Privacy Information

PRIVACY NOTICE

The purpose of this privacy notice is to explain how, and for what purposes, we use the information we collect about you. Please read this notice carefully.

Please note that we are not your insurer. If you wish to find out how your insurer uses your personal data, you should contact your insurer. You can find out how you can identify your insurer in section 4 below.

This notice may be updated from time to time: this version is dated 23 May 2018.

In this notice:

  • we, us or our refers to Generali Global Health Services; and
  • you or your refers to the individual whose personal data is being processed by us (you may be the policyholder, beneficiary, claimant or other person involved in a claim or relevant to an insurance policy).

The other terms in bold have specific meanings. Those meanings can be found in the glossary in section 12 below.

This notice sets out the following:

Generali Global Health Services is the trading name of CMN Global Inc. We provide services in connection with health insurance policies, including administering the claims under such policies.

We will use your personal data acting as data controller and we have appointed a data protection officer to oversee our handling of personal data.

If you have any questions concerning the processing of your personal data, or if you want to exercise a right in respect of your personal data, you can contact our data protection officer in the following ways:

  • by post:  The Data Protection Officer

Generali Global Health Services

150 Commerce Valley Drive West

Suite 900 Thornhill

ON L3T 7Z3 Canada

  • by email:  privacy@gghs.ca

In order for us to provide services in connection with the provision of insurance policies, such as our customer services function, and/or to handle claims or complaints, we need to collect and process personal data about you. The personal data we collect and process will depend on our relationship with you. The types of personal data that may be processed include:

 

Types of personal data

Details

Individual details

Name, address (including proof of address), other contact details (e.g. email and telephone numbers), gender, marital status, date and place of birth, nationality, employer, job title, and family details, including their relationship to you.

Identification details

Identification numbers issued by government bodies or agencies, including your national insurance number, passport number, tax identification number and driving licence number.

Financial information

Bank account, payment card details or other financial information.

Risk details

Information about you which was collected in order to assess the risk to be insured and provide a quote. This may include data relating to your health or other special categories of personal data.

Insurance policy information

Information about the quotes you receive and policies you take out.

Anti-fraud data

Sanctions and criminal offences, and information received from various anti-fraud databases relating to you.

Previous and current claims

Information about previous and current claims, (including other unrelated insurances),which may include data relating to your health, criminal convictions, or other special categories of personal data and in some cases, surveillance reports..

Special categories of personal data

Certain categories of personal data which have additional protection under data protection law. The categories include health and genetic data or data concerning sex life or sexual orientation.

 

We might collect your personal data from various sources, including:

  • you;
  • your family members or employer;
  • other insurance market participants;
  • in the event of a claim, third parties including the other party to the claim (claimant/defendant), witnesses, experts (including medical experts), medical services providers, loss adjustors, solicitors, and claims handlers; and
  • anti-fraud databases, sanctions lists, court judgments and other databases.

Which of the above sources apply will depend on our relationship with you.

The provision of insurance involves the sharing of your personal data between insurance market participants, some of which you will not have direct contact with. We also work with other individuals and organisations, such as medical services providers, to provide our services to you, and this may involve them handling your personal data. In addition, your personal data may not have been collected directly by an insurance market participant or other individual or organisation we work with.

You can find out the identity of the initial data controller of your personal data within the insurance market in the following ways:

  • where your employer or another organisation took out the insurance policy for your benefit: you should contact your employer or the organisation that took out the insurance policy who should provide you with details of the insurer or intermediary to whom they provided your personal data and you should contact their data protection contact who can advise you on the identities of other organisations to whom they have passed your personal data.
  • where you took out the insurance policy yourself: the insurer and, if purchased through an intermediary, the intermediary will be the initial data controller and their data protection contact can advise you on the identities of other organisations to whom they have passed your personal data.
  • where you are not a policyholder: you should contact the organisation that collected your personal data who should provide you with details of the relevant organisation’s data protection contact.

In this section we set out each use we make of your personal data, and the corresponding legal grounds which apply for that particular use. We may process your personal data for a number of different purposes. For each purpose, we must have a legal ground for such processing.

We set out in the table below:

  • the purposes for which we might use your personal data;
  • the categories of personal data processed for that purpose;
  • the legal grounds for processing that personal data;
  • to which third parties your personal data may be disclosed.

Purpose

Categories of data

Legal grounds

Disclosures

Insurance policy set-up (including policy renewal)

 

Setting you and/or your employer up as a client, including possible fraud, sanctions and anti-money laundering checks (including.

 

Personal data

  • Individual details
  • Identification details
  • Financial information

 

Personal data

  • Consent

 

  • Insurance market participants
  • Group companies
  • Anti-fraud databases

Special categories of data

  • Anti-fraud data

 

 

Special categories of data

  • Consent

 

 

Insurance policy administration

 

General client care, including communicating with you regarding administration and requested changes and sending you updates.

Personal data

  • Individual details
  • Insurance policy information

Personal data

  • Consent

 

  • Insurance market participants
  • Group companies
  • Medical services providers

 

 

Special categories of data

  • Risk details
  • Previous claims
  • Current claims

 

 

Special categories of data

  • Consent

 

Claims processing

 

Managing insurance claims and anti-money laundering and sanctions checks

Personal data

  • Individual details
  • Identification details
  • Financial information
  • Insurance policy information

Personal data

  • Consent

 

  • Insurance market participants
  • Claims handlers
  • Solicitors
  • Loss adjusters
  • Experts
  • Third parties involved in the claim, including medical services providers
  • Group companies

 

Special categories of data

  • Risk details
  • Previous claims
  • Current claims

 

Special categories of data

  • Consent

 

Claims processing

 

Defending or prosecuting legal claims

Personal data

  • Individual details
  • Identification details
  • Financial information
  • Insurance policy information

 

Personal data

  • Consent

 

  • Insurance market participants
  • Claims handlers
  • Solicitors
  • Loss adjusters
  • Experts
  • Third parties involved in the claim, including medical services providers
  • Group companies

 

Special categories of data

  • Risk details
  • Previous claims
  • Current claims
  • Anti-fraud data

 

Special categories of data

  • Consent

 

Claims processing

 

Investigating and prosecuting fraud

Personal data

  • Individual details
  • Identification details
  • Financial information
  • Insurance policy information

 

Personal data

  • Consent

 

  • Insurance market participants
  • Solicitors
  • Private investigators
  • Police
  • Experts
  • Third parties involved in the investigation or prosecution
  • Anti-fraud databases
  • Group companies

 

Special categories of data

  • Health data
  • Criminal records data
  • Risk details
  • Previous claims
  • Current claims
  • Anti-fraud data

 

Special categories of data

  • Consent

 

Special categories of data

  • Risk details
  • Previous claims
  • Current claims

 

Special categories of data

  • Consent

 

 

Throughout the insurance lifecycle

 

Company sales and reorganisations

 

Personal data

  • Individual details
  • Identification details
  • Financial information
  • Insurance policy information

 

Personal data

  • Consent

 

  • Courts
  • Purchaser/transferee
  • Group companies

 

Special categories of data

  • Risk details
  • Previous claims
  • Current claims
  • Anti-fraud data

 

Special categories of data

  • Consent

 

Throughout the insurance lifecycle

 

Provision of added value services

 

Personal data

  • Individual details
  • Identification details
  • Financial information
  • Insurance policy information

 

Personal data

  • Consent

 

  • Group companies
  • Third parties involved in the provision of added value services

 

Special categories of data

  • Risk details
  • Previous claims
  • Current claims
  • Anti-fraud data

 

Special categories of data

  • Consent

 

Throughout the insurance lifecycle

 

Complying with our legal and regulatory obligations

 

Personal data

  • Individual details
  • Identification details
  • Financial information
  • Insurance policy information

 

Personal data

  • Consent
  • Regulatory bodies
  • Police
  • Other insurers (under court order)
  • Group companies

 

Special categories of data

  • Risk details
  • Previous claims
  • Current claims
  • Anti-fraud data

 

Special categories of data

  • Consent

 

Maintaining records

 

Keeping records for accounting purposes and analysis of financial results

 

 

 

Personal data

  • Individual details
  • Identification details
  • Financial information
  • Insurance policy information

 

Personal data

  • Consent

 

  • Group companies

Special categories of data

  • Risk details
  • Previous claims
  • Current claims
  • Anti-fraud data

 

Special categories of data

  • Consent

 

 

In order to process your personal data for the purposes set out in section 5 above, we need your consent.

You may withdraw your consent to such processing at any time. However, if you withdraw your consent this will impact our ability to provide services related with your insurance policy or pay claims.

We will keep your personal data only for so long as is necessary and for the purpose for which it was originally collected. In particular, for so long as there is any possibility that either you or we may wish to bring a legal claim in relation to the services we have provided, or where we are required to keep your personal data due to legal or regulatory reasons.

We may need to transfer your personal data to third parties acting on our behalf or to insurance market participants which are located in countries which may have lower standards of data protection than Canada. Those transfers would always be made in compliance with applicable data protection law.

We have put in place technical and organisational security measures to prevent the loss or unauthorised access of your personal data. These include putting in place contractual protections which have the purpose of ensuring the security of any personal data transferred.

If you would like further details of how your personal data would be protected if transferred, please contact us.

Profiling may be used by us to assess your personal data for purposes which include understanding fraud patterns.

Where special categories of personal data are relevant, such as medical history for health insurance, your special categories of personal data may also be used for profiling.

For the purposes set out in section 5, above, we may also make decisions about you without human intervention (known as automatic decision making). Our automatic decision making may include decisions made about you based on profiling.

You can request from us a manual review of an automatic decision if you are unhappy with it.

If you have any questions in relation to our use of your personal data, please contact us. Under certain conditions, you may have the right to require us to:

• provide you with further details on the use we make of your personal data/special category of data;

• provide you with a copy of the personal data that you have provided to us;

• update any inaccuracies in the personal data we hold;

• delete any special category of data/personal data that we no longer have a lawful ground to use;

• where processing is based on consent, to withdraw your consent so that we stop that particular processing;

• object to any processing based on the legitimate interests ground unless our reasons for undertaking that processing outweigh any prejudice to your data protection rights; and

• restrict how we use your personal data whilst a complaint is being investigated.

In certain circumstances, we may need to restrict the above rights in order to safeguard the public interest (e.g. the prevention or detection of crime) and our interests (e.g. the maintenance of legal privilege).

There will not normally be a charge by us for dealing with the exercise of your rights above. 

If you are not satisfied with our use of your personal data or our response to any request by you to exercise any of your rights in section 10 above, or if you think that we have breached data protection law, then you have the right to complain.

The Office of the Privacy Commissioner of Canada can help direct your complaint, and they can be contacted here:

Office of the Privacy Commissioner of Canada

30, Victoria Street

Gatineau, Quebec

K1A 1H3

www.priv.gc.ca/en/contact-the-opc

Beneficiary is an individual or a company that an insurance policy states may receive a payment under the insurance policy if an insured event occurs. A beneficiary does not have to be the policyholder and there may be more than one beneficiary under an insurance policy.

Claimant is either a beneficiary who is making a claim under an insurance policy or an individual or a company who is making a claim against a beneficiary where that claim is covered by the insurance policy.

Consent is your explicit consent to the processing of your personal data for one or more specified purposes. You are free to withdraw your consent by contacting us. However withdrawal of this consent will impact our ability to provide services or pay claims. For more detail see section 6.

Data controller is the entity which determines the purposes for which, and the manner in which, personal data is processed. The data controllers of your personal data include us and the other insurance market participants who share or receive your personal data.

Data protection law means all applicable data protection law, including the Personal Information Protection and Electronic Documents Act and the EU General Data Protection Regulation.

Insurance market participant or participants means an intermediary, insurer or reinsurer and their affiliates and subcontractors.

Insurer (sometimes also called underwriters) provide insurance cover to policyholders in return for premium. An insurer may also be a reinsurer.

Intermediaries help policyholders and insurers arrange insurance cover. They may offer advice and handle claims. Many insurance and reinsurance policies are obtained through intermediaries.

Personal data means the data described in section 2 above.

Policyholder is the individual or company in whose name the insurance policy is issued. A potential policyholder may approach an intermediary to purchase an insurance policy or they may approach an insurer directly.

Profiling means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

Reinsurers provide insurance cover to another insurer or reinsurer. That insurance is known as reinsurance.

Special categories of personal data means those categories of data described in section 2 above as special categories of data which have additional protection under data protection law, such as health data.