a copy of your personal data in a structured, commonly used machine readable format.
• In order to exercise any of the above rights, please contact us using the contact details set out below.

If you have any queries or complaints in connection with our processing of your personal data, you can get in touch with us using the following contact details:

• Post: Data Protection Officer, Vhi, Vhi House, Lower Abbey Street, Dublin 1
• E-Mail: dataprotection@vhi.ie

You also have the right to lodge a complaint with the Data Protection Commission (DPC) if you are unhappy with our processing of your personal data. Details of how to lodge a complaint can be found on the dataprotection.ie website by selecting the appropriate webform, or by writing to the DPC at Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2. DO2, RD28, Ireland

Find here 

In order to provide you with the Vhi Dental product, Vhi and Collinson need to get to know you and what your needs are. This means that Vhi and Collinson collect certain information about you in the course of providing the Vhi Dental product. This notice sets out details of the information that is collected, how it is processed, to whom it is disclosed, and your rights under data protection law in relation to the processing of your data.

Vhi Healthcare DAC (“Vhi”) works with Collinson Insurance Europe Limited (“Your Insurer” or “Collinson”) and their agent Collinson Insurance Solutions Europe Limited (“CISEL”) to provide the Vhi Dental product.

Vhi and Collinson generally act as separate controllers of personal data that is collected and processed in connection with the Vhi Dental product. However, there are some limited circumstances when Vhi and Collinson act as joint controllers of your personal data. For further details about these circumstances, please refer to the notice below.

Your Insurer will be a controller of your personal data for claims administration purposes and to meet its statutory obligations.

Vhi’s registered address is Vhi House, Lower Abbey Street, Dublin 1. Collinson’s registered address is Third Floor, Development House, St Anne Street, Floriana, FRN 9010, Malta.

If you have any queries in relation to the processing of your personal data, Vhi has appointed a data protection officer that you can contact at dataprotection@vhi.ie. You can also contact Collinson’s data protection officer at data.protection@collinsongroup.com.

Vhi is responsible for selling you your Vhi Dental product, making any changes that you may need to make to it and undertaking any marketing, with your permission, once the policy has been sold. Collinson needs to administer the underlying insurance policy, meet its regulatory obligations and deal with any claims that you may need to make. Vhi and Collinson have entered into an agreement under which they have agreed that they each act as separate controllers of your personal data when processing your personal data for these purposes (as further set out below). However, in the event that you make a claim or complaint in relation to your Vhi Dental product, the parties may deal with your claim or complaint on a joint basis in certain circumstances, and will therefore act as joint controllers. Further details of Vhi’s and Collinson’s processing of your personal data as joint controllers is set out below.

In the event that Vhi’s relationship with Collinson is terminated, Collinson will only continue to process your personal data to meets its contractual, regulatory or legal obligations and Vhi’s role as controller will be unaffected by the termination.

In order to provide the Vhi Dental product to you Vhi needs to process certain personal data in relation to you, which includes:

• Biographical data - Vhi collects the following biographical data: name, assumed names, address, mobile phone number, email address, gender, and date of birth.
• Payment data - Your payment details such as the IBAN, BIC and the name of your bank/building society will be collected and processed by Vhi in the event that you purchase a Vhi Dental product.
• Claims data - If you make a claim Vhi will process details of the underlying dental condition that gives rise to your claim. Where you make a claim in connection with dental treatment, Vhi may process details of your dental history, details of services claimed, treatment dates, payments you have made and, if necessary, further dental information that is required to be accessed or requested relating to your claim. Vhi may also process details of other insurance products that may cover aspects of your claim, and further information that you provide in support of your claim, such as original or copy receipts.
• Interactions with customer services - If you interact with Vhi's customer services departments Vhi will record details of those interactions (e.g. records of phone calls, email correspondence and hard copy correspondence). If you make a complaint Vhi will process details in relation to that complaint.
• Digital platforms - When you interact with Vhi's digital platforms you will often provide personal data to Vhi, which you will be aware of when using the services. Vhi also automatically collects data about your use of its services, such as the IP address of the device you use to access the service, the type of device you are using, and how you interact with the services. Further details are available in the cookies policy and/or the data protection notice that accompanies the relevant service.

In order to provide the Vhi Dental product to you Collinson needs to process certain personal data in relation to you, which includes:

• Biographical data – Collinson processes the following biographical data: name, assumed names, address, mobile phone number, email address, gender, and date of birth.
• Claims Payment data – Collinson processes your payment details such as the IBAN,BIC and the name of your bank/building society if you make a claim and receive payments through electronic funds transfers.
• Claims data – If you make a claim Collinson will process details of the underlying dental condition that gives rise to your claim. Where you make a claim in connection with dental treatment, Collinson may process details of your medical history, details of services claimed, treatment dates, payments you have made and, if necessary, Collinson may access or request further medical information relating to your claim. Collinson may also process details of other insurance products that may cover aspects of your claim, and further information that you provide in support of your claim, such as original or copy receipts.
• Interactions with customer services – If you interact with Collinson’s customer services departments Collinson will record details of those interactions (e.g. records of phone calls, email correspondence and hard copy correspondence). If you make a complaint Collinson will process details in relation to that complaint.

Most of the personal data that Vhi and Collinson collect about you will be provided by you through application forms, claims forms and your interactions with customer services.

However, certain information may be provided by third parties on your behalf, including the following:

• Group schemes – Some customers avail of the Vhi Dental product through a scheme that is operated by their employer. In order to sign you up as a customer your employer will give Vhi certain details, such as your name, address, gender, age, contact details, and details of dependants that will be included on a policy.
• Dependants – It is very common for insurance policies to cover not just the policyholder, but also their dependants. If you are a dependant covered by a policy, the policyholder will have provided Vhi with certain details, such as your name and address, gender and age. In the event that a claim is made, the policyholder (or someone else with your permission) may provide Vhi and/or Collinson with the “claims data” outlined above.
• Dental practices, Hospitals and Dentists – If you are making a claim, you may have had some interactions with a hospital or dental practitioner. Collinson will contact these entities so that they can provide it with details of the services that you have received,so that your claim can be properly assessed and processed.
• Digital platforms –When you access Vhi’s digital platforms Vhi will collect the information that you provide to Vhi through the platform, and will also automatically collect certain data in relation to your use of Vhi’s services, such as the IP address of the device you use to access the service, the type of device  you are using, and how you interact with the services.

Vhi and Collinson process your personal data in order to provide you with the Vhi Dental product and to assist them in the operation of their businesses. Under data protection law Vhi and Collinson are required to ensure that there is an appropriate basis for the processing of your personal data, and they are required to let you know what that basis is. There are various options under data protection law, but the primary bases that are used by Vhi and Collinson are (i) processing necessary for the performance of a contract with you, (ii) processing necessary in order for Vhi and/or Collinson to pursue their legitimate interests, (iii) processing where you and/or your dependants’ have given your consent, and (iv) processing that is required under applicable law. Further details of the processing of your personal data are set out below, together with the basis for that processing:

Vhi and Collinson’s processing of your personal data as joint controllers:

·         Claims – Vhi and Collinson will jointly process your personal data in order to process your claim where you make a claim that requires the parties to co-ordinate a response (e.g. where it is not clear if your claim is covered by the Vhi Dental product). Where Vhi and Collinson process health related claims data, this will be on the   basis that it is necessary and proportionate for the purposes of administering your insurance policy. In addition your personal data is processed by Collinson on the basis that it is necessary in order for the performance of its contract with you, and by Vhi on the basis of its legitimate interest in ensuring the proper operation of the Vhi Dental product.

·      Complaints – Vhi and Collinson will jointly process your personal data in order to deal with your complaint in circumstances where your complaint relates to the actions or responsibilities of both parties. Where Vhi and Collinson process health related claims data, this will be on the basis that it is necessary and proportionate for the purposes of administering your insurance policy. In addition your personal data is processed by Vhi and Collinson on the basis of their legitimate interests in ensuring the proper operation of the Vhi Dental product.

Vhi’s processing of your personal data:

·      Administering your policies – Vhi will process your personal data in order to administer your policy. This includes processing your personal data in order to receive payments, and to maintain Vhi’s records of the insurance products that you have purchased. Where Vhi processes your personal data in order to administer your policy this will be on the basis of Vhi’s legitimate interest in making the Vhi Dental product available and ensuring that Collinson operates the insurance policy in accordance with Vhi’s agreement with Collinson.

·      Providing you with services - Vhi provides different channels to engage with you in order to provide you with its services, including where you have opted to avail of electronic channels such as MyVhi, Vhi’s website and mobile app. The MyVhi section of Vhi’s website, and Vhi’s mobile applications, give you access to your policy documents and information in one secure place, anytime, anywhere. Vhi is the sole controller of personal data that is processed to provide you with access to Vhi’s digital channels, but personal data that is transmitted through these channels that relates to claims will be processed in accordance with the provisions of this notice. Where Vhi processes health related claims data in the context of providing these services, this will be on the basis that it is necessary and proportionate for the purposes of providing insurance policies as part of its business. Any other data is processed on the basis of Vhi’s legitimate interest in ensuring Collinson operates the insurance policy in accordance with Vhi’s agreement with Collinson.

·      Running Vhi’s business – in order to ensure that Vhi can continue to provide its products and services, it is essential to ensure that it can manage the costs of claims and determine what events each of Vhi’s policies can cover. In order to do this Vhi undertakes extensive modelling of the current and historic claims made by its customers. This information is used to identify patterns in claims, to try to predict future trends and how they might affect Vhi’s business, and to undertake pricing, profitability and propensity to claim studies. This information may be used to help Vhi develop new product benefits and services. Vhi also undertakes auditing and quality control to check that its processes are robust and are being followed. In addition, Vhi also needs to process your data to meet certain regulatory and legislative obligations that apply to its business. Vhi tries to do all of the above by using aggregated or anonymous data where possible, so you won’t be identifiable from the data, but some of this work involves processing your data without anonymising it. Where Vhi processes health related claims data, this will be on the basis that it is necessary and proportionate for the purposes of providing insurance policies as part of its business. Any other personal data that Vhi processes will be on the basis of its legitimate interests in operating its business, or on the basis of a legal obligation to which Vhi is subject.

·      Complaints – Vhi will process your personal data in order to deal with complaints queries, complaints resolution and enhance your experience with Vhi products. Where Vhi process complaints data including health related claims information, this will be on the basis that it is necessary and proportionate for the purposes of administering your insurance policy and resolving the complaint. Any other personal data that Vhi processes will be on the basis of its legitimate interests in operating its business, or on the basis of a legal obligation to which Vhi is  subject.

·      Marketing – if you provide Vhi with your consent to send you marketing messages Vhi will process your personal data in order to make sure that any marketing messages that Vhi sends to you are relevant to you. Vhi also undertakes market research and surveys, which provides Vhi with market insights. Vhi’s processing of your personal data in relation to marketing and market research will be subject to your consent.

·      Fraud prevention and claims management – it is an unfortunate feature of any insurance product that fraud can occur from time to time. Vhi has a number of systems and procedures in place to monitor for potentially fraudulent claims. If Vhi identifies a suspicious claim or pattern of claims, Vhi will process your personal data in order to investigate the claim and to take appropriate measures to protect itself and its customers. Where Vhi processes health data in connection with fraud prevention and claims management, this will be on the basis that it is necessary and proportionate for the purposes of administering your insurance policy. Any other personal data that Vhi processes will be on the basis of its legitimate interests in preventing fraudulent claims.

·      Administering Vhi’s computer systems – Vhi relies on technology and computer systems to run its business. Vhi has an extensive team of developers and support engineers who are constantly testing its systems, running trials of new software, and providing support to its users. In order to do this, where possible Vhi tries to use test data or anonymised data, but on occasion Vhi may have to access live data directly, or Vhi will often make a copy of some of the data that sits in its live systems and run its tests on that to make sure everything is working before a change is rolled out. These copies may include your personal data, including details in relation to claims you have made. In general this processing of your personal data is justified by Vhi’s legitimate interests in making sure its computer systems run properly and are safe and secure. If Vhi processes health data when running these tests or providing support services to its users, this will be on the basis that it is necessary and proportionate for the purposes of providing insurance policies as part of its business.

·      Statutory and regulatory obligations – Vhi includes the total number of claims made in relation to a policy in its renewal documentation. This is done to comply with its legal obligations.

·      Payment of Private Health Insurance Claims - where you make a Vhi Dental claim and there is a shortfall that may be covered by your Vhi Insurance Private Health Insurance policy, if certain arrangements are in place with your group scheme Vhi Insurance DAC may receive your personal data from Collinson to pay the eligible benefit under the private health insurance policy.

Where Vhi processes health data in connection with paying a Vhi Insurance Personal Health Insurance claim, this will be on the basis that it is necessary and proportionate for the purposes of administering your insurance policy.

Collinson’s processing of your personal data:

·      Administering your policies – Collinson will process your personal data in order to administer your policy. This includes processing your personal data in order to make payments, and to maintain its records of the insurance products that you have purchased. Where Collinson processes your personal data in order to administer your policy this will be on the basis that it is necessary in order for the performance of its contract with you.

·      Administering claims – in order to administer a claim that you make under a policy Collinson will need to process personal data in relation to the claim. Where you make a claim in connection with dental treatment, this will include the underlying dental condition that is treated, your dental history, and the dental services that you receive. Collinson will also need to process your personal data in order to deal with claims queries or to deal with complaints queries. If your claim is successful, Collinson will process your personal data in order to cover any claims that you have made, refund you fees that you may have incurred or to pay any service providers directly. Where Collinson process health related claims data, this will be on the basis that it is necessary and proportionate for the purposes of administering your insurance policy. Any other data is processed on the basis that it is necessary in order for the performance of Collinson’s contract with you.

·      Running Collinson’s business – Collinson processes your personal data in order to operate its business, which involves processing personal data in a similar manner to how Vhi processes your personal data for these purposes (see “Running Vhi’s business” above). Where Collinson processes health related claims data, this will be on the basis that it is necessary and proportionate for the purposes of providing insurance policies as part of its business. Any other personal data that Collinson processes will be on the basis of its legitimate interests in operating its business, or on the basis of a legal obligation to which Collinson is subject.

·      Complaints - Collinson will process your personal data in order to deal with complaints queries, complaints resolution and enhance your experience with Vhi products. Where Collinson process complaints data including health related claims information, this will be on the basis that it is necessary and proportionate for the purposes of administering your insurance policy and resolving the complaint. Any other personal data that Collinson processes will be on the basis of its legitimate interests in operating its business, or on the basis of a legal obligation to which Collinson is subject.

·      Administering Collinson’s computer systems - Collinson processes your personal data in order to operate its computer systems, which involves processing personal data in a similar manner to how Vhi processes your personal data for these purposes (see “Administering Vhi’s computer systems” above). In general this processing of your personal data is justified by Collinson’s legitimate interests in making sure its computer systems run properly and are safe and secure. If Collinson processes health data when running tests or providing support services to its users, this will be on the basis that it is necessary and proportionate for the purposes of providing insurance policies as part of its business.

In order to process certain personal data in relation to you, Vhi needs to get your consent (e.g. in connection with some of Vhi's marketing activities). When Vhi processes your personal data on the basis of your consent, you are free to withdraw that consent at any time. You can withdraw your consent by contacting Vhi using the contact details at the bottom of this notice. Please note that if you withdraw your consent Vhi may not be able to continue providing you with the service to which the consent related.

Collinson requires certain information from you in order to be able to enter into a contract with you and Vhi requires certain information to provide you with its services. Where this is the case Vhi and/or Collinson will indicate on relevant forms what personal data is required in order to enter into the contract with you. If you do not provide the information, Vhi and/or Collinson will not be able to provide you with their services.

Vhi and/or Collinson share your personal data with the following third parties:

·      Dental practices, Hospitals and Dentists – Collinson will provide hospitals and dental practitioners with information that allows them to verify that your claim is covered by your policy and the current level of cover that you have.

·      Service providers – Vhi and Collinson rely on trusted third parties to help them run their businesses and to provide them with specialised services. This can include companies that provide IT services, from scanning letters that are received and loading them onto IT systems to companies hosting data when providing software services. Vhi and Collinson also engage with companies that provide them with non-IT related services, such as legal advisors, accountants and consultants. Collinson may also need to share personal data in order to handle any claim that you make. Who Collinson needs to share data with will depend on your particular circumstances at the time of your claim, but examples may include local claims administrators and cost containment specialists. Where service providers have access to your personal data, Vhi and Collinson ensure that they are subject to appropriate contracts and other safeguards.

·      Underwriters – in the insurance industry it is common practice to engage an underwriter to take on the risks associated with a policy. In such circumstances, the underwriter will be given access to details about your claim in order to process your claim.

·      Regulators – in certain circumstances Vhi and Collinson may be obliged to provide information to a regulator, such as in relation to the investigation of complaints.

·      Group companies – Vhi and Collinson each consist of a number of separate companies. Some of these companies provide services on an intra-group basis, in Ireland and in the case of Collinson in Malta and the UK. The provision of intra-group services may involve the sharing of your personal data between one or more of Vhi’s or Collinson’s group companies.

·      Banking and Financial Institutions - Vhi may share data with banks and other credit and payment institutions to process premium collection including direct debits, funds transfers, credit management, standing orders and other electronic funds transfers as necessary. Collinson may share data with banks and other credit and payment institutions to make claims payments.

·      Collinson and Vhi share your personal data with each other for the purposes of providing the Dental Insurance to you (including to deal with complaints queries, complaints resolution and to enhance your experience with Vhi products). If certain arrangements are in place with your Group Scheme Collinson may share your personal data with Vhi Insurance DAC for the payment of eligible Vhi Insurance Private Medical Insurance claims.

There are certain circumstances where Vhi, Collinson and/or its agent CISEL, will transfer your personal data outside of the European Union to a country which is not recognised by the European Commission as providing an equivalent level of protection for personal data as is provided for in the European Union. Collinson may need to transfer your personal data outside of the European Union in order to process your claims (e.g. when you make a claim in relation to treatment at a hospital outside of the EU or to provide round the clock customer service). Such transfers of personal data are on the basis that the transfer is necessary in order to perform Collinson’s contractual obligations under your policy.

If Vhi, Collinson or its agents transfer your personal data outside of the European Union for any other reason please rest assured that they will ensure that appropriate measures are in place to protect your personal data and to comply with their obligations under applicable data protection law. This may mean that Vhi or Collinson enter into contracts in the form approved by the European Commission, or use such other GDPR compliant transfer mechanisms that may be approved from time to time. If you would like further details about the measures that Vhi or Collinson have taken in relation to the transfer of your personal data, or copies of the agreements that they have put in place in relation to the transfers, please contact Vhi or Collinson using the details at the bottom of this notice.

Vhi and Collinson will retain your personal data in accordance with their record retention policies. The record retention policies each operate on the principle that personal data is kept for no longer than is necessary for the purpose for which it was collected, and in accordance with any requirements that are imposed by regulators or by law. This means that the retention period for your personal data will vary depending on the type of personal data. For further information about the criteria that Vhi and Collinson apply to determine retention periods please see below:

·      Statutory and regulatory obligations – As Vhi and Collinson work in a highly regulated industry, they each have certain statutory and regulatory obligations to retain personal data for set periods of time.

·      Managing legal claims – When assessing how long they keep personal data, Vhi and Collinson take into account whether that data may be required in order to defend any legal claims which may be made. If such data is required, it may be kept until the statute of limitations runs out in relation to the type of claim that can be made (which varies from 2 to 12 years).

·      Business requirements – As personal data is only collected for defined purposes, Vhi and Collinson assess how long they need to keep personal data for in order to meet their reasonable business purposes.

You have various rights under data protection law, subject to certain exemptions, in connection with the processing of your personal data:

·      Right to access the data - You have the right to request a copy of the personal data that is held about you, together with other information about the processing of that personal data.

·      Right to rectification – You have the right to request that any inaccurate data that is held about you is corrected, or if incomplete information is held about you, you may request that the information is updated such that it is complete.

·      Right to erasure – You have the right to request the deletion of the personal data that is held about you. This is sometimes referred to as the right to be forgotten.

·      Right to restriction of processing or to object to processing – You have the right to request that your personal data is no longer processed for particular purposes, or to object to the processing of your personal data for particular purposes.

·      Right to data portability – You have the right to request that you, or a third party, are provided with a copy of your personal data in a structured, commonly used machine readable format.

You may make a request to exercise your data subject rights to Vhi or Collinson using the contact details below. Vhi and Collinson have agreed that in circumstances where your request relates to personal data held by both Vhi and Collinson, either jointly or separately, they will co-operate to ensure that your request is processed appropriately. This will mean that Vhi may respond to your request on behalf of Collinson in certain circumstances.

If you have any queries or wish to make a complaint about Collinson’s processing of your personal data in connection with the handling of your claim, you can contact their data protection officer at:

Postal Address:

Data Protection Officer

Collinson Insurance Solutions Europe Ltd

3 More London

Riverside (5th Floor)

London SE1 2AQ

England

E-mail Address:

Collinson’s data protection officer at data.protection@collinsongroup.com

If you have any queries or complaints in connection with Vhi’s processing of your personal data, you can get in touch with Vhi using the following contact details:

Postal Address:

Data Protection Officer

Vhi House

Lower Abbey Street

Dublin 1

E-mail Address:

Vhi’s data protection officer at dataprotection@vhi.ie

You also have the right to lodge a complaint with the Data Protection Commission (DPC) if you are unhappy with our processing of your personal data.  Details of how to lodge a complaint can be found on the dataprotection.ie website by selecting the appropriate webform, or by writing to the DPC at - Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2. DO2, RD28, Ireland.

Find here.

In order to provide you with the Vhi International Health Insurance product, Vhi and Collinson need to get to know you and what your needs are. This means that Vhi and Collinson collect certain information about you in the course of providing the Vhi International Health Insurance product. This notice sets out details of the information that is collected, how it is processed, to whom it is disclosed, and your rights under data protection law in relation to the processing of your data

Vhi Healthcare DAC (“Vhi”) works with Collinson Insurance Europe Limited (“Your Insurer”) and their agent Collinson Insurance Solutions Europe Limited (“CISEL”) together trading as “Collinson” to provide the Vhi International Health Insurance product.

Vhi and Collinson generally act as separate controllers of personal data that is collected and processed in connection with the Vhi International Health Insurance product. However, there are some limited circumstances when Vhi and Collinson act as joint controllers of your personal data. For further details about these circumstances, please refer to the notice below.

Collinson will also be separate controllers of your personal data for claims administration purposes and to meet their statutory obligations.

Your Insurer will be a controller of your personal data for claims administration purposes and to meet its statutory obligations.

Vhi’s registered address is Vhi House, Lower Abbey Street, Dublin 1. Collinson’s registered address is Third Floor, Development House, St AnneStreet, Floriana, FRN 9010, Malta.

If you have any queries in relation to the processing of your personal data, Vhi has appointed a data protection officer that you can contact at dataprotection@vhi.ie. You can also contact Collinson’s data protection officer at data.protection@collinsongroup.com.

Vhi is responsible for selling you your Vhi International Health Insurance product, making any changes that you may need to make to it and undertaking any marketing, with your permission, once the policy has been sold. Collinson needs to administer the underlying insurance policy, meet its regulatory obligations and deal with any claims that you may need to make. Vhi and Collinson have entered into an agreement under which they have agreed that they each act as separate controllers of your personal data when processing your personal data for these purposes (as further set out below). However, in the event you make a claim or complaint in relation to your Vhi International Health Insurance product, the parties may deal with your claim or complaint on a joint basis in certain circumstances, and will therefore act as joint controllers. Further details of Vhi’s and Collinson’s processing of your personal data as joint controllers are set out below.

In the event that Vhi’s relationship with Collinson is terminated, Collinson will only continue to process your personal data to meets its contractual, regulatory or legal obligations and Vhi’s role as controller will be unaffected by the termination.

In order to provide the Vhi International Health Insurance product to you Vhi needs to process certain personal data in relation to you, which includes:

• Biographical data – Vhi collects the following biographical data: name, assumed names, address, mobile phone number, email address, gender, and date of birth.
• Eligibility for membership – Vhi may ask for evidence of your eligibility to purchase a Vhi International Health Insurance policy (i.e. evidence that you are an Irish resident), and evidence on renewal in connection with your continued eligibility for the policy. Vhi may also request further details from you in order to assess your application for a policy, including your state of health, employment or status.
• Pre-existing conditions – If at the time of your application, you are not a member of a health insurance plan provided and underwritten by an Irish licensed insurer, Vhi will require details of any pre-existing medical conditions
• Payment data – Your payment details such as the IBAN, BIC and the name of your bank/building society will be collected and processed by Vhi in the event that you purchase a Vhi International Health Insurance product.
• Claims data – If you make a claim Vhi will process details of the incident or event that gives rise to your claim. Where you make a claim in connection with medical treatment, Vhi may process details of your medical history, details of services claimed, treatment dates, payments you have made and, if necessary, further medical information that is required to be accessed or requested relating to your claim. Vhi may also process details of other insurance products that may cover aspects of your claim, and further information that you provide in support of your claim, such as original or copy receipts.
• Interactions with customer services – If you interact with Vhi’s customer services departments Vhi will record details of those interactions (e.g. records of phone calls, email correspondence and hard copy correspondence). If you make a complaint Vhi will process details in relation to that complaint.
• Digital platforms – When you interact with Vhi’s digital platforms you will often provide personal data to Vhi, which you will be aware of when using the services. Vhi also automatically collects data about your use of its services, such as the IP address of the device you use to access the service, the type of device you are using, and how you interact with the services. Further details are available in the cookies policy and/or the data protection notice that accompanies the relevant service.

In order to provide the Vhi International Health Insurance product to you Collinson needs to process certain personal data in relation to you, which includes:

• Biographical data – Collinson processes the following biographical data: name, assumed names, address, mobile phone number, email address, gender, and date of birth.
• Claims Payment data – Collinson processes your payment details such as the IBAN,BIC and the name of your bank/building society if you make a claim and receive payments through electronic funds transfers.
• Claims data – If you make a claim Collinson will process details of the incident or event that gives rise to your claim. Where you make a claim in connection with medical treatment, Collinson may process details of your medical history, details of services claimed, treatment dates, payments you have made and, if necessary, Collinson may access or request further medical information relating to your claim. Collinson may also process details of other insurance products that may cover aspects of your claim, and further information that you provide in support of your claim, such as original or copy receipts.
• Interactions with customer services – If you interact with Collinson’s customer services departments Collinson will record details of those interactions (e.g. records of phone calls, email correspondence and hard copy correspondence). If you make a complaint Collinson will process details in relation to that complaint. Collinson will also receive data in relation to complaints made directly to VHI to comply with regulatory reporting and ensure products are continuing to meet the needs of customers.

Most of the personal data that Vhi and Collinson collect about you will be provided by you through application forms, claims forms and your interactions with customer services. However, certain information may be provided by third parties on your behalf, including the following:

• Group schemes – Some customers avail of the Vhi International Health Insurance product through a scheme that is operated by their employer. In order to sign you up as a customer your employer will give Vhi certain details, such as your name, address, gender, age, contact details, and details of dependants that will be included on a policy.
• Dependants – It is very common for insurance policies to cover not just the policyholder, but also their dependants. If you are a dependant covered by a policy, the policyholder will have provided Vhi with certain details, such as your name and address, gender and age. In the event that a claim is made, the policyholder (or someone else with your permission) may provide Vhi and/or Collinson with the “claims data” outlined above.
• Hospital and primary care providers – If you are making a claim, you may have had some interactions with a hospital or primary care provider. Collinson will contact these entities so that they can provide it with details of the services that you have received, so that your claim can be properly assessed and processed.
• Digital platforms – When you access Vhi’s digital platforms Vhi will collect the information that you provide to Vhi through the platform, and will also automatically collect certain data in relation to your use of Vhi’s services, such as the IP address of the device you use to access the service, the type of device you are using, and how you interact with the services.

Vhi and Collinson process your personal data in order to provide you with the Vhi International Health Insurance product and to assist them in the operation of their businesses. Under data protection law Vhi and Collinson are required to ensure that there is an appropriate basis for the processing of your personal data, and they are required to let you know what that basis is. There are various options under data protection law, but the primary bases that are used by Vhi and Collinson are (i) processing necessary for the performance of a contract with you, (ii) processing necessary in order for Vhi and/or Collinson to pursue their legitimate interests, (iii) processing where you and/or your dependants’ have given your consent, and processing that is required under applicable law. Further details of the processing of your personal data are set out below, together with the basis for that processing:

Vhi and Collinson’s processing of your personal data as joint controllers:

·         Claims – Vhi and Collinson will jointly process your personal data in order to process your claim where you make a claim that requires the parties to co-ordinate a response (e.g. where it is not clear if your claim is covered by the Vhi International Health Insurance product). Where Vhi and Collinson process health related claims data, this will be on the basis that it is necessary and proportionate for the purposes of administering your insurance policy. In addition your personal data is processed by Collinson on the basis that it is necessary in order for the performance of its contract with you, and by Vhi on the basis of its legitimate interest in ensuring the proper operation of the Vhi International Health Insurance product.

·         Complaints – Vhi and Collinson will jointly process your personal data in order to deal with your complaint in circumstances where your complaint relates to the actions or responsibilities of both parties. Where Vhi and Collinson process health related claims data, this will be on the basis that it is necessary and proportionate for the purposes of administering your insurance policy. In addition your personal data is processed by Vhi and Collinson on the basis of their legitimate interests in ensuring the proper operation of the Vhi International Health Insurance product.

Vhi’s processing of your personal data:

·         Assessing eligibility – Vhi will process your personal data in order to assess your eligibility to purchase the Vhi International Health Insurance policy at the time you apply for the policy and on renewal. Vhi processes this personal data on the basis of its legitimate interests in ensuring that only eligible persons purchase a policy. Where Vhi processes health related data in the context of assessing eligibility, this will be on the basis that it is necessary and proportionate for the purposes of providing insurance policies as part of its business.

·         Administering your policies – Vhi will process your personal data in order to administer your policy. This includes processing your personal data in order to receive payments, and to maintain Vhi’s records of the insurance products that you have purchased. Where Vhi processes your personal data in order to administer your policy this will be on the basis of Vhi’s legitimate interest in making the Vhi International Health Insurance product available and ensuring that Collinson operates the insurance policy in accordance with Vhi’s agreement with Collinson.

·         Providing you with services – Vhi provides different channels to engage with you in order to provide you with its services, including where you have opted to avail of electronic channels such as MyVhi, Vhi’s website and mobile app. The MyVhi section of Vhi’s website, and Vhi’s mobile applications, give you access to your policy documents and information in one secure place, anytime, anywhere. Vhi is the sole controller of personal data that is processed to provide you with access to Vhi’s digital channels, but personal data that is transmitted through these channels that relates to claims will be processed in accordance with the provisions of this notice. Where Vhi processes health related claims data in the context of providing these services, this will be on the basis that it is necessary and proportionate for the purposes of providing insurance policies as part of its business. Any other data is processed on the basis of Vhi’s legitimate interest in ensuring Collinson operates the insurance policy in accordance with Vhi’s agreement with Collinson.

·         Running Vhi’s business – in order to ensure that Vhi can continue to provide its products and services, it is essential to ensure that it can manage the costs of claims and determine what events each of Vhi’s policies can cover. In order to do this Vhi undertakes extensive modelling of the current and historic claims made by its customers. This information is used to identify patterns in claims, to try to predict future trends and how they might affect Vhi’s business, and to undertake pricing, profitability and propensity to claim studies. This information may be used to help Vhi develop new product benefits and services. Vhi also undertakes auditing and quality control to check that its processes are robust and are being followed. In addition, Vhi also needs to process your data to meet certain regulatory and legislative obligations that apply to its business. Vhi try to do all of the above by using aggregated or anonymous data where possible, so you won’t be identifiable from the data, but some of this work involves processing your data without anonymising it. Where Vhi processes health related claims data, this will be on the basis that it is necessary and proportionate for the purposes of providing insurance policies as part of its business. Any other personal data that Vhi processes will be on the basis of its legitimate interests in operating its business, or on the basis of a legal obligation to which Vhi is subject.

·         Complaints – Vhi will process your personal data in order to deal with complaints queries, complaints resolution and enhance your experience with Vhi products. Where Vhi process complaints data including health related claims information, this will be on the basis that it is necessary and proportionate for the purposes of administering your insurance policy and resolving the complaint. Any other personal data that Vhi processes will be on the basis of its legitimate interests in operating its business, or on the basis of a legal obligation to which Vhi is subject.

·         Marketing – if you provide Vhi with your consent to send you marketing messages Vhi will process your personal data in order to make sure that any marketing messages that Vhi sends to you are relevant to you. Vhi also undertakes market research and surveys, which provides Vhi with market insights. Vhi’s processing of your personal data in relation to marketing and market research will be subject to your consent.

·         Fraud prevention and claims management – it is an unfortunate feature of any insurance product that fraud can occur from time to time. Vhi has a number of systems and procedures in place to monitor for potentially fraudulent claims. If Vhi identifies a suspicious claim or pattern of claims, Vhi will process your personal data in order to investigate the claim and to take appropriate measures to protect itself and its customers. Where Vhi processes health data in connection with fraud prevention and claims management, this will be on the basis that it is necessary and proportionate for the purposes of administering your insurance policy. Any other personal data that Vhi processes will be on the basis of its legitimate interests in preventing fraudulent claims.

·         Administering Vhi’s computer systems – Vhi relies on technology and computer systems to run its business. Vhi has an extensive team of developers and support engineers who are constantly testing its systems, running trials of new software, and providing support to its users. In order to do this, where possible Vhi tries to use test data or anonymised data, but on occasion Vhi may have to access live data directly, or Vhi will often make a copy of some of the data that sits in its live systems and run its tests on that to make sure everything is working before a change is rolled out. These copies may include your personal data, including details in relation to claims you have made. In general this processing of your personal data is justified by Vhi’s legitimate interests in making sure its computer systems run properly and are safe and secure. If Vhi processes health data when running these tests or providing support services to its users, this will be on the basis that it is necessary and proportionate for the purposes of providing insurance policies as part of its business.

·      Statutory and regulatory obligations – Vhi includes the total number of claims made in relation to a policy in its renewal documentation. This is done to comply with its legal obligations.

Collinson’s processing of your personal data

·         Administering your policies – Collinson will process your personal data in order to administer your policy. This includes processing your personal data in order to make payments, and to maintain its records of the insurance products that you have purchased. Where Collinson processes your personal data in order to administer your policy this will be on the basis that it is necessary in order for the performance of its contract with you.

·         Administering claims – in order to administer a claim that you make under a policy Collinson will need to process personal data in relation to the claim. Where you make a claim in connection with medical treatment, this will include the underlying medical condition that is treated, your medical history, and the medical services that you receive. Collinson will also need to process your personal data in order to deal with claims queries or to deal with complaints queries. If your claim is successful, Collinson will process your personal data in order to cover any claims that you have made, refund you fees that you may have incurred or to pay any service providers directly. Where Collinson process health related claims data, this will be on the basis that it is necessary and proportionate for the purposes of administering your insurance policy. Any other data is processed on the basis that it is necessary in order for the performance of Collinson’s contract with you

·         Running Collinson’s business – Collinson processes your personal data in order to operate its business, which involves processing personal data in a similar manner to how Vhi processes your personal data for these purposes (see “Running Vhi’s business” above). Where Collinson processes health related claims data, this will be on the basis that it is necessary and proportionate for the purposes of providing insurance policies as part of its business. Any other personal data that Collinson processes will be on the basis of its legitimate interests in operating its business, or on the basis of a legal obligation to which Collinson is subject.

·         Complaints - Collinson will process your personal data in order to deal with complaints queries, complaints resolution and enhance your experience with Vhi products. Where Collinson process complaints data including health related claims information, this will be on the basis that it is necessary and proportionate for the purposes of administering your insurance policy and resolving the complaint. Any other personal data that Collinson processes will be on the basis of its legitimate interests in operating its business, or on the basis of a legal obligation to which Collinson is subject.

·         Administering Collinson’s computer systems - Collinson processes your personal data in order to operate its computer systems, which involves processing personal data in a similar manner to how Vhi processes your personal data for these purposes (see “Administering Vhi’s computer systems” above). In general this processing of your personal data is justified by Collinson’s legitimate interests in making sure its computer systems run properly and are safe and secure. If Collinson processes health data when running tests or providing support services to its users, this will be on the basis that it is necessary and proportionate for the purposes of providing insurance policies as part of its business.

In order to process certain personal data in relation to you, Vhi needs your consent (e.g. in connection with some of its marketing activities). When Vhi processes your personal data on the basis of your consent, you are free to withdraw that consent at any time. You can withdraw your consent by contacting Vhi using the contact details at the bottom of this notice. Please note that if you withdraw your consent Vhi may not be able to continue providing you with the service to which the consent related.

Collinson requires certain information from you in order to be able to enter into a contract with you and Vhi requires certain information to provide you with its services. Where this is the case Vhi and/or Collinson will indicate on relevant forms what personal data is required in order to enter into the contract with you. If you do not provide the information, Vhi and/or Collinson will not be able to provide you with their services

Vhi and/or Collinson share your personal data with the following third parties:

·         Hospitals and primary care providers – Collinson will provide hospitals and primary care providers with information that allows them to verify that your claim is covered by your policy and the current level of cover that you have. Collinson will also need to make sure that you receive the appropriate treatment.

·         Service providers – Vhi and Collinson rely on trusted third parties to help them run their businesses and to provide them with specialised services. This can include companies that provide IT services, from scanning letters that are received and loading them onto IT systems to companies hosting data when providing software services. Vhi and Collinson also engage with companies that provide them with non-IT related services, such as legal advisors, accountants and consultants. Collinson may also need to share personal data in order to handle any claim that you make. Who Collinson needs to share data with will depend on your particular circumstances at the time of your claim, but examples may include local claims administrators, cost containment specialists and medical/transport repatriation services. Where service providers have access to your personal data Vhi and Collinson ensure that they are subject to appropriate contracts and other safeguards.

·         Underwriters – in the insurance industry it is common practice to engage an underwriter to take on the risks associated with a policy. In such circumstances, the underwriter will be given access to details about your claim in order to process your claim.

·         Regulators – in certain circumstances Vhi or Collinson may be obliged to provide information to a regulator, such as in relation to the investigation of complaints.

·         Group companies – Vhi and Collinson each consist of a number of separate companies. Some of these companies provide services on an intra-group basis in Ireland and in the case of Collinson in Malta and the UK. The provision of intra-group services may involve the sharing of your personal data between one or more of Vhi’s or Collinson’s group companies.

·         Collinson and Vhi may share your personal data (complaints data including health related claims information) with each other for the purposes of dealing with complaints queries, complaints resolution and to enhance your experience with Vhi products.

·         Banking and Financial Institutions - Vhi may share data with banks and other credit and payment institutions to process premium collection including direct debits, funds transfers, credit management, standing orders and other electronic funds transfers as necessary. Collinson may share data with banks and other credit and payment institutions to make claims payments.

There are certain circumstances where Vhi, Collinson and/or its agent CISEL, will transfer your personal data outside of the European Union to a country which is not recognised by the European Commission as providing an equivalent level of protection for personal data as is provided for in the European Union. Collinson may need to transfer your personal data outside of the European Union in order to process your claims (e.g. when you make a claim in relation to treatment at a hospital outside of the EU or to provide round the clock customer service). Such transfers of personal data are on the basis that the transfer is necessary in order to perform Collinson’s contractual obligations under your policy. If Vhi, Collinson or its agents transfer your personal data outside of the European Union for any other reason please rest assured that they will ensure that appropriate measures are in place to protect your personal data and to comply with their obligations under applicable data protection law. This may mean that Vhi or Collinson enter into contracts in the form approved by the European Commission, or use such other GDPR compliant transfer mechanisms that may be approved from time to time. If you would like further details about the measures that Vhi or Collinson have taken in relation to the transfer of your personal data, or copies of the agreements that they have put in place in relation to the transfers, please contact Vhi or Collinson using the details at the bottom of this notice.

Vhi and Collinson will retain your personal data in accordance with their record retention policies. The record retention policies each operate on the principle that personal data is kept for no longer than is necessary for the purpose for which it was collected, and in accordance with any requirements that are imposed by regulators or by law. This means that the retention period for your personal data will vary depending on the type of personal data. For further information about the criteria that Vhi and Collinson apply to determine retention periods please see below:

• Statutory and regulatory obligations – As Vhi and Collinson work in a highly regulated industry, they each have certain statutory and regulatory obligations to retain personal data for set periods of time.
• Managing legal claims – When assessing how long they keep personal data Vhi and Collinson take into account whether that data may be required in order to defend any legal claims which may be made. If such data is required, it may be kept until the statute of limitations runs out in relation to the type of claim that can be made (which varies from 2 to 12 years).
• Business requirements – As personal data is only collected for defined purposes, Vhi and Collinson assess how long they need to keep personal data for in order to meet their reasonable business purposes.

You have various rights under data protection law, subject to certain exemptions, in connection with the processing of your personal data:

• Right to access the data - You have the right to request a copy of the personal data that is held about you, together with other information about the processing of that personal data.
• Right to rectification - You have the right to request that any inaccurate data that is held about you is corrected, or if incomplete information is held about you, you may request that the information is updated such that it is complete.
• Right to erasure - You have the right to request the deletion of the personal data that is held about you. This is sometimes referred to as the right to be forgotten.
• Right to restriction of processing or to object to processing - You have the right to request that your personal data is no longer processed for particular purposes, or to object to the processing of your personal data for particular purposes.
• Right to data portability - You have the right to request that you, or a third party, are provided with a copy of your personal data in a structured, commonly used machine readable format.

You may make a request to exercise your data subject rights to Vhi or Collinson using the contact details below. Vhi and Collinson have agreed that in circumstances where your request relates to personal data held by both Vhi and Collinson, either jointly or separately, they will cooperate to ensure that your request is processed appropriately. This will mean that Vhi may respond to your request on behalf of Collinson in certain circumstances.

If you have any queries or wish to make a complaint about Collinson’s processing of your personal data in connection with the handling of your claim, you can contact their data protection officer at:

Postal Address:

Data Protection Officer

Collinson Insurance Solutions Europe Ltd

Trading as Collinsons Cutlers Exchang

3. More London

Riverside (5th Floor)

London

SE12AQ

England

E-mail Address:

Collinson’s data protection officer at data.protection@collinsongroup.com

If you have any queries or complaints in connection with Vhi’s processing of your personal data, you can get in touch with Vhi using the following contact details:

Postal Address:

Data Protection Officer

Vhi House

Lower Abbey Street

Dublin 1

E-mail Address:

Vhi’s data protection officer at dataprotection@vhi.ie

You also have the right to lodge a complaint with the Data Protection Commission (DPC) if you are unhappy with our processing of your personal data.  Details of how to lodge a complaint can be found on the dataprotection.ie website by selecting the appropriate webform, or by writing to the DPC at - Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2. DO2, RD28, Ireland.

Find here.

In order to provide you with the Vhi MultiTrip product, Vhi and Collinson need to get to know you and what your needs are. This means that Vhi and Collinson collect certain information about you in the course of providing the Vhi MultiTrip product. This notice sets out details of the information that is collected, how it is processed, to whom it is disclosed, and your rights under data protection law in relation to the processing of your data. 

Vhi Healthcare DAC (“Vhi”) works with Collinson Insurance Europe Limited (“Your Insurer” or “Collinson”) and their agent Collinson Insurance Solutions Europe Limited (“CISEL”) to provide the Vhi MultiTrip product.

Vhi and Collinson generally act as separate controllers of personal data that is collected and processed in connection with the Vhi MultiTrip product. However, there are some limited circumstances when Vhi and Collinson act as joint controllers of your personal data. For further details about these circumstances, please refer to the notice below.

Your Insurer will be a controller of your personal data for claims administration purposes and to meet its statutory obligations

Vhi’s registered address is Vhi House, Lower Abbey Street, Dublin 1. Collinson’s registered address is Third Floor, Development House, St Anne Street, Floriana, FRN 9010, Malta.

If you have any queries in relation to the processing of your personal data, Vhi has appointed a data protection officer that you can contact at dataprotection@vhi.ie. You can also contact Collinson’s data protection officer at data.protection@collinsongroup.com.

Vhi is responsible for selling you your Vhi MultiTrip product, making any changes that you may need to make to it and undertaking any marketing, with your permission, once the policy has been sold. Collinson needs to administer the underlying insurance policy, meet its regulatory obligations and deal with any claims that you may need to make. Vhi and Collinson have entered into an agreement under which they have agreed that they each act as separate  controllers of your personal data when processing your personal data for these purposes (as further set out below). However, in the event that you make a claim or complaint in relation to your Vhi MultiTrip product, the parties may deal with your claim or complaint on a joint basis in certain circumstances, and will therefore act as joint controllers. Further details of Vhi’s and Collinson’s processing of your personal data as joint controllers is set out below.

In the event that Vhi’s relationship with Collinson is terminated, Collinson will only continue to process your personal data to meets its contractual, regulatory or legal obligations and Vhi’s role as controller will be unaffected by the termination. 

In order to provide the Vhi MultiTrip product to you Vhi needs to process certain personal data in relation to you, which includes:

• Biographical data - Vhi collects the following biographical data: name, assumed names, address, mobile phone number, email address, gender, and date of birth.
  
• Payment data - Your payment details such as the IBAN, BIC and the name of your bank/building society will be collected and processed by Vhi in the event that you purchase a Vhi MultiTrip product.
• Claims data - If you make a claim Vhi will process details of the incident or event that gives rise to your claim. Where you make a claim in connection with medical treatment, Vhi may process details of your medical history, details of services claimed, treatment dates, payments you have made and, if necessary, further medical information that is required to be accessed or requested relating to your claim. Vhi may also process details of other insurance products that may cover aspects of your claim, and further information that you provide in support of your claim, such as original or copy receipts.
• Interactions with customer services - If you interact with Vhi's customer services departments Vhi will record details of those interactions (e.g. records of phone calls, email correspondence and hard copy correspondence). If you make a complaint Vhi will process details in relation to that complaint.
• Digital platforms - When you interact with Vhi's digital platforms you will often provide personal data to Vhi, which you will be aware of when using the services. Vhi also automatically collects data about your use of its services, such as the IP address of the device you use to access the service, the type of device you are using, and how you interact with the services. Further details are available in the cookies policy and/or the data protection notice that accompanies the relevant service.

In order to provide the Vhi MultiTrip product to you Collinson needs to process certain personal data in relation to you, which includes:

• Biographical data – Collinson processes the following biographical data: name, assumed names, address, mobile phone number, email address, gender, and date of birth.
• Claims Payment data – Collinson processes your payment details such as the IBAN, BIC and the name of your bank/building society if you make a claim and receive payments through electronic funds transfers.
• Claims data – If you make a claim Collinson will process details of the incident or event that gives rise to your claim. Where you make a claim in connection with medical treatment, Collinson may process details of your medical history, details of services claimed, treatment dates, payments you have made and, if necessary, Collinson may access or request further medical information relating to your claim. Collinson may also process details of other insurance products that may cover aspects of your claim, and further information that you provide in support of your claim, such as original or copy receipts.
• Interactions with customer services – If you interact with Collinson’s customer services departments Collinson will record details of those interactions (e.g. records of phone calls, email correspondence and hard copy correspondence). If you make a complaint Collinson will process details in relation to that complaint. Collinson will also receive data in relation to complaints made directly to VHI to comply with regulatory reporting and ensure products are continuing to meet the needs of customers.

Most of the personal data that Vhi and Collinson collect about you will be provided by you through application forms, claims forms and your interactions with customer services. However, certain information may be provided by third parties on your behalf, including the following:

• Group schemes – Some customers avail of the Vhi MultiTrip product through a scheme that is operated by their employer. In order to sign you up as a customer your employer will give Vhi certain details, such as your name, address, gender, age, contact details, and details of dependants that will be included on a policy.
• Dependants – It is very common for insurance policies to cover not just the policyholder, but also their dependants. If you are a dependant covered by a policy, the policyholder will have provided Vhi with certain details, such as your name and address, gender and age. In the event that a claim is made, the policyholder (or someone else with your permission) may provide Vhi and/or Collinson with the “claims data” outlined above.
• Hospital and primary care providers – If you are making a claim, you may have had some interactions with a hospital or primary care provider. Collinson will contact these entities so that they can provide it with details of the services that you have received, so that your claim can be properly assessed and processed.
• Digital platforms – When you access Vhi’s digital platforms Vhi will collect the information that you provide to Vhi through the platform, and will also automatically collect certain data in relation to your use of Vhi’s services, such as the IP address of the device you use to access the service, the type of device you are using, and how you interact with the services. 

Vhi and Collinson process your personal data in order to provide you with the Vhi MultiTrip product and to assist them in the operation of their businesses. Under data protection law, Vhi and Collinson are required to ensure that there is an appropriate basis for the processing of your personal data, and they are required to let you know what that basis is. There are various options under data protection law, but the primary bases that are used by Vhi and/or Collinson are (i) processing necessary for the performance of a contract with you, (ii) processing necessary in order for Vhi and/or Collinson to pursue their legitimate interests, (iii) processing where you and/or your dependants have given your consent, and (iv) processing that is required under applicable law. Further details of the processing of your personal data are set out below, together with the basis for that processing: Vhi and Collinson’s processing of your personal data as joint controllers

·         Claims – Vhi and Collinson will jointly process your personal data in order to process your claim where you make a claim that requires the parties to co-ordinate a response (e.g. where it is not clear if your claim is covered by the Vhi MultiTrip product). Where Vhi and Collinson process health related claims data, this will be on the basis that it is necessary and proportionate for the purposes of administering your insurance policy. In addition your personal data is processed by Collinson on the basis that it is necessary in order for the performance of its contract with you, and by Vhi on the basis of its legitimate interest in ensuring the proper operation of the Vhi MultiTrip product.

·         Complaints – Vhi and Collinson will jointly process your personal data in order to deal with your complaint in circumstances where your complaint relates to the actions or responsibilities of both parties. Where Vhi and Collinson process health related claims data, this will be on the basis that it is necessary and proportionate for the purposes of administering your insurance policy. In addition your personal data is processed by Vhi and Collinson on the basis of their legitimate interests in ensuring the proper operation of the Vhi MultiTrip product.

Vhi’s processing of your personal data:

·         Administering your policies – Vhi will process your personal data in order to administer your policy. This includes processing your personal data in order to receive payments, and to maintain Vhi’s records of the insurance products that you have purchased. Where Vhi process your personal data in order to administer your policy this will be on the basis of Vhi’s legitimate interest in making the Vhi MultiTrip product available and ensuring that Collinson operates the insurance policy in accordance with Vhi’s agreement with Collinson.

·         Providing you with services –  Vhi provides different channels to engage with you in order to provide you with its services, including where you have opted to avail of electronic channels such as MyVhi, Vhi’s website and mobile app. The MyVhi section of Vhi’s website, and Vhi’s mobile applications, give you access to your policy documents and information in one secure place, anytime, anywhere. Vhi is the sole controller of personal data that is processed to provide you with access to Vhi’s digital channels, but personal data that is transmitted through these channels that relates to claims will be processed in accordance with the provisions of this notice.

Where Vhi processes health related claims data in the context of providing these services, this will be on the basis that it is necessary and proportionate for the purposes of providing insurance policies as part of its business. Any other data is processed on the basis of Vhi’s legitimate interest in ensuring Collinson operates the insurance policy in accordance with Vhi’s agreement with Collinson.  

·         Running Vhi’s business – in order to ensure that Vhi can continue to provide its products and services, it is essential to ensure that it can manage the costs of claims and determine what events each of Vhi’s policies can cover. In order to do this Vhi undertakes extensive modelling of the current and historic claims made by its customers. This information is used to identify patterns in claims, to try to predict future trends and how they might affect Vhi’s business, and to undertake pricing, profitability and propensity to claim studies. This information may be used to help Vhi develop new product benefits and services. Vhi also undertakes auditing and quality control to check that its processes are robust and are being followed. In addition, Vhi also needs to process your data to meet certain regulatory and legislative obligations that apply to its business. Vhi tries to do all of the above by using aggregated or anonymous data where possible, so you won’t be identifiable from the data, but some of this work involves processing your data without anonymising it. Where Vhi processes health related claims data, this will be on the basis that it is necessary and proportionate for the purposes of providing insurance policies as part of its business. Any other personal data that Vhi processes will be on the basis of its legitimate interests in operating its business, or on the basis of a legal obligation to which Vhi is subject.

·         Complaints – Vhi will process your personal data in order to deal with complaints queries, complaints resolution and enhance your experience with Vhi products. Where Vhi process complaints data including health related claims information, this will be on the basis that it is necessary and proportionate for the purposes of administering your insurance policy and resolving the complaint. Any other personal data that Vhi processes will be on the basis of its legitimate interests in operating its business, or on the basis of a legal obligation to which Vhi is subject.

·         Marketing – if you provide Vhi with your consent to send you marketing messages, Vhi will process your personal data in order to make sure that any marketing messages that Vhi sends to you are relevant to you. Vhi also undertakes market research and surveys, which provides Vhi with market insights. Vhi’s processing of your personal data in relation to marketing and market research will be subject to your consent.

·         Fraud prevention and claims management – it is an unfortunate feature of any insurance product that fraud can occur from time to time. Vhi has a number of systems and procedures in place to monitor for potentially fraudulent claims. If Vhi identifies a suspicious claim or pattern of claims, Vhi will process your personal data in order to investigate the claim and to take appropriate measures to protect itself and its customers. Where Vhi processes health data in connection with fraud prevention and claims management, this will be on the basis that it is necessary and proportionate for the purposes of administering your insurance policy. Any other personal data that Vhi processes will be on the basis of its legitimate interests in preventing fraudulent claims.

·         Administering Vhi’s computer systems – Vhi relies on technology and computer systems to run its business. Vhi has an extensive team of developers and support engineers who are constantly testing its systems, running trials of new software, and providing support to its users. In order to do this, where possible Vhi tries to use test data or anonymised data, but on occasion Vhi may have to access live data directly, or Vhi will often make a copy of some of the data that sits in its live systems and run its tests on that to make sure everything is working before a change is rolled out.

·         Statutory and regulatory obligations – Vhi includes the total number of claims made in relation to a policy in its renewal documentation. This is done to comply with its legal obligations

These copies may include your personal data, including details in relation to claims you have made. In general this processing of your personal data is justified by Vhi’s legitimate interests in making sure its computer systems run properly and are safe and secure. If Vhi processes health data when running these tests or providing support services to its users, this will be on the basis that it is necessary and proportionate for the purposes of providing insurance policies as part of its business.

Collinson’s processing of your personal data:

·         Administering your policies – Collinson will process your personal data in order to administer your policy. This includes processing your personal data in order to make payments, and to maintain its records of the insurance products that you have purchased. Where Collinson processes your personal data in order to administer your policy this will be on the basis that it is necessary in order for the performance of its contract with you.

·         Administering claims – in order to administer a claim that you make under a policy Collinson will need to process personal data in relation to the claim. Where you make a claim in connection with medical treatment, this will include the underlying medical condition that is treated, your medical history, and the medical services that you receive. Collinson will also need to process your personal data in order to deal with claims queries or to deal with complaints queries. If your claim is successful, Collinson will process your personal data in order to cover any claims that you have made, refund you fees that you may have incurred or to pay any service providers directly. Where Collinson process health related claims data, this will be on the basis that it is necessary and proportionate for the purposes of administering your insurance policy. Any other data is processed on the basis that it is necessary in order for the performance of Collinson’s contract with you.

·         Running Collinson’s business – Collinson processes your personal data in order to operate its business, which involves processing personal data in a similar manner to how Vhi processes your personal data for these purposes (see “Running Vhi’s business” above). Where Collinson processes health related claims data, this will be on the basis that it is necessary and proportionate for the purposes of providing insurance policies as part of its business. Any other personal data that Collinson processes will be on the basis of its legitimate interests in operating its business, or on the basis of a legal obligation to which Collinson is subject.

·         Complaints - Collinson will process your personal data in order to deal with complaints queries, complaints resolution and enhance your experience with Vhi products. Where Vhi process complaints data including health related claims information, this will be on the basis that it is necessary and proportionate for the purposes of administering your insurance policy and resolving the complaint. Any other personal data that Collinson processes will be on the basis of its legitimate interests in operating its business, or on the basis of a legal obligation to which Collinson is subject.

·         Administering Collinson’s computer systems -  Collinson processes your personal data in order to operate its computer systems, which involves processing personal data in a similar manner to how Vhi processes your personal data for these purposes (see “Administering Vhi’s computer systems” above). In general this processing of your personal data is justified by Collinson’s legitimate interests in making sure its computer systems run properly and are safe and secure. If Collinson processes health data when running tests or providing support services to its users, this will be on the basis that it is necessary and proportionate for the purposes of providing insurance policies as part of its business. 

In order to process certain personal data in relation to you, Vhi needs your consent (e.g. in connection with some of our marketing activities). When Vhi processes your personal data on the basis of your consent, you are free to withdraw that consent at any time. You can withdraw your consent by contacting Vhi using the contact details at the bottom of this notice. Please note that if you withdraw your consent Vhi may not be able to continue providing you with the service to which the consent related.

Collinson requires certain information from you in order to be able to enter into a contract with you and Vhi requires certain information to provide you with its services. Where this is the case Vhi and/or Collinson will indicate on relevant forms what personal data is required in order to enter into the contract with you. If you do not provide the information, Vhi and/or Collinson will not be able to provide you with their services. 

Vhi and/or Collinson share your personal data with the following third parties:

·         Hospitals and primary care providers – Collinson will provide hospitals and primary care providers with information that allows them to verify that your claim is covered by your policy and the current level of cover that you have. Collinson will also need to make sure that you receive the appropriate treatment.

·         Service providers – Vhi and Collinson rely on trusted third parties to help them run their businesses and to provide them with specialised services. This can include companies that provide IT services, from scanning letters that are received and loading them onto IT systems to companies hosting data when providing software services. Vhi and Collinson also engage with companies that provide them with non-IT related services, such as legal advisors, accountants and consultants. Collinson may also need to share personal data in order to handle any claim that you make. Who Collinson needs to share data with will depend on your particular circumstances at the time of your claim, but examples may include local claims administrators, cost containment specialists and medical/transport repatriation services. Where service providers have access to your personal data, Vhi and Collinson ensure that they are subject to appropriate contracts and other safeguards.

·         Providers of additional benefits – Under your policy you are entitled to avail of a lounge access benefit, which is provided by a third party. Although the lounge access service provider is provided with information to confirm your entitlement to avail of its services, its processing of your personal data is subject to its own separate privacy statement.

·         Underwriters – in the insurance industry it is common practice to engage an underwriter to take on the risks associated with a policy. In such circumstances, the underwriter will be given access to details about your claim in order to process your claim.

·         Regulators – in certain circumstances Vhi or Collinson may be obliged to provide information to a regulator, such as in relation to the investigation of complaints.

·         Group companies – Vhi and Collinson each consist of a number of separate companies. Some of these companies provide services on an intra-group basis in Ireland, and in the case of Collinson in Malta and the UK. The provision of intra-group services may involve the sharing of your personal data between one or more Vhi’s or Collinson’s group companies.

·         Collinson and Vhi may share your personal data (complaints data including health related claims information) with each other for the purposes of dealing with complaints queries, complaints resolution and to enhance your experience with Vhi products.

·         Banking and Financial Institutions - Vhi may share data with banks and other credit and payment institutions to process premium collection including direct debits, funds transfers, credit management, standing orders and other electronic funds transfers as necessary. Collinson may share data with banks and other credit and payment institutions to make claims payments.

There are certain circumstances where Vhi, Collinson and/or its agent CISEL will transfer your personal data outside of the European Union to a country which is not recognised by the European Commission as providing an equivalent level of protection for personal data as is provided for in the European Union. Collinson may need to transfer your personal data outside of the European Union in order to process your claims (e.g. when you make a claim in relation to treatment at a hospital outside of the EU or to provide round the clock customer service). Such transfers of personal data are on the basis that the transfer is necessary in order to perform Collinson’s contractual obligations under your policy.

If Vhi or Collinson or its agents transfer your personal data outside of the European Union for any other reason please rest assured that they will ensure that appropriate measures are in place to protect your personal data and to comply with their obligations under applicable data protection law. This may mean that Vhi or Collinson enter into contracts in the form approved by the European Commission, or use such other GDPR compliant transfer mechanisms that may be approved from time to time. If you would like further details about the measures that Vhi or Collinson have taken in relation to the transfer of your personal data, or copies of the agreements that they have put in place in relation to the transfers, please contact Vhi or Collinson using the details at the bottom of this notice. 

Vhi and Collinson will retain your personal data in accordance with their record retention policies. The record retention policies each operate on the principle that personal data is kept for no longer than is necessary for the purpose for which it was collected, and in accordance with any requirements that are imposed by regulators or by law. This means that the retention period for your personal data will vary depending on the type of personal data. For further information about the criteria that Vhi and Collinson apply to determine retention periods please see below:

• Statutory and regulatory obligations – As Vhi and Collinson work in a highly regulated industry, they each have certain statutory and regulatory obligations to retain personal data for set periods of time.
• Managing legal claims – When assessing how long they keep personal data, Vhi and Collinson take into account whether that data may be required in order to defend any legal claims which may be made. If such data is required, it may be kept until the statute of limitations runs out in relation to the type of claim that can be made (which varies from 2 to 12 years).
• Business requirements – As personal data is only collected for defined purposes, Vhi and Collinson assess how long they need to keep personal data for in order to meet their reasonable business purposes. 

You have various rights under data protection law, subject to certain exemptions, in connection with the processing of your personal data: 

• Right to access the data – You have the right to request a copy of the personal data that is held about you, together with other information about the processing of that personal data.
• Right to rectification – You have the right to request that any inaccurate data that is held about you is corrected, or if incomplete information is held about you, you may request that the information is updated such that it is complete.
• Right to erasure – You have the right to request the deletion of the personal data that is held about you. This is sometimes referred to as the right to be forgotten.
• Right to restriction of processing or to object to processing – You have the right to request that your personal data is no longer processed for particular purposes, or to object to the processing of your personal data for particular purposes.
• Right to data portability – You have the right to request that you, or a third party, are provided with a copy of your personal data in a structured, commonly used machine readable format.

You may make a request to exercise your data subject rights to Vhi or Collinson using the contact details below. Vhi and Collinson have agreed that in circumstances where your request relates to personal data held by both Vhi and Collinson, either jointly or separately, they will cooperate to ensure that your request is processed appropriately. This will mean that Vhi may respond to your request on behalf of Collinson in certain circumstances. 

If you have any queries or wish to make a complaint about Collinson’s processing of your personal data in connection with the handling of your claim, you can contact their data protection officer at:

Postal Address:

Data Protection Officer,

Collinson Insurance Solutions Europe Ltd

3 More London

Riverside (5th Floor)

London SE1 2AQ

England

E-mail Address:

Collinson’s data protection officer at data.protection@collinsongroup.com  

If you have any queries or complaints in connection with Vhi’s processing of your personal data, you can get in touch with Vhi using the following contact details:

Postal Address:

Data Protection Officer:

Vhi House,

Lower Abbey Street,

Dublin 1

E-mail Address:

Vhi’s data protection officer at dataprotection@vhi.ie  

You also have the right to lodge a complaint with the Data Protection Commission (DPC) if you are unhappy with our processing of your personal data.  Details of how to lodge a complaint can be found on the dataprotection.ie website by selecting the appropriate webform, or by writing to the DPC at - Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2. DO2, RD28, Ireland.

Find here.

Find here.

Our promise to you is that ‘when you need us, we’re there’. In order to fulfil that promise, and to provide you with our products and services, we need to get to know you and what your needs are. This means that we collect certain information about you in the course of operating our business. This notice sets out details of the information that we collect, how we process it, to whom we disclose it, and your rights under data protection law in relation to our processing of your data This notice applies to the following VHI Health and Welling being services, collectively referred to as “Services”

1. Digital & First Contact

3. Planned Care

4. Urgent Care

5. Corporate Services

6. Care @ Home (“Services”) 

Vhi Health and Wellbeing DAC, whose registered address is Vhi House, Lower Abbey Street, Dublin 1, is the company that provides all of the Vhi Health Services available to you. Vhi Health and Wellbeing DAC controls and is responsible for personal data that is collected in relation to our member Health & Wellbeing services. If you have any queries in relation to the processing of your personal data, we have appointed a data protection officer that you can contact at DPO@vhi360.ie.

In order to provide our services to you we need to process certain personal data in relation to you, which includes: 

• Biographical data – we collect the following biographical data: name, address, email address, phone numbers, date of birth, gender, employer, next of kin details, general practitioner name and address.
• Health data – we collect personal data from you in connection with the particular health services that we are providing to you. This information is collected directly from you via questionnaires that you fill in, or during the provision of our services to you. It will also include health related data that we derive from any tests that are undertaken (e.g. heart rate, blood pressure, blood tests, hearing tests etc.).
• Payment data – if you pay by credit or debit card for any of the services we will process your credit or debit card details in order to take payment from you. If you pay by cheque, we will process the details listed on the cheque in order to process payment.
• Vhi membership – if the service is being provided under your Vhi Healthcare plan, we will process details about your Vhi membership in order to ensure you are entitled to avail of the particular services that we are offering. We may also process your personal data in order to support a claim that you may make under your Vhi Healthcare plan in connection with the service.
• Interactions with Vhi Healthcare customer services – if you interact with the Vhi customer services department we will record details of those interactions (e.g. records of phone calls, email correspondence and hard copy correspondence). If you make a complaint we will process details in relation to that complaint.
• Digital platforms - when you interact with Vhi's digital platforms you will often provide personal data to Vhi, which you will be aware of when using the services. Vhi also automatically collects data about your use of its services, such as the IP address of the device you use to access the service, the type of device you are using, and how you interact with the services. Further details are available in the cookies policy and/or the data protection notice that accompanies the relevant service. 

Most of the personal data that we collect about you will be gathered from you as part of the services that we offer. However, certain information may be provided by third parties on your behalf, including the following:

• Group members- services are covered by your Vhi Healthcare plan and we will receive verification of your health insurance cover from Vhi Healthcare.
• Medical service providers - we will request a copy of your medical files from third party service providers, such as your GP or other primary care givers.
• Your employer - if a policy is taken out via the organisation that you work for, certain personal information required for the administration of that insurance policy may be provided to us by your employer. Also, your employer may refer you directly to our services such as our Employee Assistance Programme (EAP). This would only be provided with your consent. 

We process your personal data in order to provide you with our services and to assist us in the operation of our business. Under data protection law we are required to ensure that there is an appropriate legal basis for the processing of your personal data, and we are required to let you know what that legal basis is. We set out further details of our processing of your personal data below, together with the legal basis for that processing: 

Data collected

Purposes/activity Legal basis for processing First and last name, email address, Policy Number, contact number, DOB, bank account or other financial details, certain medical data.

Purpose/activity

Providing you with our services. Making/receiving payments to and from you.

Legal basis for processing

• The processing is necessary to perform a contract with you.
• The processing is necessary for medical diagnosis, management of health systems and services
• Your consent.

Data collected

First and last name, email address, Policy Number, contact number, DOB, certain medical data.

Purpose/activity

Processing claims - make a claim for payment from the Vhi company that provides the Vhi Healthcare plan on your behalf.

Legal basis for processing

• The processing is necessary to perform a contract with you.
• The processing is necessary for medical diagnosis, management of health systems and services.
• Your consent.

Data collected

First and last name, email address, Policy Number, certain medical data.

Purpose/activity

Reporting to regulators, audits, compliance controls, responding to queries/requests for information in relation to claims.

Legal basis for processing

• Required in compliance with a legal obligation.
• The processing is necessary for medical diagnosis, management of health systems and services
• Your consent.

Data collected

Name, certain medical data.

Purpose/activity

Providing copies of medical data/results to your GP.

Legal basis for processing

• The processing is necessary to perform a contract with you/provide you with our services.
• The processing is necessary for medical diagnosis, management of health systems and services.
• Your consent.

Data collected

Name, certain medical data.

Purpose/activity

Provide you or a third party with details of your treatment in connection with a personal injuries action.

Legal basis for processing

• The processing is necessary to perform a contract with you.
• Required in compliance with a legal obligation.
• The processing is necessary for medical diagnosis, management of health systems and services.

Data collected

Name, certain medical data.

Purpose/activity

Clinical and non-clinical auditing and quality control, processing your data to meet certain regulatory and legislative obligations. Your data will be anonymized in such circumstances.

Legal basis for processing

• Required in compliance with a legal obligation.
• The processing is necessary for medical diagnosis, management of health systems and services.
• Your consent.

Data collected

Name, membership data, non-medical data.

Purpose/activity

Process your personal data in connection with the general administration of our business, including the generation of reports that detail how the business is functioning.

Legal basis for processing

The processing is necessary to support our legitimate interests in managing our business.

Data collected

Email address.

Purpose/activity

To send you emails that you have opted-in to receive, or having contacted us by email or by other means.

Legal basis for processing

The processing is necessary to support our legitimate interests in managing our business.

Data collected

First and last name, Email address, telephone contact details, any ad hoc information you provide to us.

Purpose/activity

Direct marketing - to contact/respond to prospects regarding additional services and offers.

Legal basis for processing

Your consent.

Data collected

First and last name, email address, location, phone number, professional qualifications, CV, references.

Purpose/activity

To process job applications from candidates for employment within our organisation.

Legal basis for processing

Your consent.

Data collected

Telephone recordings.

Purpose/activity

Recordings of telephone calls with our representatives and call centres, used for maintaining a record of customer transactions we complete over the phone.

Legal basis for processing

• The processing is necessary to support our legitimate interests in managing our business.
• Your consent.

Data collected

CCTV recordings.

Purpose/activity

We use CCTV on our premises to ensure the safety and security of our patients and staff.

Legal basis for processing

• The processing is necessary to support our legitimate interests in managing our business.
• Required in compliance with a legal obligation.

Data collected

Name, email, contact number.

Purpose/activity

To contact you regarding customer satisfaction surveys or questionnaires which we may ask you to complete.

Legal basis for processing

The processing is necessary to support our legitimate interests in managing our business.

Data collected

IP address, browser type etc.

Purpose/activity

To assist the proper operation and functionality of our website.

Legal basis for processing

The processing is necessary to support our legitimate interests in managing our business and maintaining website security.

Data collected

First and last name, email address.

Purpose/activity

To notify you about changes to our Data Privacy Notice.

Legal basis for processing

The processing is necessary to support our legitimate interests in managing our business (to keep our records updated and to study how website users use our services). 

In order to process personal data in relation to you, especially health data, we may need to get your consent in certain circumstances. When we process your personal data on the basis of your consent, you are free to withdraw that consent at any time. You can withdraw your consent by contacting us using the contact details at the bottom of this notice. 

We require certain information from you in order to be able to enter into a contract with you and to provide you with our services. Where this is the case we will indicate on relevant forms what personal data is required in order to enter into the contract with you. If you do not provide the information, we will not be able to provide you with our services.

We may share your personal data with the following third parties:

• Group companies – Vhi consists of a number of separate companies. Some of these companies provide you with health and medical services. Some companies in our group also provide services on an intra-group basis, which may involve the sharing of your personal data between one or more group companies.
• Medical service providers – we may share personal data in relation to you with third parties that provide medical related services to us (e.g. labs that provide blood tests).
• Your GP – depending on the type of services received by you, we may be required under best medical practice guidance to send your GP a copy of the relevant results, and if serious issues are identified we may contact your GP or consultant directly in relation to the results.
• Service providers – we rely on trusted third parties to help us run the Vhi business and to provide us with specialised services. This can include companies that provide IT services, from scanning letters that we receive and loading them onto our systems to hosting data on our behalf when providing software services. We also engage with companies that provide us with non-IT related services, such as payment service providers, legal advisors, accountants and consultants. Where our service providers have access to your personal data, we ensure that they are subject to appropriate contracts and other safeguards.
• Other parties when required by law or as necessary to protect our services - for example, it may be necessary by law, legal process, or court order from governmental authorities to disclose your information. They may also seek your information from us for the purposes of law enforcement, national security, anti-terrorism, or other issues that are related to public security. We will challenge any such requests that are not valid.
• Regulators - in certain circumstances Vhi is obliged to provide information to a regulator, such as in relation to the investigation of complaints.
• Your employer – in certain circumstances Vhi will share you name with your employer if they copay for any of the services you avail of. This can include screening services and also, if you request additional services under the Employee Assistance Programme (EAP).

There are certain circumstances where we will transfer your personal data outside of the European Union to a country which is not recognised by the European Commission as providing an equivalent level of protection for personal data as is provided for in the European Union. If we transfer your personal data outside of the European Union please rest assured that we will ensure that appropriate measures are in place to protect your personal data and to comply with our obligations under applicable data protection law. This may mean that for example we use the new Standard Contractual Clauses approved by the European Commission or use such other GDPR compliant transfer mechanisms that may be approved from time to time. If you would like further details about the measures we have taken in relation to the transfer of your personal data, or copies of the agreements that we have put in place in relation to the transfers, please contact us using the details at the bottom of this notice.

Vhi will retain your personal data in accordance with our record retention policy. The record retention policy operates on the principle that we keep personal data for no longer than is necessary for the purpose for which we collected it, and in accordance with any requirements that are imposed on us by law. This means that the retention period for your personal data will vary depending on the type of personal data. For further information about the criteria that we apply to determine retention periods please see below:

• Statutory and regulatory obligations – as we work in a highly regulated industry, we have certain statutory and regulatory obligations to retain personal data for set periods of time.
• Managing legal claims – when we assess how long we keep personal data we take into account whether that data may be required in order to defend any legal claims which may be made. If such data is required, we may keep it until the statute of limitations runs out in relation to the type of claim that can be made (which varies from 2 to 12 years).
• Business requirements – as we only collect personal data for defined purposes, we assess how long we need to keep personal data for in order to meet our reasonable business purposes. 

You have various rights under data protection law, subject to certain exemptions, in connection with our processing of your personal data:

• The right to be informed about our collection and use of your personal data. This privacy notice should tell you everything you need to know, but you can always contact us to find out more or to ask any questions using the contact details set out below.
• The right to access the personal data we hold about you. 
• The right to have your personal data rectified if any of your personal data held by us is inaccurate or incomplete. It is important that your personal data is kept accurate and up to date. If any of the personal data we hold about you changes, please keep us informed as long as we have that data.
• The right to be forgotten, i.e. the right to ask us to delete or otherwise dispose of any of your personal data that we hold. Please contact us using the details in contact details set out below.
• The right to restrict (i.e. prevent) the processing of your personal data.
• The right to object to us using your personal data for a particular purpose or purposes.
• The right to withdraw consent. This means that, if we relying on your consent as the legal basis for using your personal data, you are free to withdraw that consent at any time.
• The right to data portability. This means that, if you have provided personal data to us directly, we are using it with your consent or for the performance of a contract, and that data is processed using automated means, you can ask us for a copy of that personal data to re-use with another service or business in many cases.
• Rights relating to automated decision-making and profiling. We do not use your personal data in this way.
• The right to lodge a complaint with the Data Protection Commission, if you have any cause for complaint about our use of your personal data. We would welcome the opportunity to resolve your concerns ourselves however, so please contact us first.

In order to exercise any of the above rights, please contact us using the contact details set out below.

If you have any queries or complaints in connection with our processing of your personal data, you can get in touch with us using the following contact details:

• Post: Data Protection Officer, Vhi, Vhi House, 20 Lower Abbey Street, Dublin 1
• E-Mail: DPO@vhi360.ie

You also have the right to lodge a complaint with the Data Protection Commission (DPC) if you are unhappy with our processing of your personal data. Details of how to lodge a complaint can be found on the dataprotection.ie website by selecting the appropriate webform, or by writing to the DPC at - Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2. DO2, RD28, Ireland. 

Find here.

Welcome to the VHI Health and Wellbeing Service. We want to make sure you know how we keep your information safe and what rights you have. Vhi Health and Wellbeing DAC, whose registered address is Vhi House, Lower Abbey Street, Dublin 1, is the company that provides all of the Vhi Health Services available to you.

Vhi must comply with all applicable data protection, privacy and security laws and regulations. We respect your rights to privacy and to the protection of your personal information. This notice sets out an explanation of what information about you we process, why we process your information, with whom your information is shared and a description of your rights with respect to your information.

This notice is to help you understand how we use your information when you visit our clinic. It is designed for you and your parent or legal guardian. If these is anything that you do not understand you can contact us on the details at the end of the page. 

VHI Health and Wellbeing DAC. If you have any questions about how we use it, you can ask the staff at the clinic, or you can email our Data Protection Officer at DPO@vhi360.ie.

When you visit our clinic, we might ask for your name, age, where you live, who are your parents and some health information to. We keep this information safe and only share it with people who need to know.

We use your information to help you get the right care and treatment. We also use it to make sure our clinic runs smoothly and to follow the law.

Further examples of how we process your information include:

• Assess patient experience and satisfaction;
• Carry out audits and compile statistics;
• Process billing and account management;
• Maintain safety and security across our sites;
• Provide support services to patients and their families;
• Send reminders for appointments and follow-up care;
• Manage your treatment / care outside of appointments and in-patient care;
• Share your information with external parties, including those involved in your care (see section ‘Who do we share your information with’);
• Manage our administration and business functions;
• Respond to requests from public bodies, agencies or Gardaí;
• Prevent or lessen a serious and/or imminent threat to somebody’s life, health;
• Process in line with legal obligations;

Most of the information we collect comes from you or your parent or guardian when you visit the clinic. Sometimes we might get information from other doctors or hospitals to help with your treatment.

We will sometimes ask your parent or legal guardian for permission before we use your information. They can also ask us to change information we have about you if it's wrong or not needed any more like if you were to move to a new house and had a new address.

Depending on your age we may ask you directly for consent before we use your information.

We share your information with people who need to know, like doctors, nurses, and other healthcare professionals. We keep your information safe and won't share it with anyone else unless we have to, and we will make sure that person takes your privacy seriously. Sometimes we have to share information because we are required to by law this includes laws designed to protection children.  

We are committed to ensuring that your information is secure with us and with the third parties who act on our behalf. We have a number of security precautions in place to prevent the loss, misuse or alteration of your information. All staff working for the Vhi have a legal duty to keep information about you confidential and all staff are trained in data protection, information security and confidentiality. The Vhi has strict information security policies and procedures in place to ensure that information about you is safe, whether it is held in paper or electronic format. Vhi will monitor and review access and use of email and intranet so that information about you is kept safe and secure. 

We only keep your information for as long as we need it to help you with your treatment. After that, we make sure to keep it safe until we don't need it anymore.

VHI uses video surveillance systems (commonly referred to as CCTV) across all sites and throughout our facilities for the purpose of maintaining the safety and security of staff, patients, visitors and other attendees, traffic management, and to detect, investigate and/or prosecute offences and/or misconduct. VHI will generally store recorded footage for 30 days.

You have the right to know what information we have about you and to ask us for a copy. You can also sometimes ask us not to use your information if you're not happy with how we're using it. Your parent of legal guardian may also be able to exercise some of these rights to your information. You can use our contact details below to exercise these rights. 

• Some of your rights may include the right to receive a copy of and/or access the personal data that we hold about you, together with other information about our processing of that personal data
• the right to request that any inaccurate data that is held about you is corrected, or if we have incomplete information, you may request that we update the information such that it is complete; Employee Data Protection Notice Page 6 of 19
• the right, in certain circumstances, to request that we erase your personal data;
• the right, in certain circumstances, to request that we no longer process your personal data for particular purposes, or object to our use of your personal data or the way in which we process it;
• the right, in certain circumstances, to transfer your personal data to another organisation;
• the right to object to automated decision making and/or profiling; and
• The right to complain to the Data Protection Commissioner. 

Your rights as a data subject may not be exercised in certain circumstances, such as when the processing of your data is necessary to comply with a legal obligation or for the exercise or defence of legal claims. 

We are obliged to respond without undue delay. In most instances, we will respond within one month. If we are unable to deal with your request fully within a one month period (due to the complexity or number of requests), we may extend this period by a further two months. Should this be necessary, we will explain the reasons why.

We hope that you have found this privacy notice useful. To contact us in relation to any aspect of how we are handle your personal information, to exercise your rights, ask questions you can contact our data protection office by post, email or phone through the contact details below.

Contact Details

Data Protection Officer Email: DPO@vhi360.ie
Address: Vhi House, Abbey Street Lower, North City, Dublin, D01 DX77

Phone: (056) 444 4444

Supervisory Authority – Data Protection Commission (DPC)

If you are unhappy with the outcome of your complaint or how your request to exercise your rights in relation to your personal data has been processed by VHI, you also have the right to make a complaint to the Data Protection Commission directly.

Email

info@dataprotection.ie

Website

www.dataprotection.ie

Phone

01 7650100 / 1800437 737

Post

Dublin Office:

Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28.

This data protection notice will be reviewed from time to time to take into account changes in the law and the experience of the notice in practice

This statement relates to the privacy practices of Vhi in connection with Vhi.ie and the Vhi Mobile Health Assistant (the "Website and App"). It sets out the basis on which any personal data that we collect from you, or that you supply to us, in connection with the Website or App will be processed by us. For the purposes of this Data Protection Statement, "we", "our" and "us" refers to one of the Vhi entities.

Where we have entered into contractual agreements with third parties for the provision of services we will provide external links to those third parties websites outlining their terms of use and privacy policies.

In order to use the App you must first download it to your smart phone from the iOS App Store and Google Play Store.

Then either register for the App by providing your name, e-mail, policy number, and date of birth to Vhi at the registration point or alternatively if you have already registered for MyVhi via the Vhi website you may log in with your MyVhi details.

We will process such personal information in order to provide you with access to the Mobile Health Assistant app.

In the App you can enter & view & submit the following personal information:

My Policy: view the benefits and details of your private health insurance plan or your Employee Extras entitlement

Medical and Wellness Features: review and contact the Vhi services available to you

Snap & Send: submit your day to day medical expenses claim with Snap & Send.

It is important to note that the medical information you provide as part of using the Online Doctor feature of the app will never be seen or used by Vhi.

Effective as 12th of April 2020 the following services were provided by VHI Health & Wellbeing Holding DAC, Vhi House, Lower Abbey Street, Dublin 1 were incorporated into the App.

Note: while Health Coach is discontinued as of 01/09/2023 the below privacy policy is still in effect in relation to personal data. 

If you use the Vhi Health Coach Feature:

Vhi Health & Wellbeing DAC registered in Ireland No.628074 with Registered Office: Vhi Lower House Abbey Street, Dublin is the Data Controller.

C3LX, Inc. 8774 Yates Drive Suite 120 Westminster, CO 80031 our licensee is our data processor.

All your personal data will be hosted in Ireland & C3LX will not have access to your personal data.

If you wish to link your tracker Fitbit and/or Garmin please refer to their privacy policies.

The legal basis we will rely on for processing your health data is consent. You will need to consent to the Terms of Use.

If you wish to opt-out of receiving SMS from your coach please text STOP.

The purpose of processing your data is so that you can set yourself health goals and we will provide support and assistance to help you achieve them.

All the certified health coaches you engage with will be employees of Vhi Health and Wellbeing. Each coach is bound by a contractual requirement for confidentiality.

Any data we analyse from this feature will remove all personal identifiers and be used for the purpose of quality and assurance of the coach interactions and/or improving the feature.

We will retain data for a period of seven (7) years from when you agree to the Terms of Use.

If you access the Vhi Digital Health Services feature:

Vhi Health and Wellbeing DAC has an agreement with HealthHero Healthcare Ireland Limited and HealthHero Solutions Limited to provide online health services (GP, Physio, Dietitian, Speech and Language services).

Vhi Health & Wellbeing DAC is registered in Ireland, No.628074, with Registered Office: Vhi Lower House Abbey Street, Dublin.

When your booking is confirmed HealthHero becomes the Data Controller. For further information on the use of your personal data, please read HealthHero`s Privacy Policy. 

Healthhero Healthcare Ireland ltd

2 Dublin Landings,

North Dock, Dublin,

D01 V4A3, Ireland

When you access the Digital Health Services, Vhi confirm your identity and eligibility in accordance with your policy. Depending on the service, access to the services is available to members with either a Private Medical insurance policy, an Employee Extras entitlement or an International Medical Insurance policy.

Consultation details can be accessed within the Vhi App or are emailed directly to you, if you are a current private medical insurance policyholder. The information contained in these documents is made available to your device directly from the HealthHero platform and Vhi has no access to the content of these documents. If your policy is cancelled, lapsed or expired, you should contact HealthHero directly on +353 1 582 9161 or vhisupport@healthhero.com as Vhi does not hold this information.

The appointment history for a dependant is available only to the parent or legal guardian. 

The legal basis HealthHero will rely on for processing your health data is contract and the provision of health care or treatment (Articles 6(1)(b) and 9(2)(h) of the GDPR). You will, in addition, need to consent to the Terms and Conditions of these Services.

Please see HealthHero's Privacy Policy for further information on data retention (as they are a UK company the data retention is determined by UK legislation). 

If you access the Employee Assistance Programme (EAP) feature:

Vhi Health and Wellbeing DAC has an agreement with HealthHero Healthcare Ireland Limited and HealthHero Solutions Limited to provide the EAP services.

Vhi Health & Wellbeing DAC is registered in Ireland, No.628074 with registered office: Vhi Lower House Abbey Street, Dublin.

When your booking is confirmed HealthHero becomes the Data Controller. For further information on the use of your personal data, please read HealthHero`s Privacy Policy.

HealthHero Healthcare Ireland Ltd

2 Dublin Landings,

North Dock, Dublin,

D01 V4A3, Ireland

When you access the EAP Mental Health feature, Vhi confirm your identity and eligibility in accordance with your policy. Access to the feature through the Vhi App is available to members with either a Private Medical Insurance policy with an Employee Assistance Programme benefit or an Employee Extras entitlement.

If your policy is cancelled, lapsed or expired, you should contact HealthHero directly on +353 61 517115 or vhisupport@healthhero.com as Vhi does not hold this information.

The legal basis HealthHero will rely on for processing your health data is contract and the provision of health care or treatment (Articles 6(1)(b), 6(1)(f) and 9(2)(h) of the GDPR). You will, in addition, need to consent to the Terms and Conditions of these Services.

Please see HealthHero's Privacy Policy  for further information on data retention (as they are a UK company the data retention is determined by UK legislation). 

If you use the Employee Extra feature, review: www.vhi.ie/privacy-policy/Employee-Extra

If you use the Symptom Checker feature:

The service is delivered by HealthHero Healthcare Ireland Limited. Any information you enter into the Symptom Checker is anonymised and stored anonymously.

The MyVhi area of the Website allows you to administer healthcare related products and services that we provide you, including viewing claims statements in relation to those products. In order to use the MyVhi section of the Website you must provide us with certain personal details, including your name, email, address, date of birth, phone number and policy numbers. We will process such information in order to provide you with access to the MyVhi section of the Website.

Vhi will process the above information for as long as your MyVhi account is active. Personal data regarding your policy and claims will be retained in accordance with our Data Retention Policy.

Vhi may share certain information with trusted third parties that provide services in relation to data storage and IT security. Where data is transferred to a third-party, Vhi ensure appropriate contractual clauses and technical and organisational safeguards are in place to protect your information. Vhi also ensure the third-party has taken appropriate technical and organisational measures to process, store, and safeguard your information.

Your information is usually stored in the European Economic Area (EEA). However, if we transfer your personal data outside of the EEA we will ensure that appropriate measures are in place to protect your personal data and to comply with our obligations under applicable data protection law.

Information you provide   

When you provide us with information through the Contact Us page, Ask an Expert feature, Current Vacancies feature on the site or through the feedback feature in the app, we will process that information solely for the purposes of responding to your query or processing your job application and feedback.

Information collected via digital interactions:

When you interact with certain Vhi digital services we may need to process information in relation to you, such as details of the interactions with us, e.g. accepting T&Cs, registering to a service, accessing to MyVhi, etc. (and in limited circumstances only Policy ID and Partner ID may be required to be processed and these are labelled below with an *).

Examples of Vhi digital services include (but are not limited to):

·               Mobile App - Login

·               Mobile App - Registration

·               Parkrun - Claim Reward

·               Snap And Send - Claim Submission *

·               Health Coaching - Terms and Conditions Accepted *

·               MyVhi - Login

·               Online GP - Appointment Status (e.g. cancelled appointment, etc.) *

·               Online GP - Terms and Conditions Accepted *

·               Positive Minds – Registration *

Most of your personal data that we collect will be provided by you through your interactions with us by App or by the Vhi website (including the MyVhi customer portal).

We process your personal data in order to develop new product benefits and services, to improve existing products, to evidence member’s registration for a digital service, to confirm that a member has accepted the T&Cs in the event of a query or complaint, to cross check counts for the purposes of paying for digital services (for financial audit purposes) and to ensure that digital services are working as expected on the app and web. We try to do all of the above by using aggregated or anonymous data where possible, so you won’t be identifiable from the data, but some of this work involves processing your data without anonymising it. Any personal data that Vhi processes will be on the basis of its legitimate interests in operating its business, or on the basis that it is necessary in order for the performance of our contract with you. When we process health data in connection with the above operational interactions, this will be on the basis that it is either necessary and proportionate for the purposes of providing health insurance policies as part of our business or it is necessary for providing medical or health related services.

If you visit our website to browse, read or download details, we automatically collect and store information about your use of the website through certain cookies that are set.

Cookies come in two main forms; necessary cookies, which do not require consent and optional cookies, which we ask you to accept when you visit our website. Please refer to our Cookies Policy, which is available here for further information.

Vhi uses an analytics tool called Google Analytics 4 across vhi.ie, MyVhi and corporate portals. You can delete the cookie and the information it gathers at any time, using the settings in your internet web browser. Vhi ensures:

• We have concluded a processor agreement with Google for the processing of Analytics data.

• We have turned off data sharing within Google Analytics.

• We do not use other Google services in combination with the Google Analytics cookies.

• Your device IP address is not visible to third parties.

• Data is retained no longer than 14 months and may be stored in jurisdictions outside the EU with appropriate protections in place.

Vhi uses a mobile app analytics tool called Google Analytics for Firebase to track events and clicks to identify the user journey throughout the App. You can find more information about Google Analytics for Firebase on their privacy and security support page. 

This statement relates to the privacy practices of Vhi in connection with Vhi's Alexa skill. It sets out the basis on which any personal data that we collect from you, or that you supply to us, in connection with the skills will be processed by us. For the purposes of this Data Protection Statement, "we", "our" and "us" refers to Vhi. We are not responsible for the content or privacy practices of other platforms, applications or skills.

In order to use our Alexa skill, you do not need to provide us with any personal information. Should you choose to provide us with personal information this will be processed and stored in line with Alexa's privacy policy 

We may update this Data Protection Statement from time to time. We therefore recommend that you check for updates to the Data Protection Statement before providing such personal data.

In the event that you use the App to locate a parkrun accessible to your current location please note that the App sends your request to parkrun directly (without disclosing any personal data other than your location). The App will then provide you with a list of the five nearest parkruns. The App does not use any location data other than as is strictly necessary to provide you with the list of parkruns and does not use it for any other purpose. From time to time this feature might be disabled; in this case no location data is used.

When you link your parkrun account with the Vhi parkrun Rewards feature you will be asked to provide your parkrun ID to verify your account with parkrun. We will also share your parkrun ID number and your date of birth at this stage to validate your account.

Policy Termination in the event that your Vhi policy is terminated (you leave Vhi or cancel or do not renew your policy or do not hold any other Vhi policies) all data in relation to your parkrun activity sent from parkrun to Vhi will cease to be sent. This includes the information received from parkrun (location of parkrun, timings, parkrun activity). This means your participation in the Vhi parkrun rewards programme has concluded.

If you use the Vhi Midwife Support feature:

To use the Midwife Support Service, Vhi confirm your identify and eligibility in accordance with your policy. For full details review Vhi Privacy Policy.

In order to provide the Midwife Support Service to you, Vhi Health & Wellbeing DAC will process the personal data that you have provided, together with any personal data that you have authorised third parties to provide to us. Certain processing of your personal data is required in order for us to provide the Midwife Support Service and for us to be able to operate the business of providing health services, whereas some processing of your personal data is optional (e.g. sharing medical information). You can indicate your consent to the optional processing of your personal data where asked.

Vhi Health & Wellbeing DAC of Vhi House, Lower Abbey Street, Dublin 1 is the company that controls and is responsible for processing the personal data.

We may update this Data Protection Statement from time to time. We therefore recommend that you check for updates to the Data Protection Statement before providing such personal data.

This notice sets out details of the information that we collect, how we process it and who we share it with. It also explains your rights under data protection law in relation to our processing of your data.

Vhi Healthcare DAC is the company that controls and is responsible for the personal data that is collected in relation to your registration and your interview process for the UX Research. Vhi Healthcare DAC registered address is Vhi House, Lower Abbey Street, Dublin 1, Ireland.

Vhi Healthcare DAC has an agreement with UserTesting, which is the company that provides the platform for UX Research interviews. During the interview process, UserTesting will collect your IP address and will be the Controller of this data. For further information on the use of your personal data by UserTesting, please read: UserTesting`s Privacy Policy. UserTesting registered address is 660 4th Street #246, San Francisco, CA 94107, USA. 

Vhi will collect the following personal data for your registration: full name, email address, phone number, age, policy type (single or family, if you are a Vhi customer).

Health data:

We collect health data from you in relation to any medical condition(s) you may have. This information is collected directly from you when you sign up online to become a member of the research panel. It is optional to provide this data.

During the interviews, the Vhi Research Team will collect video/audio recordings of interviews via UserTesting. All data collected from interviews will be anonymised during the analysis stage, typically within a week from the interview date.  

In order to process your personal data, we use consent, for processing health data we use explicit consent.  You are free to withdraw that consent at any time.  You can withdraw your consent by contacting us using the contact details at the bottom of this notice.  

We share your personal data with the following third parties:

• Service providers - We rely on trusted third parties to provide us with software services, such as UserTesting, Qualtrics and One4all. Where our software providers have access to your personal data, we ensure that they are subject to appropriate contracts and other security safeguards.
• Group companies - Vhi consists of a number of separate companies. Some of these companies provide services to each other which may involve the sharing of your personal data between one or more group companies.
• When we send a panel member a gift card then we share your personal data (full name and email address) with One4all, as they require these details to send you the gift card. For further information on the use of your personal data by One4all please see: One4all Privacy Policy

There are certain circumstances where we may transfer your personal data outside of the EEA to a country which is not recognised by the European Commission as providing an equivalent level of protection for personal data as is provided for in the EEA.  If we transfer your personal data outside of the EEA please rest assured that we will ensure that appropriate measures are in place to protect your personal data and to comply with our obligations under applicable data protection law.  This may mean that we enter into contracts in the form approved by the European Commission, or use such other GDPR compliant transfer mechanisms that may be approved from time to time. If you would like further details about the measures we have taken in relation to the transfer of your personal data, or copies of the agreements that we have put in place in relation to the transfers, please contact us using the details at the bottom of this notice.

Personal data collected at the registration for UX Research is kept until you withdraw your consent. Once you withdrawn your consent, your data will be deleted within two weeks from the date you submitted your request.

All data collected from interviews will be anonymised during the analysis stage, typically within a week from the interview date. The anonymised data is stored for a maximum of 6 months.

Video and its transcripts are stored by UserTesting and deleted from the Zoom cloud within a week of interview date. 

You have various rights under data protection law, subject to certain exemptions, in connection with our processing of your personal data:

• Right to access the data - You have the right to request a copy of the personal data that we hold about you, together with other information about our processing of that personal data.
• Right to rectification – You have the right to request that any inaccurate data that is held about you is corrected, or if we have incomplete information you may request that we update the information such that it is complete.
• Right to erasure – You have the right to request us to delete personal data that we hold about you.  This is sometimes referred to as the right to be forgotten.
• Right to restriction of processing  – You have the right to request that your personal data is no longer processed for particular purposes.
• Right to data portability – You have the right to request that you, or a third party, are provided with a copy of your personal data in a structured, commonly used machine readable format.

In order to exercise any of the above rights, please contact us using the contact details set out below.

If you have any queries or complaints in connection with our processing of your personal data, you can get in touch with us using the following contact details:

• Post: Data Protection Officer, Vhi, Vhi House, Lower Abbey Street, Dublin 1
• E-Mail: dataprotection@vhi.ie

You also have the right to lodge a complaint with the Data Protection Commission (DPC) if you are unhappy with our processing of your personal data.  Details of how to lodge a complaint can be found on the dataprotection.ie website by selecting the appropriate webform, or by writing to the DPC at - Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2. DO2, RD28, Ireland.

If you are a Vhi corporate contact, review: https://www1.vhi.ie/privacy-policy/corporate-contacts