1. Introduction

1.1 We care about your privacy

Your privacy and maintaining the confidentiality of your personal information is important to Bupa. This document describes how we handle your personal information, and provides information about how you can exercise your rights in relation to your personal information.

When you become a Bupa customer, you agree that we will handle your personal information as described in this document.

1.2 About Bupa

In this document, ‘we’, ‘us’, ‘our’ and ‘Bupa’ refers to Bupa HI Pty Ltd (ABN 81 000 057 590) and its related entities.

You may have also obtained products or services from other Bupa Australia Group companies, including:

• aged care services through Bupa Aged Care Australia Pty Ltd (bupaagedcare.com.au);
• dental services from Dental Corporation Pty Ltd (bupadental.com.au);
• optometry services through Bupa Optical Pty Limited (bupaoptical.com.au);
• health coaching and telehealth services through Bupa Telehealth Pty Limited (bupa.com.au/telehealth);
• employee and student health management services through Bupa Wellness Pty Ltd (health.bupawellness.com.au/client/s/);
• medical visa services through Bupa Medical Visa Services (bupamvs.com.au).

If you have engaged with, or obtained products or services from other Bupa companies, you should refer to the privacy policies of those companies, available on their websites (as noted above).

1.3 Connected Bupa Experiences

Bupa is working hard to become the world’s most customer-centric healthcare company. To do that, we provide more than just health insurance, we’re developing programs and offering services which collectively look after our customer’s health.

In any interaction with Bupa, you might deal with more than one Bupa company.

We will tell you when you are dealing with different Bupa companies.

1.4 Definitions

In this policy, the following terms have the following meanings:

Term	Meaning
Benefits	means the amount we pay for a treatment covered by your policy.
Consent	means your permission. Your consent can be express or implied. Express consent can be written (e.g. when you sign a form or agree to something by completing a transaction via myBupa) or verbal (e.g. when you give us your permission over the phone or in face-to-face conversations). Your consent will be implied when we can reasonably conclude that you have consented by either taking or not taking action. For example, if you have received direct marketing materials from us in the past, then, until you tell us otherwise, we have your implied consent to send you further direct marketing materials.
Claim	means a claim for us to pay benefits for a treatment a customer receives under a policy.
Claim information	Includes any form of communication about a customer’s health cover claim
Customer	means a person who is currently receiving, has previously received products or services from us (such as a health insurance policy). It includes someone who has enquired about or expressed interest in our products, programs or services (for example, by obtaining a quote or requesting further information).
Fund Rules	means the Bupa Fund Rules, with which you agree when obtaining a health insurance policy from us. You can view our Fund Rules at bupa.com.au.
Health management program	means a program intended to either reduce the complications in a person with a diagnosed chronic disease, or prevent or delay the onset of chronic disease for a person with identified multiple risk factors for chronic disease, as defined in the Private Health Insurance (Health Insurance Business) Rules 2009 (Cth).
Partner	unless the context indicates otherwise, a partner means a person of either sex with whom a policy holder lives in a bona fide domestic relationship. This includes a person to whom the policy holder is legally married.
Personal information	has the same meaning that it has under the Privacy Act, namely information or an opinion, whether true or not, and whether recorded in a material form or not, about an identified or reasonably identifiable individual.
Policy	means a Bupa health insurance policy.
Policy holder	means the holder of a Bupa health insurance policy.
Privacy Act	means the Privacy Act 1988 (Cth).
Sensitive information	is a sub-set of personal information that includes health information and has the same meaning that it has under the Privacy Act

2. Collection of your personal information

2.1 What kinds of personal information does Bupa collect?

The amount and type of personal information we collect from and hold about you will vary depending on whether you are an existing customer, have made enquiries about our programs, products and services, and the extent to which you have used our programs, products and services.

If you apply to be, are currently or have previously been our customer, the personal information we hold about you may include:

• your name, address, telephone and email contact details;
• your gender, date of birth and marital status;
• your billing details, including information about how you pay premiums;
• details of claims you have made under your policy and treatment you have received, including date, amount paid, service type, description of the service, which healthcare provider treated you, etc;
• records of our interactions with you, such as system notes and call recordings of our telephone conversations (including telehealth) with you; and
• details and information your browser send when you visit our websites including your device IP address, browser type and version, operating system type and version, the pages on our website you visited and the time you spent on those pages, the information you searched for, the times and dates you accessed our website and other statistical information.

If you have, or have previously had, a policy with us, we may also hold information about:

• your current and previous Bupa products and services;
• changes of cover, cancellations and suspensions of your policy, including information about your eligibility for our policies;
• your Medicare number;
• details of when you have registered for the Australian Government Rebate on private health insurance and your income tier for rebate purposes;
• details of your participation in a health management program or other health related programs or services provided by us; and

We may also hold personal information you give us in response to a marketing offer or campaign, to obtain a quote and when enquiring about our products and services.

2.2 Does Bupa collect sensitive information?

For some of our products and services, we may be required to collect and store your sensitive information, such as health information. For example, if you have Bupa health insurance, we will collect and hold information about your claims so we can assess those claims and administer your policy.

Also, we may request information from health service providers, such as medical or allied health professionals to verify claims, for audit purposes, and to ensure we have paid benefits according to our Fund Rules, your policy terms, and the law.

2.3 How does Bupa collect personal information?

We may collect personal information from you in a range of ways, including when you:

• take out a product with Bupa, whether online, by phone or in person;
• complete a form or otherwise provide us with information, including in response to our offers, products or services;
• contact us in person, by phone, via mail, email or online (e.g. via social media or an app), or when we contact you in any of these ways;
• make a claim;
• log in for and use services offered through myBupa (see section 7.3 below); or
• participate in a health management program or other health related programs.

We will always try to collect your personal information directly from you. However, given the nature of our health insurance business, there is likely to be instances where we will need to collect your information from other persons or entities.

For example, we may collect your personal information from others in the following circumstances:

• if you are covered by a family or couples health insurance policy, we may collect information from another person on the policy (for example, the policy holder or the person who set up the policy);
• when you go to hospital, we will collect information about your admission and treatment directly from the hospital;
• when you visit a healthcare provider and make a claim for those services, we will collect information about your treatment from that provider;
• if you are a corporate customer or pay your premiums by payroll deduction, we may collect information from your employer or broker, as the case may be;
• for some overseas visitors’ products, we may collect information from a migration or other agent you engage;
• for overseas student products, we may collect information from your educational institution; and
• if you have transferred to Bupa from another private health insurer, we may collect information from that private health insurer.

If you have provided us with information about another person, you need to ensure that you have that person’s permission to do so and inform them that:

• you have given us their information;
• they have a right to access their information that we hold; and
• they can refer to this document for information on how Bupa will handle their personal information.

2.4 Couples and family health insurance policies

Some polices may cover more than one person, for example family, couples and single parent policies.

For couples, family and single parent policies, we will collect information about each person insured under the policy. This may include, for persons aged 18 or over, the email address, residential address and other contact details and contact preferences of each person covered by the policy.

If a policy holder lodges a claim on your behalf, we assume they have your consent to give us all the information required to process that claim.

2.5 If you do not provide us with your personal information

If you do not provide us with the personal information we reasonably require, we may be unable to provide you with the offer, information or products or services (as the case may be) that you have requested.

3. Use and disclosure of your personal information

3.1 How does Bupa use your personal information?

We use your personal information to provide, manage and administer our programs, products and services and to operate an efficient and sustainable business. As part of these processes, we may disclose your personal information on a confidential basis to members of the Bupa Group and third party service providers.

In operating our business, we may use your information to:

• process your application;
• administer your policy;
• investigate, assess and pay claims;
• process payments;
• contact you in relation to any matter relating to you or the products and services provided to you;
• identify whether you are a suitable candidate for participation in a health management program, or other health related programs or services;
• contact you to advise you of health management programs and other programs and services that may help you improve your health and wellbeing;
• conduct health management programs;
• personalise your experience, including by ensuring that the communications we send you and your online experience is relevant to you;
• answer your enquiries and deliver customer service to you;
• conduct quality assurance activities across our businesses;
• research and evaluate our health and wellness programs (if we use your identifiable personal information to do these things, we will always ask for your consent);
• carry out internal functions, including administration, training, accounting, audit and information technology;
• practice effective risk management and prevent fraud by conducting claims audits and analysis of claims;
• monitor, price and evaluate our products and services;
• resolve complaints, identify trends and improve our processes;
• conduct market research, customer surveys and data analytics;
• comply with laws and regulations; and
• develop and fulfil marketing promotions.

3.2 Marketing personalisation and communication

From time to time, we may contact you (via post, email, phone, digital app, social media or other means that become available from time to time) to tell you about products, services, programs or offers that may be of interest to you. This may relate to products, services, programs or offers offered by us, our related entities or third parties with whom we have partnered.

We may also share your personal information on a confidential basis with members of the Bupa Australia Group and business partners, so that they may promote, offer and/or provide products and services to you.

We may use your information to personalise how we provide and market our products and services to you (for example, in our communications to you or advertisements on websites and social media platforms that you access).

When you become our customer, we will use your personal information for these purposes, unless you contact us to opt out.

If you do not wish to receive marketing material from us, you can opt out at any time by contacting us (our contact details are at the end of this policy). In some instances, you can opt out when we communicate with you (for example, by unsubscribing from certain types of emails you receive using the link in the email you receive).

If you request not to receive marketing material, please note that we will still contact you in relation to our on-going relationship with you. For example, we will still send you any bills, statements and notices that are relevant to the products and services you hold with us.

We will use your personal information, including your claims information, to personalise how we communicate with you and to tailor the advice or suggestions we provide to ensure that our communication with you is relevant to your circumstances. If you are aged 18 or over and would prefer that we do not use your claims information to personalise your experience with us, you can opt out by logging into myBupa or by contacting us.

We will send general membership communications (e.g., notices about changes to your cover) to the policy holder in whose name your policy is registered.

We will send personal communications to the person on the policy to whom those communications relate, using their contact preferences.

From time to time, we may contact you to offer new options for how you can receive membership and personal communications and may contact you to ask about your communication preferences (for example, via post, on myBupa or via email).

3.3 Health management programs and services

We are developing and delivering a range of programs and services designed to assist our customers’ health and wellbeing.

We may use your personal information (including health information) to design, implement and offer health management programs and services and to identify suitable candidates for such programs and services. These programs and services may be offered by Bupa, or by a party acting on our behalf.

Some programs and services will be made generally available to all customers through our website, brochures, newsletters or other means of communication.

Others may be targeted to those customers most likely to benefit from the program or service. For example, we may implement a program suitable for customers with, or at risk of, a specific illness or medical condition.

We, or someone acting on our behalf, may contact you to offer you a specific health management program or other health related program.

Your participation in a health management programs and service is voluntary and you may opt out at any time.

We also offer health coaching programs which are discussion in section 5 (below).

3.4 Use of artificial intelligence (AI)

Bupa uses some AI applications and may process your personal information using AI, including to:

• transcribe and summarise your information and interactions with us (including phone conversations and online chats);
• undertake data analytics of your interactions with us (including sentiment and trends analysis);
• conduct training, compliance and quality assurance activities across our business; and
• respond to your enquiries about our products and services.

3.5 Who does Bupa disclose your personal information to?

We may disclose your information to other members of the Bupa Group and handle it in any State or Territory where we operate. In some circumstances we may be required to send your personal information outside of Australia.

In addition, to help us provide, manage and administer our programs, products and services and operate an efficient and sustainable business, we may need to disclose your information to third parties. This may include disclosing your information:

• to anyone engaged by us or acting on our behalf in relation to our business, such as service providers/suppliers that work with us to offer our products or services and support our operations;
• to our partners to ensure that you receive applicable discounts and other benefits from the partner;
• to industry bodies, government and regulatory bodies, including Medicare, the Australian Taxation Office, the Department of Health, and the Commonwealth Ombudsman;
• to other private health insurers, to facilitate transfer between health funds;
• to lawyers, auditors and other advisors appointed by us or acting on our behalf;
• where disclosure is permitted or required by law, including in response to compulsory notices from courts of law, tribunals or government agencies;

In addition, where a third party is providing services to you or supporting you and your policy on our behalf, we may disclose your personal information to them, including:

• to hospitals, medical and ancillary healthcare providers to facilitate the provision of treatment (for example, they may contact us to ascertain if your policy covers your desired treatment), and to ensure that you’ve been charged the correct amount claimable under your policy;
• to any persons acting on your behalf including those persons nominated by you, executors, trustees and legal representatives;
• to your employer or broker if you are on a corporate health plan in order to set up your policy, verify your on-going eligibility to be on that corporate health plan and administer the corporate health plan or our relationship with the broker or corporate client;
• to a broker, migration agent or other agent, to enable them to set up, verify or administer your policy, or our relationship with the broker or agent.

Where a third party operates outside of Australia which results in us sending your information outside of Australia, we require the recipient of the information to comply with privacy laws and keep your information secure.

3.6 Use and disclosure of personal information on couples, family and single parent health insurance policies

If you are covered by a family, couples or single parent policy, you should be aware of who else on the policy can access your personal information.

Each person on a policy aged 18 and over may contact us or complete a ‘Keeping Your Personal Information Confidential’ form (available on our website) to advise us who may receive information about their health claims.

If they don’t fill in this form or otherwise let us know, when they turn 18, we will automatically send their claims information to them directly.

All cheques, non-cash payments and general policy correspondence will be sent to the policy holder. Personal correspondence (for example, tax statements and claims correspondence) will be sent directly to the individual to whom it relates.

The policy holder is the person responsible for the administration and maintenance of the policy and may:

• change any details on a policy;
• change the product or level of cover;
• add and remove persons from the policy;
• receive benefits on behalf of other persons on the policy;
• terminate the policy;
• permit their partner, or another person aged 18 years or over, to be treated as authorised to operate the policy.

An authorised person will have the same administrative rights over the policy as the policy holder but (with the exception of Overseas Visitors Cover policy holders) will not be permitted to terminate the policy.

This authority may be given by completing an ‘Authority Form’ or by any other means approved by us. The authority will remain in effect until the instructed end date, or the policy holder contacts us to revoke it.

If you are insured under a couples or family policy and you and your partner become divorced or separated, you may no longer be eligible to be covered under a policy together. You must notify Bupa if your circumstances change. It is your responsibility to ensure that each person takes out their own policy.

4. Travel, home, car and life insurance customers

4.1 Bupa Travel, Home and Car Insurance

Bupa is an authorised representative of Open Insurance Pty Ltd (ABN 23 166 949 444; AFSL 451712), the issuer of Bupa Travel, Home and Car Insurance. Open arranges Home and Car insurance as agent for Allianz (AWP Australia Pty Ltd (ABN 52 097 227 177; AFSL 245631) trading as Allianz Global Assistance), and Travel insurance as agent for Hollard Insurance Company Pty Ltd (ABN 78 090 584 473; AFSL 241436).

If you apply for travel, home or car insurance (in this clause, “insurance”) from Bupa, we will only collect information necessary for us to provide you with such insurance products and services. This includes information necessary for us to provide you with insurance cover, underwrite insurance policies and consider insurance claims.

The types of personal information we collect and hold will depend on the product or service you request, but may include:

• your name and address;
• your age;
• details of your previous insurance history, including claims;
• details of your personal assets (e.g. house and contents, motor vehicle, etc);
• the details of your spouse or partner, and others insured on your policy; and
• your health information if applicable (e.g. for travel insurance).

It is your responsibility to advise us of any changes to your personal details and any relevant change to your circumstances to ensure we can keep our records accurate and up to date.

We will use the information we collect to provide you with the insurance product or service you request.

We will disclose your personal information to IAL (as the issuer of the insurance) for the purposes of allowing IAL to:

• consider your current, and any subsequent, insurance application;
• price and underwrite any policy issued by IAL or its related entities;
• calculate and offer discounts;
• issue you with a policy;
• administer the policy; and
• investigate, assess, manage and pay any claims made by or against you.

When you take out travel, home or car insurance you should refer to the Financial Services Guide and Product Disclosure Statement provided to you for more information on how IAL handles your personal information.

We may also disclose your personal information to other insurers, other parties as required by law, or to third party service providers such as investigators and assessors who are contractually required to comply with privacy law.

4.2 Bupa Pet Insurance customers

Bupa Pet Insurance is issued by The Hollard Insurance Company Pty Ltd (ABN 78 090 584 473; AFSL 241436) (Hollard) and arranged and administered by PetSure (Australia) Pty Ltd (ABN 95 075 949 923; AFSL 420183 (PetSure). Bupa is an Authorised Representative (AR 354269) of PetSure and is authorised to distribute and arrange for the issue of the insurance.

When you take out Bupa Pet Insurance through PetSure, your information will be handled by PetSure in accordance with PetSure’s privacy policy available at petsure.com.au and in the Bupa Pet Insurance Combined Product Disclosure Statement, Policy Terms and Conditions and Financial Services Guide (available at bupa.com.au/pet-insurance). You should refer to that policy for more information about how your personal information will be handled.

5. Health coaching customers

This section outlines how your information will be handled if you participate in any health coaching program offered by Bupa. Bupa offers health coaching services through its agents, including Bupa Telehealth Pty Limited. In this section, any references to ‘we’, ‘us’, ‘our’ or ‘Bupa’ includes any agent who provides health coaching services to you on our behalf.

5.1 What information is collected if I participate in a health coaching program?

When you participate in a health coaching program, we will collect your personal information for the purposes of offering, providing, and administering the health coaching services, health management programs and related services to you, and to ensure these programs and services are provided to you in accordance with our policies and procedures and the law.

When you take part in health coaching and/or related services the information your health coach may collect includes:

• your name, address, telephone number and email contact details;
• your gender and date of birth;
• your health information, including details of the treatments you have had or are planning to have, and health conditions or ailments that you have suffered or may be at risk of suffering, and any other information that is relevant to your health;
• the name and contact details of any person authorised to act on your behalf when speaking with us ;
• if the health coaching program is made available to you through an organisation (for example, your employer), the name of the organisation on whose behalf we are contacting you;
• the details of any correspondence or resources we have sent you, such as brochures, information sheets or videos;
• the details of any conversations we have had with you;
• the records of our interactions with you, including system notes and call recordings; and
• if you have been referred to the program from a healthcare provider (such as a GP, specialist or hospital), any information provided by that party as part of your referral.

5.2 How will my information be used or disclosed?

When you take part in a health coaching program, we will use your personal information for the purposes of offering and providing health coaching and related services to you and to operate an efficient and sustainable business.

We may use your personal information to:

• contact you about health coaching and/or health management programs available to you;
• confirm your identity when we speak to you via telephone (including confirming at least 3 points of identification each time we speak with you);
• develop and provide you with a tailored health coaching plan;
• answer your queries and provide you with health-related resources such as pamphlets, videos and online resources;
• carry out internal functions including administration, audit (internal or external), training, accounting and information technology;
• practice effective risk management and quality control through auditing and compliance monitoring;
• conduct quality assurance activities;
• conduct customer satisfaction surveys and otherwise evaluate our services;
• conduct marketing, research and data analysis; and
• comply with any laws or regulations.

We may also use de-identified information to conduct data analyses and to identify suitable candidates for health management programs.

In the course of providing health coaching services to you we may disclose your personal information in the following circumstances:

• if the program has been made available through Bupa Health Insurance, Bupa Health Insurance will have access to information that confirms your participation in a program and details about your health and programme outcomes (to allow us to evaluate and design programs);
• your General Practitioner (if your General Practitioner has referred you to the program);
• with your consent, to any other healthcare provider;
• any person authorised to act on your behalf;
• any person or entity engaged by us or acting on our behalf for the purposes of providing you with our health coaching services;
• where required, to a body having regulatory authority over any part of our business or affairs;
• where we are required or permitted by law to do so, including where we reasonably believe that disclosure is necessary to lessen or prevent a serious and imminent threat to your life, health or safety, or the life, health or safety of others; and
• if the health coaching program has been made available to you through a particular organisation (such as your employer), we may advise that organisation whether you have participated in a particular program or service.

5.3 Is the service confidential?

Yes, all personal information we collect from you when you participate in a health coaching program, along with your discussions with your health coach, are treated confidentially and will not be disclosed, other than as outlined in section 5.2, above.

We will keep a record of the programs and services we’ve offered to you and that you have registered to take part in. We will also keep a record of requests you’ve made that no further programs or services be offered to you.

5.4 Will my participation in health coaching affect my health insurance policy?

No, we won’t charge you for participating in a health coaching program and your participation does not affect the cost or any other aspect of your health insurance policy.

6. Accessing and correcting your personal information

6.1 Can I access my personal information?

You can ask us for access to the information we hold about you at any time. Simply contact us (see contact details below) to make your request. We will aim to meet your request within a reasonable time and in the manner requested by you if it is reasonable to do so.

In some circumstances, we may be unable to give you access to the information you have requested. In that case, we will write to you with the reasons for our decision. If you have any concerns about the refusal, please see section 8 for further information.

6.2 Correcting your personal information

To enable us to provide you with the best possible service, it is important that the information we hold about you is complete and accurate.

It is your responsibility to notify us if your details change or you believe that any information we hold about you is inaccurate, incomplete or out-of-date. We will respond to your request within a reasonable period and take reasonable steps to amend your records.

In some circumstances we may decline to amend your records. If we decline, we will write to you and tell you why.

7. Your privacy online

7.1 Online data collection and use

When you visit a Bupa website, we will collect certain technical information generated your activities on the website. This may include information such your device IP address, browser type and version, operating system and version, the pages of our website that you visited and the time spent on each page, the information you searched for, the date and time of your visits and other statistical information.

We use this information to improve the browsing experience on our websites and digital products, as well as to optimise and personalise your use of Bupa websites and digital products (such as apps).

7.2 Cookies and other analytics tools

Our websites use “cookies” and similar online behavioural tracking technologies. Cookies are small text files placed on your computer by a web server when you access a website. We use cookies to collect data about which web pages are most popular, peak usage times, websites you have visited and other information that helps us make our websites more helpful and easier to use.

Cookies are designed to identify computers rather than individual users. We may, however, use them to help personalise your visit to our websites by linking the cookie on your computer to your personal information stored on our system.

You can choose if and how to accept cookies by configuring the preferences and options in your web browser. For example, you can set your browser to notify you when you receive a cookie or to reject cookies. If you decide not to accept cookies, however, you may not be able to gain access to all the content and functions of our websites.

We may also use products offered by third parties such as Adobe, Google and Fullstory to undertake activities such as website analytics, email campaign management and online behavioural advertising.

You can visit youronlinechoices.com.au for more information about how to opt out of certain behavioural advertising and for further information about how these tools work.

7.3 Your privacy and myBupa

When you use myBupa, we will keep a record of your interactions including when you log in and your transaction and account history.

When you register for and use myBupa, you accept and are bound by the myBupa terms of service. For information about your use of myBupa, including the privacy and security of your myBupa account, please refer to the myBupa terms of service available on our website.

8. Overseas disclosure

We may disclose your personal information to organisations located outside of Australia. These overseas organisations are third party service providers or suppliers (or their related entities) which support us in delivering our products and services and are likely to be located in the United States of America.

9. Contacting Bupa

9.1 Your feedback

If you have any questions, feedback or concerns about this policy or how we handle your information, you may contact us at any time by calling us on 134 135.

You may also contact us by post, email or by visiting a Bupa retail centre. For all of our contact details, please visit bupa.com.au/contact-us.

Bupa will investigate your concerns and manage your complaint directly with you.

If, after contacting us, you still have concerns or don’t understand a decision we’ve made, you may contact our Customer Relations team using the contact details below:

Bupa Customer Relations
GPO Box 9809
Brisbane QLD 4001

Telephone: 134 135

Email: customerrelations@bupa.com.au

When working with you to resolve your complaint, we will keep you updated on the progress of your complaint.

If you are not happy with Bupa’s response, or if you do not feel your complaint has been resolved, you may seek advice from or make a complaint to the Office of the Australian Information Commissioner by calling 1300 363 992 or visiting oaic.gov.au

Effective 1 November 2025