Bupa Blua Health App legal and privacy information
Bupa Blua Health App privacy notice
The Bupa Blua Health App (the ‘App’) is provided to you by Bupa in partnership with Babylon Healthcare Services Limited and Babylon Partners Limited (collectively, ‘Babylon’). Bupa and Babylon are committed to protecting your privacy when dealing with your personal information.
This privacy notice provides details about the information Bupa and Babylon collect and process about you, how that is used and protected. It also provides information about your rights.
Babylon is a controller of the personal information collected and processed when you use the App, including using the Symptom Checker and receiving consultations with clinicians via the App. Bupa is also a controller, and Babylon is a data processor for Bupa, of some of the information collected and processed when you use the App. When this notice describes what happens to personal data, it will be made clear whether it applies to Bupa, Babylon, or both.
If you have any questions about how Bupa and Babylon process information collected through the App, please get in touch using the ‘Data protection contacts’ section at the end of this notice.
For information about how Bupa processes your personal information outside of this App, please see the Bupa privacy notice at www.bupa.co.uk/privacy.
Company details
Bupa (the British United Provident Association Limited) is registered with the Information Commissioner’s Office, registration number Z6831692. Bupa is made up of a number of trading companies, many of which also have their own data protection registrations. Depending on which of our products and services you ask us about, buy or use, different companies within our organisations will process your information. You can find out more about the companies that handle your information, including which company makes decisions about how your information is handled based on the products and services you access or use. Find out more at www.bupa.co.uk/legal-notices
Babylon is registered with the Information Commissioner’s Office, registration number ZA085885 for Babylon Healthcare Services Limited and ZA363572 for Babylon Partners Limited.
The personal data we hold and how we get it
Personal details
When you register for the App, you provide Bupa with basic information about yourself, such as your name, date of birth, physical address and email address.
If you have a consultation, you may also provide us with a copy of identification documentation for ID checks.
Health and medical information
Babylon will collect and process health and medical information that you provide to the App, including information about your health, symptoms, treatments, consultations and sessions, medications and procedures. This includes details of your consultations with clinicians, and other interactions with the App.
Babylon will share health and medical information with Bupa where it’s necessary for Bupa to process it for an insurance purpose (for example, advising on, arranging, providing or managing an insurance policy, dealing with a claim made under an insurance policy, or relating to rights and responsibilities arising in connection with an insurance policy or law), or where you have given consent for Babylon to share data with Bupa, or where otherwise permitted by law.
If you have given consent to do so, we will send the consultation notes taken during your use of the App to your NHS GP.
We will retain audio recordings of consultations with you, so that they can ensure high quality care is provided to you, and, with your consent, to allow Babylon to learn from them to improve Babylon services. These recordings are held securely in accordance with the Babylon retention policy.
Babylon may also hold information about you and your health from other apps, devices and services where you have given your consent to that data being shared. Examples include where you decide to share information collected from a smart watch or similar device with the App.
Technical information and analytics
Babylon may collect the following data when you use the App, where this is allowed by your device or browser settings:
- The IP address used to connect your mobile phone or other device to the internet
- Your browser information, such as Google Chrome or Apple Safari
- Login and operating system
- The make and model of your device
- Resettable device identifiers
- Time zone, language and location settings
- Your mobile network provider and your location (based on your IP address)
- Information about your use of the App, for example when you first used the App or how many time you have visited it
- Information about the products or services you viewed or used
- App response times and updates
- Information about your interactions, like what notifications you opened
What we use your personal data for
Contract
Bupa and Babylon obtain and use your personal information to establish and deliver Bupa’s contract with you.
For example, Babylon may share information with Bupa so that Bupa can create a claim for you, check your eligibility for services and certain procedures, invoice, price services accurately, and pre-authorise claims for you. Bupa will only process the information for purposes that are necessary to carry out these services, which will include: diagnostic codes, referral specialism information, Bupa consultant number, appointment number, time and date, clinician type, and a shared ID between Babylon and Bupa.
Provision of healthcare
Babylon will obtain and use your medical information because this is necessary for medical purposes, including medical diagnosis and the provision of healthcare or treatment. This includes the information collected through consultations with you (such as notes and recordings), and through your use of the App. It may also include sharing information with other healthcare professionals as necessary for the provision of care to you, such as your GP, specialist referral services, therapists, pharmacists, hospitals, accident and emergency services, pathology service providers, and diagnosis centres chosen by you for the purpose of imaging request forms.
Consent
Where you have provided your consent, Babylon will share personal information with Bupa for Bupa to process for analytics purposes, to assist Bupa in understanding more about usage of the App and identify future improvements. This information may include your name, date of birth, your appointment, clinician and referral information, and other similar information which may include your medical information.
Where you have provided your consent, Babylon will use your medical information (always having removed personal identifiers, such as your name, address and contact details) to improve Babylon’s healthcare products and services, and Babylon’s artificial intelligence systems, so that Babylon can deliver better healthcare to you and others. This medical information (de-identified in the way described above) may include your medical record (both records received and created by Babylon), transcripts and recordings of your consultations, and your interactions with artificial intelligence services, such as the Symptom Checker. This does not involve making any decisions about you – it is only about improving products, services and software so that Babylon can deliver a better experience to you and others. Strict confidentiality and data security provisions always apply.
Babylon may obtain and use data about your precise location where you give your consent (through providing Babylon with access to your location), for example, to help direct you to the nearest pharmacy. Babylon may also derive your approximate location from your IP address.
Bupa may use your email address and/or phone number to contact you with occasional updates and marketing messages where you have not objected. You have the right to object to Bupa marketing at any time by emailing [email protected], or via the preference management centre in Bupa Touch.
Legitimate interests
Bupa and Babylon will process some information because it is in Bupa and Babylon’s legitimate interests. For example, for business management and planning, Bupa and Babylon may analyse data about your use of the App to troubleshoot bugs within the App, forecast demand of services and to understand trends, including which features users use the most and find most helpful, and what features users require. This does not involve making any decisions about you – it is only about improving the App so that Bupa and Babylon can deliver better services to you. Strict confidentiality and data security provisions will always apply.
Where necessary, Bupa and Babylon may need to share personal and financial details for the purposes of fraud prevention and detection.
Babylon will store your medical information, such as notes from consultations, recordings of consultations with you and your interactions with the App, for safety, regulatory, and compliance purposes. For example, Babylon may need to review your information and, where necessary, make disclosures in compliance with reasonable requests by regulatory bodies including the General Medical Council, MHRA, and Care Quality Commission, or as otherwise required by law or regulation.
Where necessary for safety, regulatory and/or compliance purposes, Babylon may audit consultations and your other interactions with the App (e.g. the Symptom Checker). Strict confidentiality and data security provisions will always apply.
Vital interests, public task and legal obligations
Bupa and Babylon may process your personal information where it is necessary to protect interests that are essential to your life. For example, for emergency medical care, to perform a necessary task in the public’s interest, and/or to comply with a legal obligation.
Insurance
Babylon will share your data with Bupa where it’s necessary for Bupa to process it for an insurance purpose (for example, advising on, arranging, providing or managing an insurance policy, dealing with a claim made under an insurance policy, or relating to rights and responsibilities arising in connection with an insurance policy or law).
Sharing your personal data with others
Bupa and Babylon may share your personal data with members of their corporate groups and partner organisations, to help deliver services to you.
- Bupa and Babylon may share your personal data with companies we have hired to provide services on our behalf, including those who act as data processors on our behalf, acting strictly under contract in accordance with data protection legislation. Those data processors are bound by strict confidentiality and data security provisions, and they can only use your data in the ways specified by Bupa and Babylon.
- Bupa and Babylon may share aggregated data with commercial partners that does not personally identify you, but which shows general trends, for example, the number of users of the service.
- Babylon will, where necessary for the provision or funding of treatment or care, share your information with Bupa where Bupa is your insurer, and with other health and social care providers. For example, your NHS GP and other NHS bodies, specialist referral services, therapists, pharmacists, hospitals, accident and emergency services, pathology service providers, diagnosis centres chosen by you for the purpose of imaging requests, and other health and care bodies. This may include sharing information with such services for safeguarding purposes in accordance with Babylon’s legal obligations.
- Bupa may share your information with relevant policy holders (including your employer if you’re covered under a group scheme), funders arranging services on your behalf and people acting on your behalf (for example, brokers and other agents).
- Bupa and Babylon may preserve or disclose information about you to comply with a law, regulation, legal process, or governmental request; to assert legal rights or defend against legal claims; or to prevent, detect, or investigate illegal activity, fraud, abuse, violations of our terms, or threats to the security of our services or the physical safety of any person.
Retention periods
Babylon retains your medical records in accordance with national best practice guidance – in particular, advice provided by the Department of Health (2006) Records management: NHS code of practice, and summary guidance issued by the British Medical Association. The below is a summary of the Babylon retention policy, but both Babylon and Bupa may retain records for other periods as required by law or regulation.
|
Type of record |
Retention period |
|---|---|
|
GP records |
GP Records retained for 10 years after death or after the patient has permanently left the country unless the patient remains in the European Union. In the case of a child, if the illness or death could have potential relevance to adult conditions or have genetic implications for the family of the deceased, the advice of clinicians should be sought as to whether to retain the records for a longer period. |
|
Maternity records |
25 years after the birth of the last child. |
|
Records relating to persons receiving treatment for a mental disorder within the meaning of mental health legislation |
20 years after the date of the last contact; or 10 years after the patient's death if sooner. |
|
Type of record |
Retention period |
|---|---|
|
GP records |
GP Records retained for 10 years after death or after the patient has permanently left the country unless the patient remains in the European Union. In the case of a child, if the illness or death could have potential relevance to adult conditions or have genetic implications for the family of the deceased, the advice of clinicians should be sought as to whether to retain the records for a longer period. |
|
Maternity records |
25 years after the birth of the last child. |
|
Records relating to persons receiving treatment for a mental disorder within the meaning of mental health legislation |
20 years after the date of the last contact; or 10 years after the patient's death if sooner. |
To find out about Bupa’s retention periods, please get in touch using ‘Data protection contacts’ below.
Data storage, security and transfers
Babylon does not store your personal health information on your mobile device. All your personal health information – including primary care information, medication information and diagnostic information – is stored on secure servers.
Where you have chosen a password that enables you to access certain parts of the App, you are responsible for keeping this password confidential. You should ensure that your password is sufficiently complex. Do not share the password with anyone.
Babylon does not store any credit or debit card information. Payments are processed via a third party payment provider that is fully compliant with Level 1 Payment Card Industry (PCI) data security standards. Payment transactions are encrypted using SSL technology.
Babylon encrypts data transmitted to and from the App. Once Babylon have received your information, Babylon will use strict procedures and security features to try to prevent unauthorised access.
Your data may be processed or stored in locations outside the United Kingdom, but always in accordance with data protection law and subject to strict safeguards. For example, Babylon and Bupa works with third parties to use their software platforms who have servers outside the UK to send communication emails to our users.
Babylon and Bupa will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this privacy policy.
Your rights
If Bupa or Babylon rely on your consent to process your personal information, you have the right to withdraw your consent at any time by accessing the privacy settings in the App.
You also have specific rights under UK data protection law, including to:
- Understand what information Bupa and Babylon process about you and obtain a copy of that information.
- Ask Bupa and Babylon to rectify or erase information each holds about you, (subject to limitations relating to our obligation to store medical records for prescribed periods of time).
- Ask Bupa and Babylon to restrict processing of your personal data or object to processing.
You may also contact the Information Commissioner's Office (the data protection regulator in the UK): Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, telephone: 0303 123 1113 (local rate).
Data protection contacts
Bupa: For data protection questions related to processing by Bupa, you can email [email protected] or view the Bupa main privacy notice at www.bupa.co.uk/privacy.
Babylon: For data protection questions related to processing by Babylon, you can email [email protected].
