Medavie Blue Cross Privacy Statement

1. Personal Information We Collect

In this Privacy Statement, "personal information" means any information that is related to an identifiable individual, or as otherwise defined under applicable privacy law.

Depending on the type of services we are providing and your relationship with us, we collect personal information as follows:

Personal information you provide directly to us

We collect personal information from you directly when you apply for benefits and services, when claims are submitted for payment, when you contact or communicate with us online, by phone or in person and when managing our business relationship with you. The categories of personal information we may collect from you directly include:

• Contact information such as your name, address, telephone number(s), email address;

• Demographic information such as your birth date and gender or other identifying information;

• Identification information such as your member ID number and policy number, username and password;

• Financial information such as your annual income, banking information, place of employment, and social insurance number (SIN);

• Medical information such as diagnoses, medications, treatments, paramedical results; and

• Business contact information such as name, company/provider name, business address, business email address, and business phone number if you are an individual or employee of a business that interacts with Medavie.

Information we collect automatically

Depending on the device you use or the method you use to interact with us, we may automatically collect digital information about your device, your location and your use of our site. Please see our Online Privacy Statement for more information about how we collect, store and use information electronically, including through our websites and our mobile apps.

Personal information we collect from other sources

We may also collect personal information about you from other sources, including:

• Your employer or authorized representative;

• Health care practitioners;

• Other insurance companies when coordinating the payment of benefits;

• The card holder of any contract under which you are a participant; and

• Other third parties you allow to share information with us;

2. How we use your personal information

Depending on the type of services we are providing and your relationship with us, your personal information may be collected and used for the following purposes:

• Evaluating applications and administering our products and services;

• Processing claims;

• Confirming your identity and verifying the accuracy of information;

• Complying with legal requirements, such as provincial and federal tax reporting, financial audits and anti-money laundering verifications;

• Understanding your preferences for engaging with us (e.g. via email, telephone, etc.); and

• Determining if there are other suitable products or services you might be interested in and sending you details about them. You can ask to be removed from our marketing lists at any time.

We may also use your personal information for other purposes that you have consented to or for other purposes that are authorized by law. For example, we may use your personal information for:

• Protecting you and us from errors, misrepresentations, fraud and/or contravention of laws or criminal activity;

• Fulfilling contractual obligations imposed by service/program providers; and,

• Helping us make decisions to improve the products and services we offer;

If you provide your personal information over the phone, the call might be recorded or monitored and your personal information is collected and used to: establish a record of the information you provide; take or verify instructions from you; and confirm your identity. Your personal information will also be used to maintain quality service levels and help with staff training. If you don’t want your calls recorded, you can communicate with us in writing instead. You can also request that we respond to you in writing only.

3. Consent

With some exceptions, we require your consent to collect, use and disclose your personal information. We do not require additional consent to use your personal information for providing or delivering a product or service you use or apply for. Other exceptions are determined by law and can include legal, medical or security reasons that make receiving your consent impossible or impractical such as fraud prevention and detection or assessing or improving security measures.

Your consent may be given in writing, verbally, electronically or through authorized representatives. It may also be implied, in certain circumstances. For example, if you show your benefits card to a pharmacy instead of paying for the prescription directly, it’s implied that you give consent for the pharmacy to provide your personal information to us to pay the claim.

You may withhold or withdraw your consent for us to collect, use or disclose your personal information if there are no legal or contractual requirements that prevent it. Please note that by withdrawing your consent, we will not be able to provide you with certain products or services that may be useful to you and/or your dependents.

For information of how to withdraw your consent Click here

4. Disclosing your personal information

Depending on the product or service, we disclose your personal information for the purposes we collected it or for another purpose to which you have consented or which is permitted or required by law.

We may disclose your personal information to:

• Authorized employees, agents, and representatives who need the information to complete their duties for us;
• Any person or organization you give consent to;
• People, organizations, and investigative bodies who work to prevent, detect, or investigate suspected fraud, breaches of agreement, or contravention of the law;
• Other people or organizations who are legally authorized to view your personal information,
• Service providers who need this information to perform their services for us. We use service providers for various purposes, including printing, mail distribution, information technology (IT), data storage, administration, investigation, reinsurance, and paramedical services.
• the cardholder of any contract under which you are a participant.

In some cases, we provide your personal information to authorized employees, people, organizations, and service providers in other provinces or jurisdictions than where it was collected. These parties may be subject to the laws of those provinces or jurisdictions. If you are a Quebec resident, this means your personal information may be disclosed or transferred outside Quebec including to service providers outside of Quebec.

When we share personal information with our service providers, we ensure by contractual means that they protect it in ways that are consistent with our privacy policies and practices.

We do not sell your personal information.

5. How long we retain your personal information

We keep your information for one of the following time periods, whichever is longer:

• As long as we are required by law and guidelines set for the financial services industry; and
• As long as we need to for managing the products and services we provide you.

The types of products and services we offer may require us to keep your information for extended periods of time. Personal information that is no longer required is destroyed, deleted, or made anonymous.

6. How we protect your personal information

Medavie’s information security has been developed and continually enhanced to protect your personal information from unauthorized disclosure, access and use. Physical, organizational and technological safeguards are in place to protect this information, based on its nature and sensitivity.

All Medavie employees – including full, part-time and contract employees – receive privacy training, sign confidentiality agreements and must follow our corporate privacy policies, as a condition of their employment.

All employees who are authorized to handle personal information as part of their duties work to ensure that the information is handled with the appropriate level of care and protected at all times.

7. Your Rights

Rights of access

You may submit a written request at any time to Medavie’s Chief Privacy Officer to obtain a copy of your personal information we hold about you. We will also inform you, upon written request, of any of the following information:

• the existence and nature of any personal information we hold about you, the purposes for which we collected it, how we collected it, or the sources of the personal information;
• the names of the individuals or categories of third parties with whom it is necessary for us to communicate your personal information;
• the categories of Medavie employees who have access to the information; and
• the length of time your personal information will be kept.

Any personal information you request will be provided in writing, with certain exceptions allowed by law. Please understand that, depending on specific circumstances, we might not be able to provide all of the information you request. There may also be a fee for such information; you will be notified after your request is evaluated.

Right of correction

Medavie strives to ensure that any personal information we collect, use or disclose is as accurate and up-to-date as possible in order to meet the needs for which it is used. We encourage you to use our Medavie Blue Cross Mobile App or access your account online to update your personal information. You may also contact us if your information needs to be updated, allowing us to best meet your needs in the future.

If we inform you about the existence of or provide you with a copy of your personal information and you believe that it is inaccurate, incomplete or ambiguous you can request that we correct the information. If you believe that the collection, disclosure or retention of your personal information is not authorized by law, you may ask us to rectify the matter.

We will require that you prove your identity before we process your request for access to, or correction of your personal information. A request will also be considered if it is made by a person acting as the representative, heir or successor of the person concerned, liquidator of the estate, beneficiary of life insurance or death benefit, or holder of parental authority. In all cases, this person will have to establish their capacity and identity. Such requests must be made in writing.

We will respond to your access or correction request within 30 days of the date of receipt.

Please contact Medavie’s Chief Privacy Officer at the mailing address or email address provided below to make an access or correction request.

8. Contact us with your privacy questions, concerns or complaints

If you have any questions, concerns or complaints about Medavie’s privacy policies or practices or wish to exercise your rights under applicable privacy law, please contact us.

You may submit a written request to Medavie’s Chief Privacy Officer on any aspect of our personal information governance and procedures, including:

• Questions about Medavie’s privacy policies and practices and/or to obtain additional information;
• To exercise your rights (including the right of access to and correction of your personal information and the right to withdraw consent), as described in this Privacy Statement; or
• To voice a concern or make a privacy-related complaint. We have established an internal privacy complaint review process. We will investigate all complaints and we endeavor to respond to all privacy-related complaints and address any concerns as quickly and thoroughly as possible. If a complaint is found to be justified, we will take appropriate measures to correct the situation.
• Upon written request, Medavie will provide you with reasonable access to your personal information as required or permitted by law. You can also review the accuracy and completeness of your information and you may request that it be amended or deleted, if appropriate or permitted by law.

Please address your matter in writing to:

Chief Privacy Officer
Medavie Blue Cross
644 Main Street
PO Box 220
Moncton, NB E1C 8L3

E-mail: [email protected]

If your privacy concern has not been addressed to your satisfaction, you may file a formal complaint with the Office of the Privacy Commissioner of Canada, who oversees compliance with the Personal Information Protection and Electronic Documents Act (PIPEDA), or to any other applicable privacy regulatory body.

Office of the Privacy Commissioner of Canada
30 Victoria Street
Gatineau, Québec K1A 1H3

Toll-free: 1-800-282-1376
Phone: 819-994-5444
Fax: 819-994-5424

Website: www.priv.gc.ca