Bupa Healthy Cities App Privacy Notice
Last modified: March 14th, 2025
The British United Provident Association Ltd (‘Bupa’) is committed to protecting your personal data and using it responsibly. This privacy notice sets out how Bupa and other companies part of the Bupa Group process your personal data in connection with the Healthy Cities Challenge App (the ‘App’) available through the Apple App Store, and the Google Play Store.
Any
subsequent updates to this notice will be posted on this page and notified to
you by push notification within the App or by email. The updated
notice may be displayed on-screen, and you may be required to read and
acknowledge the changes to continue your use of the App.
It is important that the personal data we
hold about you is accurate and current. Please keep us informed if your
personal data changes during our relationship with you. You can update your
information in the App at any time.
This App is not intended for children, and we do not knowingly collect
personal data relating to children.
In this privacy notice, ‘Bupa’, ‘we’, ‘us’ and ‘our’ mean The British United Provident Association Limited. Bupa is registered with the Information Commissioner’s Office, registration number Z6831692. Bupa is the ‘data controller’ of the information you share with us when using the App. We can be contacted by email at dataprotection@bupa.com or by post at the following address:
Bupa, Privacy Team,
1 Angel Court,
City of London, EC2R 7HJ,
United Kingdom
‘Sanitas’ means Sanitas Sociedad Anónima de Seguros, with registered address at C/ Ribera del Loira, 52, 28042, Madrid (Spain), registered under Tax Identification Code Number A-28037042.
‘Bupa Australia’ means Bupa HI Pty Ltd, a registered Australian Private Company under ABN 81 000 057 590, with its registered office at Level 16, 33 Exhibition Street, Melbourne VIC 3000, Australia.
‘Care Plus' means Care Plus Medicina Assistencial Ltda., a legal entity governed by private law
registered with the CNPJ/ME under no. 02.725.347/0001-27, with its registered
office at Alameda Mamoré, no. 687, 12th
floor, Alphaville, Barueri, São Paulo state, Brazil, ZIP
Code no. 06454-040.
2.
Personal data we collect
about you and how we use it
Under data
protection law, we can only process your personal data if we have a legal basis
for doing so.
Where we process your personal data in connection with the Healthy Cities App, we rely on the below legal bases for the following different processing purposes:
Table 1: Personal data collected by Bupa as the Controller
|
Purpose |
Description |
Personal Data
types |
Legal Basis |
|
Registering an
account as a new user |
To allow you to create
an account and generate a user profile |
Identity Data:
first name and last name Contact Data:
email address Profile Data:
username and profile picture |
We have a legitimate
interest to identify individual users of the App to facilitate the step
challenges. |
|
Information you
generate each time you use the App |
Information
required to allow the App to function, deliver challenges, deliver support, and
to ensure the App is secure. |
Usage Data: when
you access or use the App for the Challenge, we collect information such as for
how long you are using the App or what you’re viewing on the App. Location Data: we
will collect your approximate location from your device. Device Data: we collect data about the device(s) you use to access the App
which may include IP addresses, browser types, operating systems, fitness
device type or mobile device, the referring web page(s) visited. |
We have a
legitimate interest to: · Process your
Location Data to enable you to participate in local challenges; · Process your
Device Data and Usage Data to monitor the usage of our App; · Process your
Device Data and Usage Data to implement appropriate security measures in our App; · Process your
Location Data and Device Data to offer technical support to you. |
|
Connecting health
apps and smart watches |
In order
to connect your device to the App. |
Device Data
(about the device(s) you use to access the App): fitness device type or
mobile device. |
You have provided
your consent to us to collect this data to facilitate your participation in
the challenges. |
|
Collection of
steps and activity data |
To facilitate the
sharing of personal data to compete in step challenges. |
Challenge Data: steps,
distance travelled, and active minutes moved with the App (if you choose to share
it with the Challenge through fitness tracking devices and/or smart phones) |
You have provided
your consent to us to collect this personal data to facilitate the user’s
participation in the challenges. |
|
Notify users of
changes in legal terms and changes to the App. |
To notify users
of changes to the Terms of Use or Privacy Notice, and changes to the App via
email or through in App announcements and notifications. |
Contact Data:
email address |
We have a
legitimate interest to inform you of changes in legal notices, legal terms,
and changes to the App. It is required or allowed by law to inform you of changes to legal notices and terms. |
|
Exercising your rights |
To respond to
requests to exercise data subject rights under data protection law. |
Identity Data: name Contact Data:
email address, address, contact number |
It is necessary
to meet our obligations under data protection law. |
|
Survey responses |
To facilitate the
response to in App survey(s) |
Survey Response
Data: responses to wellbeing questionnaires. |
You have provided
your consent to us to collect this data in response to an optional survey. |
|
Enforce our terms
and conditions |
To ensure terms and
conditions detailed on the App are followed |
All personal data
under this privacy notice. |
We have a
legitimate interest to ensure the terms and conditions of our App, if
breached, are enforced. |
|
User provided
content |
To allow you to
share comments and photos during challenges with other users |
User Content
Data: messages and photos. |
We have a
legitimate interest to facilitate in challenge discussions for your experience. |
|
For security
measures |
Applying security
measures to our processing of your personal data |
All personal data
under this privacy notice. |
We have a
legitimate interest to implement appropriate security controls within the
App. It is required or allowed by
law in order to protect your personal data. |
|
Personal data communication to Sanitas (if you are using the App in Spain, the United States, Brazil, Turkey, Chile, or Mexico.) |
Data transfer to
Sanitas which enables Sanitas to conduct a well-being
study to understand how, and to what extent, the Healthy Cities initiative is
improving users' well-being. |
Pseudonymised information
necessary for conducting a well-being study (ID number, number of steps,
minutes active, gender, age, country of participation). |
You have provided
consent for the transfer of your personal data. |
|
Personal data communication to Bupa Australia (if you are using the App in Australia or New Zealand) |
Data transfer to Bupa
Australia which enables Bupa Australia to conduct a
well-being study to understand how, and to what extent, the Healthy Cities initiative
is improving users' well-being. |
Pseudonymised information
necessary for conducting a well-being study (ID number, number of steps,
minutes active, country of participation). |
You have provided
consent for the transfer of your personal data. |
|
Personal data
collection on behalf of Sanitas (if you are using the App in Spain) |
Data collection
on behalf of Sanitas if the user decides to sign up for any of the challenges
and/or activities or to participate in any of the giveaways organised by
Sanitas that are announced through the App. |
Basic
identification and contact personal data— name, surname, contact details, and
country of participation |
You have provided
consent for personal data to be collected on behalf of Sanitas. |
|
Personal data
collection on behalf of Bupa Australia (if you are using the App in Australia
or New Zealand) |
Data collection
on behalf of Bupa Australia if the user decides to sign up for any of the
challenges and/or activities or to participate in any of the giveaways organised
by Bupa Australia that are announced through the App. |
Basic
identification and contact personal data— name, surname, contact details, and
country of participation |
You have provided
consent for personal data to be collected on behalf of Bupa Australia. |
3.
Cookies
We use cookies (small files placed on your device) on the
App to improve your experience and our development of the App. For detailed
information on the cookies we use, the purposes for which we use them and how
you can exercise your choices regarding our use of your cookies
please refer to the table below:
4.
Automated decision-making
and profiling
We do not make decisions based solely on automated processing or profiling that produce legal effects concerning you (or have similarly significant effects).
5.
Sharing your personal data
Bupa will, as a Controller, share your data with our service provider, Movespring LLC, acting as processor based in the European Union and United States who provide IT and system administration services, hosting services for our App, customer service support, email delivery and administration, and data storage and analysis.
We ensure that protections
are in place to adequately safeguard your personal data when sharing it with
third parties and require those parties to agree to adequately protect your
personal data in accordance with data protection law.
Personal data sharing within the Bupa Group
If you are using the App in Spain, the United States, Brazil, Turkey, Chile, or Mexico
Bupa may share with Sanitas the personal data necessary for conducting a well-being study, which will allow Sanitas to understand how and to what extent Healthy Cities is improving users' well-being. This transfer of personal data is based on your prior consent, meaning it will only take place if you authorise it. The personal data will be shared in a pseudonymised form, meaning it will not be accompanied by your identifying data, such as your name, email address, or phone number. Sanitas will process the shared information as an independent data controller and in accordance with its own privacy policy, available at www.sanitas.es/RGPD. You can exercise your rights with Sanitas through the channels indicated in that privacy policy, under the "ARCO Rights" section, or by contacting Sanitas´ DPO at dpo@sanitas.es. For Portuguese speakers, please contact the Care Plus DPO at privacidade@careplus.com.br or exercise your rights through our form by clicking here.
Likewise, if you are using the App in Spain and wish to sign up for any of the challenges and/or activities or participate in any of the giveaways organised by Sanitas through the App, we will collect your basic personal data (such as your name, surname, contact details, and country of participation) in order to send them to Sanitas so that Sanitas can manage your participation. In this case, Sanitas will process your personal data in accordance with its own privacy policy, which you can review at the link provided in the previous paragraph.
If you are based in
Australia or New Zealand
If you are using the App in Australia or New Zealand, Bupa will share information about you and your use of the App with Bupa Australia for the purpose of creating leaderboards, sending communications about Healthy Cities to you, completing prize draws, and for understanding how you engage with the App.
The personal data that Bupa may share with Bupa Australia for the above purposes may include your:
· Identity Data;
· Contact Data;
· Fitness Device Data; and
· Usage Data and Challenge Data.
If you are using the App and participating in Healthy Cities as part of your employer’s team, Bupa Australia may share limited information about your engagement with the App and participation in Healthy Cities with your employer, such as your Identity Data and Challenge Data.
If you win a prize, Bupa Australia may also share information about you with a third party for the purpose of providing your prize to you, such as your Identity Data, Contact Data and your address.
6.
Personal data transfers
To provide the App to you, we need to transfer your personal information outside of the UK and EEA (the member states plus Norway, Liechtenstein and Iceland) because our App provider hosts data centres in the United States of America for the purposes of providing technical support and to help administer the App.
Where we transfer
your personal data from the UK to the EEA (i.e. where you consent to
participate in the well-being study carried out by Sanitas, and/or sign up to
the challenges and/or activities or participate in the giveaways organised by
Sanitas) those transfers are made pursuant to the UK Government’s adequacy
decision in favour of countries in the EEA and the European Commission’s
adequacy decision in favour of the UK. Otherwise, we may rely on appropriate
safeguards, for example, by entering into standard
contractual clauses adopted by the European Commission/ UK Government.
Where we transfer your
personal data from Brazil to the EEA, to the United States, or to a Bupa business
located elsewhere those transfers are made pursuant to standard contractual
clauses approved by the Brazilian National Data Protection Authority.
Where users are from Australia or New Zealand, your personal data will be disclosed outside of your resident country to the EEA.
7.
How long will we keep your personal
data for
We will retain your personal data in-line with our internal data retention standards. Once we no longer have a reason to hold your personal data, we will delete or, in some circumstances, we will anonymise your personal data (which means the personal data you shared can no longer be associated with you). You may delete your personal data in the App at any time.
For more information on how long we keep your personal data for, please contact Bupa using the information in the ‘Data Protection Contacts’ section of this notice.
8. Your rights in relation to our
processing of your personal data
You have rights under data protection law in relation to your personal data.
|
Right |
Description |
|
Right of access |
Ask for a copy of personal information we hold about you. |
|
Right to rectification |
Ask to correct or remove inaccurate information we hold about you. |
|
Right to
restriction of processing |
Ask to use your information for restricted purposes only. |
|
Right to portability |
Request that we transfer your information to you or to someone else in a format which can be read by a computer. |
|
Right to erasure |
Ask to delete your information if there’s no good reason to keep it. We’ll inform you if we can’t do this for legal reasons. |
|
Right to withdraw
consent |
Withdraw any consent you’ve given us. We’ll inform you if this effects the provision of a product or service. |
|
Right to object |
Object to us processing your information for direct marketing, legitimate interest, or a task carried out in the public interest. We’ll inform you if we can’t action your objection for legal reasons. |
|
Rights in relation to
profiling and automated decision making |
Ask us not to make solely automated decisions about you or use profiling if it has a legal effect concerning you. Bupa does not carry out automated decision making or profiling through this App. |
|
Right to
information sharing |
In some jurisdictions, you may ask us to provide information about the entities with whom we have shared your personal data. |
9.
Data protection contacts
If you have any questions, comments, complaints or suggestions relating to this notice or about how we process your personal data, please get in touch with us by emailing dataprotection@bupa.com or sending a letter to:
Bupa, Privacy Team
1 Angel Court
City of London
EC2R 7HJ
United Kingdom
If you are not
satisfied with our response, or to make a complaint, you can contact your local
supervisory authority using the Contact Information below.
|
Country |
Contact Information |
|
UK |
|
|
Ireland |
|
|
Australia |
|
|
New Zealand |
|
|
Spain |
|
|
Brazil |
|
|
Turkey |