Be.Me Legal Information

Managing Your Data

The Be.Me Service is provided to you by Bupa Occupational Health Limited (Company Number: 00631336) whose registered office is at 1 Angel Court, London, EC2R 7HJ (referred to as "Bupa" “we” or “us”). Bupa is registered with the Information Commissioner's Office (Registration Number: Z6196086).

Bupa requires your consent to process personal data concerning your health for the provision of certain Be.Me Services. Any health, ethnicity or sexual preference information you chose to provide to Bupa, which is not necessary for us to provide this service to you, or where you are not a health assessment customer, requires your consent. You have the right to withdraw consent at any time, which you can do by emailing [email protected]. However, if you decide to withdraw this agreement, Bupa will no longer be able to provide you with access to any part of the Be.Me Services.

Where you attend a health assessment with Bupa, we may ask you to provide information regarding your health, ethnicity or sexual orientation via the Be.Me Services which is necessary for us to provide this service to you. For details of how this information will be processed by Bupa, please visit our Privacy Notice at www.bupa.co.uk/privacy.

Where you are an employee of one of our corporate customers, we may also share anonymised information collected by Be.Me to enable your employer to have a better understanding of the health and wellbeing of its workforce. Any publishing of such data will be in an anonymised, statistical form. Anonymous or aggregated data may also be used by Bupa for research or statistical purposes.

As part of the Be.Me service, Bupa may send you tailored content to reflect areas in respect of which you’ve indicated an interest. If you don’t want to receive marketing about Bupa products and services that we think are relevant to you, please contact us at [email protected]. For further details of how your information will be processed by Bupa, please visit our Privacy Notice at www.bupa.co.uk/privacy.

Be.Me Cookies and Other Technologies

Please be aware, this Cookie Policy is only applicable to the Be.Me Portal. This Cookie Policy is not applicable to the Be.Me App which does not use cookies.

When you use the Be.Me Portal, we and third-party companies collect information by using cookies and other technologies such as pixel tags (for simplicity we refer to all such technologies as 'cookies'). A cookie is a text file containing small amounts of information which a server may download to your computer, mobile or tablet when you visit a website or use an app. A pixel tag (sometimes called a web beacon) is an invisible image with a line of code which is placed within an email message or on a web page.

There are different types of cookies which are used to do different things. These include letting you navigate between different pages on a website efficiently, remembering preferences you have given and helping us to identify ways to improve your overall site experience. Others may be used to provide you with advertising which is more tailored to your interests, or to measure the number of site visits and the most popular pages users visit. To find out more about cookies visit aboutcookies.org or allaboutcookies.org.

To help you understand the different types of cookies we use on the Be.Me Portal and what they do, we have grouped cookies into four categories as described in the ‘Cookies used on the Be.Me Portal’ section below.

Information collected via cookies and other technology

The cookies used on the Be.Me Portal do not collect directly identifiable personal information such as name, address, email address etc. However, certain cookies may collect information which relate to a unique ID or another identifier which, when combined with other information, could allow a profile to be created.

Cookies used on the Be.Me Portal

We have grouped the cookies used on the Be.Me Portal into four categories, as set out below, where you will also find a list of the cookies used on the Be.Me Portal and a brief description of the information they gather.

As well as the cookies we use, we work with third-party companies who place cookies on your device. For a list of third parties we use, please see below. Please note that the data they collect may also be subject to their privacy policies.

When working with third-party companies we take steps to protect your data. For example, we place contractual limits on how data collected about people using our services is used and we regularly audit the Be.Me Portal to make sure only cookies we have authorised are being used.

1. Necessary cookies

These cookies let you move around the Be.Me Portal and use essential features such as accessing secure areas of the Be.Me Portal and identifying you as being logged in. These cookies don't gather any information about you that could be used for marketing or remembering where you've been on the internet.

Cookie source

Name

Purpose

More information (external links)

Wellpoint

cb_enabled

Used to store that user has accepted terms of the cookie.

Microsoft .NET

ASP.NET_SessionId

Stores the unique identifier of the user’s session on the Be.Me Portal

Microsoft .NET

.AspNet.ApplicationCookie

Basically an Authentication cookie that indicates that a user is authenticated to use app. The OWIN authentication middleware will not check the database if there is a valid cookie in an incoming request. It will simply use the presented encrypted claims (username, possibly roles and other) in the cookie.

Microsoft Azure

ARRAffinity

Affinity Cookies are used to aid people who need to stay with a certain instance of web app or web site in Azure. The reason for this is that we strive for statelessness, but do not always achieve it. This means that the user must stay on the particular instance that they are using until they break state and then things are saved at that time.

Microsoft Azure

ASLBSA

Microsoft App Service and Front Door Affinity Cookies. These cookies are used to direct your browser to use the appropriate backend server.

Microsoft Azure

ASLBSACORS

Used to distribute traffic to the website on several servers in order to optimise response times.

Microsoft Azure

ARRAffinitySameSite

Microsoft App Service and Front Door Affinity Cookies. These cookies are used to direct your browser to use the appropriate backend server.

Microsoft .NET

_RequestVerificationToken

This is an anti-forgery cookie set by web applications built using ASP.NET MVC technologies. It is designed to stop unauthorised posting of content to a website, known as Cross-Site Request Forgery.

Cookie source

Name

Purpose

More information (external links)

Wellpoint

cb_enabled

Used to store that user has accepted terms of the cookie.

Microsoft .NET

ASP.NET_SessionId

Stores the unique identifier of the user’s session on the Be.Me Portal

Microsoft .NET

.AspNet.ApplicationCookie

Basically an Authentication cookie that indicates that a user is authenticated to use app. The OWIN authentication middleware will not check the database if there is a valid cookie in an incoming request. It will simply use the presented encrypted claims (username, possibly roles and other) in the cookie.

Microsoft Azure

ARRAffinity

Affinity Cookies are used to aid people who need to stay with a certain instance of web app or web site in Azure. The reason for this is that we strive for statelessness, but do not always achieve it. This means that the user must stay on the particular instance that they are using until they break state and then things are saved at that time.

Microsoft Azure

ASLBSA

Microsoft App Service and Front Door Affinity Cookies. These cookies are used to direct your browser to use the appropriate backend server.

Microsoft Azure

ASLBSACORS

Used to distribute traffic to the website on several servers in order to optimise response times.

Microsoft Azure

ARRAffinitySameSite

Microsoft App Service and Front Door Affinity Cookies. These cookies are used to direct your browser to use the appropriate backend server.

Microsoft .NET

_RequestVerificationToken

This is an anti-forgery cookie set by web applications built using ASP.NET MVC technologies. It is designed to stop unauthorised posting of content to a website, known as Cross-Site Request Forgery.

2. Analytics cookies

These cookies collect information about how visitors use the Be.Me Portal. This includes details of the site where the visitor has come from (eg referring domains, search engines and marketing campaigns), pages viewed, the site path of the visitor, which content visitors are clicking on and which products visitors are interested in and purchases. Plus, the total number of times a visitor has been to the Be.Me Portal.

We use the information to improve the Be.Me Portal and enhance the experience of its visitors. We may share this information with analytics and search engine providers that assist us in the improvement and optimisation of our site.

By using the Be.Me Portal, you agree that we can place these types of cookies on your computer or device.

Cookie source

Name

Purpose

More information
(external links)

Google Analytics

ga, gat, gid

• Determine which domain to measure
• Distinguish unique users
• Throttle the request rate
• Remember the number and time of previous visits
• Remember traffic source information
• Determine the start and end of a session
• Remember the value of visitor-level custom variables

All data collected by Google Analytics is anonymous
and cannot be used to identify individuals user behaviour.
https://developers.google.com/analytics/devguides/collection
/analyticsjs/cookie-usage

Microsoft

ai user/ai session

Application Insights – It creates a cookie so it recognises returning users and efficiently send telemetry data to Azure.

Cookie source

Name

Purpose

More information
(external links)

Google Analytics

ga, gat, gid

• Determine which domain to measure
• Distinguish unique users
• Throttle the request rate
• Remember the number and time of previous visits
• Remember traffic source information
• Determine the start and end of a session
• Remember the value of visitor-level custom variables

All data collected by Google Analytics is anonymous
and cannot be used to identify individuals user behaviour.
https://developers.google.com/analytics/devguides/collection
/analyticsjs/cookie-usage

Microsoft

ai user/ai session

Application Insights – It creates a cookie so it recognises returning users and efficiently send telemetry data to Azure.

3. Functionality cookies

These cookies allow the Be.Me Portal to remember choices you make (such as your username, language or the region you are in) and provide enhanced, more personal features. These cookies can also be used to remember changes you have made to text size, fonts and other parts of web pages that you can customise. They may also be used to provide services you have asked for such as watching a video or commenting on a blog.

By using the Be.Me Portal, you agree that we can place these types of cookies on your computer or device.

Cookie source

Name

Purpose

More information
(external links)

Be.Me Portal

MenuClosed

This cookie indicates if the menu was last left in a closed state or not.

Cookie source

Name

Purpose

More information
(external links)

Be.Me Portal

MenuClosed

This cookie indicates if the menu was last left in a closed state or not.

4. Advertising cookies

These cookies are used to collect information about your browsing habits to deliver advertising more relevant to you and your interests. The personalisation of ads may be based on data collected about your use of our services (for example what pages you visit) and other data attributed to you by the ad platform. These include data points such as interests, age, gender and similar statistical characteristics inferred from internet browsing or marketing data that an advertiser holds about you.

To find out more about how ad personalisation works please visit: http://www.youronlinechoices.com

How can you control the use of cookies?

Cookies can be set and controlled by the operator of a website which the user is browsing such as Bupa for the Be.Me Portal (known as a ‘first party cookie’) or a third party such as Facebook, for example to display advertisements and social sharing features, (known as a ‘third party cookie’).

You can use your browser settings to manage cookies including deleting cookies previously stored and blocking cookies from being set.

Cookie source	Name	Purpose
Wellpoint	cb_enabled	Used to store that user has accepted terms of the cookie.
Microsoft .NET	ASP.NET_SessionId	Stores the unique identifier of the user’s session on the Be.Me Portal
Microsoft .NET	.AspNet.ApplicationCookie	Basically an Authentication cookie that indicates that a user is authenticated to use app. The OWIN authentication middleware will not check the database if there is a valid cookie in an incoming request. It will simply use the presented encrypted claims (username, possibly roles and other) in the cookie.
Microsoft Azure	ARRAffinity	Affinity Cookies are used to aid people who need to stay with a certain instance of web app or web site in Azure. The reason for this is that we strive for statelessness, but do not always achieve it. This means that the user must stay on the particular instance that they are using until they break state and then things are saved at that time.
Microsoft Azure	ASLBSA	Microsoft App Service and Front Door Affinity Cookies. These cookies are used to direct your browser to use the appropriate backend server.
Microsoft Azure	ASLBSACORS	Used to distribute traffic to the website on several servers in order to optimise response times.
Microsoft Azure	ARRAffinitySameSite	Microsoft App Service and Front Door Affinity Cookies. These cookies are used to direct your browser to use the appropriate backend server.
Microsoft .NET	_RequestVerificationToken	This is an anti-forgery cookie set by web applications built using ASP.NET MVC technologies. It is designed to stop unauthorised posting of content to a website, known as Cross-Site Request Forgery.

Cookie source	Name	Purpose	More information (external links)
Google Analytics	ga, gat, gid	• Determine which domain to measure • Distinguish unique users • Throttle the request rate • Remember the number and time of previous visits • Remember traffic source information • Determine the start and end of a session • Remember the value of visitor-level custom variables	All data collected by Google Analytics is anonymous and cannot be used to identify individuals user behaviour. https://developers.google.com/analytics/devguides/collection /analyticsjs/cookie-usage
Microsoft	ai user/ai session	Application Insights – It creates a cookie so it recognises returning users and efficiently send telemetry data to Azure.