Data Protection Statements

Please scroll down to view the Data Protection Statement for the product(s) that are relevant to you.

Private Health Insurance

What is the purpose of this notice?

Our promise to you is that 'When you need us, we're there'. In order to fulfil that promise, and to provide you with suitable products and services, we need to get to know you and what your needs are.

This means that we collect certain information about you in the course of operating our business. This notice sets out details of the information that we collect, how we process it and who we share it with. It also explains your rights under data protection law in relation to our processing of your data.

Who controls the use of your personal data?

Vhi Insurance DAC, whose registered address is Vhi House, Lower Abbey Street, Dublin 1, is the company that controls and is responsible for personal data that is collected in relation to our health insurance products. If you have any queries in relation to the processing of your personal data, we have appointed a data protection officer that you can contact as follows: by post at Data Protection Officer, Vhi, Vhi House, Lower Abbey Street, Dublin 1 or by email at dataprotection@vhi.ie.

What personal data is collected?

In order to provide our services to you we need to process certain personal data in relation to you, which includes:

  • Biographical data - We collect the following biographical data: name, assumed names, address, phone number, email address, gender, family relationships (e.g. spouse, children), date of birth, PPS number, and if you are a student or in college.

  • Payment data - If you pay by direct debit or receive payments through electronic funds transfers, we will collect the IBAN, BIC and the name of your bank/building society or your credit card details where relevant.

  • Claims data - If you make a claim we will process details of your medical history, details of services claimed, treatment dates, payments made, details of other insurance that may cover aspects of your claim, and the original or copy receipts that you submit in support of your claims. If necessary we will access further medical information/medical records relating to your claim.

  • Interactions with us - If you interact with us we will record details of those interactions (e.g. phone calls and logs of phone calls, email correspondence and hard copy correspondence). If you make a complaint we will process details in relation to that complaint.

  • Online services - When you interact with us online (by computer, tablet or smartphone), you will often provide personal data to us, which you will be aware of when using the services or for which you give consent. We also automatically collect data about your use of our services, such as the type of device you are using and its IP address, and how you interact with the services. Further details are available in the cookies policy and/or the Data Protection Statement that accompanies the relevant service.

Where does Vhi collect personal data from?

Most of your personal data that we collect will be provided by you through our application forms, claims forms and your interactions with us. However, certain information may be provided by third parties on your behalf, including the following:

  • Group schemes - Many members avail of our services through a group scheme that is operated by their employer. In order to sign you up as a member your employer may give us certain details, such as your name, address, gender, date of birth, contact details, details of dependants that will be included on a policy, their relationship to the Policyholder, previous insurance details, employee and group scheme number and PPS number. This information may be provided electronically.

  • Dependants - If you are covered on a policy, the policyholder may have provided us with certain details, such as your name, address, gender, date of birth, contact details, relationship to the policyholder, previous insurance details and PPS Number.

  • Hospital and primary care providers - If you are making a claim or using one of our services, you have probably had some interactions with a hospital or primary care provider. We have arrangements with these entities under which they provide us with details of the services that you have received, so that we can properly assess and process your claim. Details may be provided electronically.

  • Online services - When you access our online services we will collect the information that you provide to us online. We will also automatically collect certain data in relation to your use of our services, such as the type of device you are using and its IP address and how you interact with the services.

  • Other insurers - We may receive your personal data from other insurers to verify your previous insurance details as well as for other regulatory reasons.

Why do you process my personal data?

We process your personal data in order to provide you with our services and to assist us in the operation of our business. Under data protection law we are required to ensure that there is an appropriate basis for the processing of your personal data, and we are required to let you know what that basis is.

There are various options under data protection law, but the primary bases that we use are (a) processing necessary for the performance of our contracts with you, (b) processing necessary in order for us to pursue our legitimate interests, (c) processing where we have your and/or your dependants' consent, and (d) processing that is required under applicable law.

Here are further details of our processing of your personal data below, together with the basis for that processing:

  • Administering your policies - We will process your personal data in order to administer your policy. This includes processing your personal data in order to make and receive payments, and to maintain our records of the insurance products that you have purchased. Where we process your personal data in order to administer your policy this will be on the basis that it is necessary in order for the performance of our contract with you.

  • Providing you with services - Vhi provides different channels to engage with you in order to perform our contractual obligations, including where you have opted to avail of electronic channels such as MyVhi, our mobile app and Snap and Send. The MyVhi section of our website, and our mobile applications, give you access to your policy documents and information in one secure place, anytime, anywhere. We also provide a Snap and Send feature that allows you to send us your day to day receipts on the go. Where we process health related claims data in the context of providing these services, this will be on the basis that it is necessary and proportionate for the purposes of providing health insurance policies as part of our business.

  • Processing claims - In order to process a claim that you make under a policy we will need to process personal data in relation to the claim. This includes the underlying medical condition that is treated, your medical history, the medical services that you receive and details of previous policies you may have had (in order to calculate waiting periods and determine coverage for pre-existing conditions). We will also need to process your personal data in order to deal with queries about your level of cover, to highlight benefits under your policy that are most relevant to you, for pre-certification/approval of treatment, or to deal with complaints from you or a medical services provider.

    If your claim is successful, we will process your personal data in order to refund you fees that you may have incurred or pay the medical services provider. Where we process health related claims data, this will be on the basis that it is necessary and proportionate for the purposes of administering your health insurance policy.

  • Running our business - Like all insurance companies it is essential to ensure that we can manage the costs of claims and determine what treatments and services each of our policies can cover. In order to do this we undertake extensive modelling of the current and historic claims made by our customers, which we use to identify patterns in claims, to try to predict future trends and how they might affect our business, and to undertake pricing and profitability and studies. This information may be used to help us develop new product benefits and services. We also carry out auditing and quality control to check that our processes are robust and are being followed. In addition, we also need to process your data to meet certain regulatory and legislative obligations that apply to our business.

    We try to do all of the above by using aggregated or anonymous data where possible, so you won't be identifiable from the data, but some of this work involves processing your data without anonymising it. Where we process health related claims data, this will be on the basis that it is necessary and proportionate for the purposes of providing health insurance policies as part of our business.

  • Marketing - If you consent to us sending you marketing messages about our products and services we will process your personal data in order to make sure that any marketing messages that we send you are relevant to you. With your permission, this may include processing your health data to identify services that might be particularly relevant to you. We may also use it to ensure that we don't send you details about a service that isn't relevant to you. At policy renewal this could mean processing details of your claims history to help us identify what your needs are, what might be the most appropriate policy for you, and whether you are likely to change or cancel your policy.

    We also undertake market research and surveys, including our Better Health Outcomes Survey, which provide us with market insights and measure patient experience. This helps us to advocate for an improved health system by measuring patient experience. If we process your personal data for marketing and/or market research, this will be subject to your consent.

  • Fraud prevention and claims management - It is an unfortunate feature of any insurance and health systems that fraud can occur from time to time. We have a number of systems and procedures in place to monitor for potentially fraudulent claims, or claims for inappropriate treatments and procedures. If we identify a suspicious claim or pattern of claims, we will process your personal data in order to investigate the claim and to take appropriate measures to protect Vhi and its members and on occasion this may require further access to medical information/medical records. Where we process health data in connection with fraud prevention and claims management, this will be on the basis that it is necessary and proportionate for the purposes of administering your health insurance policy.

  • Administering our computer systems - Vhi relies on state of the art technology and computer systems to run our business and to process claims. We have an extensive team of developers and support engineers who are constantly testing our systems, running trials of new software, and providing support to our users.

    Where possible we try to use test data or anonymised data, but on occasion we may have to access live data directly, or we will often make a copy of some of the data that sits in our live systems and run our tests on that to make sure everything is working before we roll out a change. These copies may include your personal data, including details in relation to claims you have made. In general this processing of your personal data is justified by our legitimate interests in making sure our computer systems run properly and are safe and secure. If we process health data when running these tests or providing support services to our users, this will be on the basis that it is necessary and proportionate for the purposes of providing health insurance policies as part of our business.

Consent

In order to process certain personal data in relation to you, (which may include health data), for certain purposes such as surveys, direct marketing, we may need to get your consent. When we process your personal data on the basis of your consent, you are free to withdraw that consent at any time. You can withdraw your consent by contacting us using the contact details at the bottom of this notice. Please note that if you withdraw your consent we may not be able to continue providing you with the service to which the consent related.

Information you are obliged to provide

We require certain information from you in order to be able to enter into a contract with you and to provide you with our services. Where this is the case we will indicate on relevant forms what personal data is required in order to enter into the contract with you. If you do not provide the information, we will not be able to provide you with our services.

Automated processing

When we receive a claim we want to make sure that we process it as quickly as possible. We have therefore developed a system that undertakes an initial assessment of your claim automatically. Most of the time the system will be able to identify that a claim should be paid out, at which point the claim is then processed automatically. The algorithms we use for automated processing are simply the Terms and Conditions and Table of Benefits relevant to your plan, written into software code. Each claim is then assessed under the rules relevant to the treatment/procedure in question along with the information you have provided (the invoices, receipts etc.). If your claim is rejected through automated processing we will always send you the reason in plain English that reflects the relevant rule under your Terms and Conditions and/or Table of Benefits that triggered the rejection. The explanation provided would be the same as if the claim had been manually adjudicated, because the same software coding is used for manual adjudication on our systems. If the rejection occurred because we need you to provide some further information to us we will explain exactly what we need and you can then re-submit your claim accordingly. Also, you always have the right to object or appeal a claims decision by contacting us at either of the following:

Who do we share your personal data with?

We share your personal data with the following third parties:

  • Hospitals and primary care providers - we will provide hospitals and primary care providers with information that allows them to verify your current level of cover.

  • Service providers - We rely on trusted third parties to help us run the Vhi business and to provide us with specialised services. These can include companies that provide IT services (e.g. scanning and uploading letters from customers and hosting data when providing software services). These can also include legal advisors, accountants and consultants. Where our service providers have access to your personal data, we ensure they are subject to appropriate contracts and other safeguards.

  • Group schemes - Many members avail of our services through a group scheme that is operated by their employer. In order to administer your policy Vhi may exchange certain details, such as your name, address, gender, date of birth, contact details, details of dependants that will be included on a policy, their relationship to the Policyholder, previous insurance details, employee and group scheme number and PPS number. This information may be provided electronically.

  • Regulators - In certain circumstances Vhi is obliged to provide information to a regulator, (e.g. in the investigation of complaints).

  • Group companies - Vhi consists of a number of separate companies. Some of these companies provide services to each other which may involve the sharing of your personal data between one or more group companies.

  • Other insurers - We may share your personal data with other insurers in order to verify your level of cover as well as for other regulatory reasons.

Transfers outside of the European Economic Area (EEA)

There are certain circumstances where we will transfer your personal data outside of the EEA to a country which is not recognised by the European Commission as providing an equivalent level of protection for personal data as is provided for in the EEA. If we transfer your personal data outside of the EEA please rest assured that we will ensure that appropriate measures are in place to protect your personal data and to comply with our obligations under applicable data protection law. This may mean that we enter into contracts in the form approved by the European Commission, or we ensure that the company to which we transfer your personal data has agreed to abide by an approved transfer mechanism, such as the EU-US Privacy Shield framework. If you would like further details about the measures we have taken in relation to the transfer of your personal data, or copies of the agreements that we have put in place in relation to the transfers, please contact us using the details at the bottom of this notice.

Retention of personal data

Vhi will retain your personal data in accordance with our record retention policy. This policy operates on the principle that we keep personal data for no longer than is necessary for the purpose for which we collected it. It is also kept in accordance with any legal requirements that are imposed on us. This means that the retention period for your personal data will vary depending on the type of personal data. For further information about the criteria that we apply to determine retention periods please see below:

  • Statutory and regulatory obligations - As we work in a highly regulated industry, we have certain statutory and regulatory obligations to retain personal data for set periods of time.

  • Managing legal claims - When we assess how long we keep personal data we take into account whether that data may be required in order to defend any legal claims which may be made. If such data is required, we may keep it until the statute of limitations runs out in relation to the type of claim that can be made (which varies from 2 to 12 years).

  • Business requirements - As we only collect personal data for defined purposes, we assess how long we need to keep personal data for in order to meet our reasonable business purposes.

Your rights

You have various rights under data protection law, subject to certain exemptions, in connection with our processing of your personal data:

  • Right to access the data - You have the right to request a copy of the personal data that we hold about you, together with other information about our processing of that personal data.

  • Right to rectification - You have the right to request that any inaccurate data that is held about you is corrected, or if we have incomplete information you may request that we update the information such that it is complete.

  • Right to erasure - You have the right to request us to delete personal data that we hold about you. This is sometimes referred to as the right to be forgotten.

  • Right to restriction of processing or to object to processing - You have the right to request that we no longer process your personal data for particular purposes, or to object to our processing of your personal data for particular purposes.

  • Right to data portability - You have the right to request us to provide you, or a third party, with a copy of your personal data in a structured, commonly used machine readable format.

    In order to exercise any of the above rights, please contact us using the contact details set out below.

Questions and Complaints

If you have any queries or complaints in connection with our processing of your personal data, you can get in touch with us using the following contact details:

You also have the right to lodge a complaint with the Data Protection Commission if you are unhappy with our processing of your personal data. Details of how to lodge a complaint can be found on the dataprotection.ie website, or you can call the Data Protection Commission on 1890 252 231.
Vhi Dental

What is the purpose of this notice?

In order to provide you with our products and services, we need to get to know you and what your needs are. This means that we collect certain information about you in the course of operating our business. This notice sets out details of the information that we collect, how we process it, to whom we disclose it, and your rights under data protection law in relation to our processing of your data.

Who controls the use of your personal data?

Vhi Healthcare DAC ("Vhi") works with Collinson Insurance Services Limited, trading as Intana ("Intana") acting as agent for, Great Lakes Insurance SE, UK Branch, ("Your Insurer") to provide the Vhi Dental product. Unless we set out otherwise in this notice, Vhi and Intana are joint controllers of personal data that is collected and processed in connection with the Vhi Dental product. References to "we", "us" and "our" therefore should be read as references to Vhi and Intana jointly, whereas if there is a reference to Vhi this means that Vhi is the sole controller of that personal data. Similarly, any references to Intana means that Intana are the sole controller of that personal data.

Your Insurer will also need to be a controller of your personal data for claims administration purposes and to meet their statutory obligations. For more information about this, please look at www.glise.com.

Vhi's registered address is Vhi House, Lower Abbey Street, Dublin 1, and Intana's registered address is Cutlers Exchange, 123 Houndsditch, London, EC3A 7BU.

If you have any queries in relation to the processing of your personal data, Vhi has appointed a data protection officer that you can contact at dataprotection@vhi.ie You can also contact Intana's data protection officer at data.protection@intana-assist.com.

Why are Vhi and Intana both controllers of my personal data?

Vhi is responsible for selling you your Vhi Dental product, making any changes that you may need to make to it and undertaking any marketing with your permission once the policy has been sold. Intana needs to administer the underlying insurance policy, meet its regulatory obligations and deal with any claims that you may need to make. Vhi and Intana have entered into an agreement under which we have agreed that where the processing of your personal data is necessary in order to enter into the Dental policy and pay claims, we will act as joint controllers of your personal data. However, as there are certain aspects of the Vhi Dental product that are operated solely by Vhi (e.g. the sale of the product and any marketing that is undertaken with your permission) Vhi is in charge of, and is therefore the sole controller of, certain personal data that is processed for those purposes. In the event that Vhi's relationship with Intana is terminated, Intana will only continue to process your personal data to meets its contractual, regulatory or legal obligations and Vhi's role as controller will be unaffected by the termination.

What personal data is collected?

In order to provide the Vhi Dental product to you we need to process certain personal data in relation to you, which includes:

  • Biographical data - We collect the following biographical data: name, assumed names, address, mobile phone number, email address, gender, and date of birth.

  • Payment data - Your payment details such as the IBAN, BIC and the name of your bank/building society will be collected and processed by us in the event that you purchase a Vhi Dental product and if you make a claim and receive payments through electronic funds transfers

  • Claims data - If you make a claim we will process details of the incident or event that gives rise to your claim. Where you make a claim in connection with medical treatment, we may process details of your dental history, details of services claimed, treatment dates, payments you have made and, if necessary, we may access or request further dental information relating to your claim. We may also process details of other insurance that may cover aspects of your claim, and further information that you provide in support of your claim, such as original or copy receipts.

  • Interactions with customer services - If you interact with our customer services departments we will record details of those interactions (e.g. records of phone calls, email correspondence and hard copy correspondence). If you make a complaint we will process details in relation to that complaint.

  • Digital platforms - When you interact with Vhi's digital platforms you will often provide personal data to Vhi, which you will be aware of when using the services. Vhi also automatically collects data about your use of its services, such as the IP address of the device you use to access the service, the type of device you are using, and how you interact with the services. Further details are available in the cookies policy and/or the data protection notice that accompanies the relevant service.

Where do we collect personal data from?

Most of the personal data that we collect about you will be provided by you through our application forms, claims forms and your interactions with customer services. However, certain information may be provided by third parties on your behalf, including the following:

  • Group schemes - Some of our customers avail of our services through a scheme that is operated by their employer. In order to sign you up as a customer your employer will give us certain details, such as your name, address, gender, age, contact details, and details of dependants that will be included on a policy.

  • Dependants - It is very common for our policies to cover not just the policyholder, but also their dependants. If you are a dependant covered by a policy, the policyholder will have provided us with certain details, such as your name and address, gender and age. In the event that a claim is made, the policyholder (or someone else with your permission) may provide us with the "claims data" outlined above.

  • Dental practices, Hospitals and Dentists - If you are making a claim or using one of our services, you may have had some interactions with a hospital or dental practitioner. We will contact these entities so that they can provide us with details of the services that you have received, so that your claim can be properly assessed and processed.

  • Digital platforms -When you access Vhi's digital platforms Vhi will collect the information that you provide to Vhi through the platform, and will also automatically collect certain data in relation to your use of Vhi's services, such as the IP address of the device you use to access the service, the type of device you are using, and how you interact with the services.

Why do you process my personal data?

We process your personal data in order to provide you with our services and to assist us in the operation of our business. Under data protection law we are required to ensure that there is an appropriate basis for the processing of your personal data, and we are required to let you know what that basis is. There are various options under data protection law, but the primary bases that we use are (i) processing necessary for the performance of our contracts with you, (ii) processing necessary in order for us to pursue our legitimate interests, (iii) processing where we have your and or your dependants' consent, and (iv) processing that is required under applicable law. We set out further details of our processing of your personal data below, together with the basis for that processing:

  • Administering your policies - We will process your personal data in order to administer your policy. This includes processing your personal data in order to make and receive payments, and to maintain our records of the insurance products that you have purchased. Where we process your personal data in order to administer your policy this will be on the basis that it is necessary in order for the performance of the contracts with you, or in the case of Vhi for our legitimate interest in ensuring the Intana operates the insurance policy in accordance with our agreement with Intana.

  • Providing you with services - Vhi provides different channels to engage with you in order to provide you with our services, including where you have opted to avail of electronic channels such as MyVhi, Vhi's website and mobile app. The MyVhi section of our website, and our mobile applications, give you access to your policy documents and information in one secure place, anytime, anywhere. Vhi is the sole controller of personal data that is processed to provide you with access to our digital channels, but personal data that is transmitted through these channels that relates to claims will be processed on a joint controller basis, as described at the beginning of this notice. Where we process health related claims data in the context of providing these services, this will be on the basis that it is necessary and proportionate for the purposes of providing insurance policies as part of our business. Any other data is processed on the basis that it is necessary in order for the performance of our contracts with you, and by Vhi for their legitimate interest in ensuring Intana operates the insurance policy in accordance with Vhi's agreement with Intana.

  • Administering claims - In order to administer a claim that you make under a policy we will need to process personal data in relation to the claim. Where you make a claim in connection with dental treatment, this will include the underlying dental condition that is treated, your dental history, and the dental services that you receive. We will also need to process your personal data in order to deal with claims queries or to deal with complaints queries. If your claim is successful, we will process your personal data in order to cover any claims that you have made, refund you fees that you may have incurred or to pay any service providers directly. Where we process health related claims data, this will be on the basis that it is necessary and proportionate for the purposes of administering your insurance policy. Any other data is processed on the basis that it is necessary in order for the performance of our contracts with you, and by Vhi for our legitimate interest in ensuring Intana operates the insurance policy in accordance with our agreement with Intana.

  • Running our business - In order to ensure that we can continue to provide you with cover, it is essential to ensure that we can manage the costs of claims and determine what events each of our policies can cover. In order to do this we undertake extensive modelling of the current and historic claims made by our customers, which we use to identify patterns in claims, to try to predict future trends and how they might affect our business, and to undertake pricing, profitability and propensity to claim studies. This information may be used to help us develop new product benefits and services. We also undertake auditing and quality control to check that our processes are robust and are being followed. In addition, we also need to process your data to meet certain regulatory and legislative obligations that apply to our businesses. We try to do all of the above by using aggregated or anonymous data where possible, so you won't be identifiable from the data, but some of this work involves processing your data without anonymising it. Where we process health related claims data, this will be on the basis that it is necessary and proportionate for the purposes of providing insurance policies as part of our business. Any other personal data that we process will be on the basis of our legitimate interests in operating our business, or on the basis of a legal obligation to which we are subject.

  • Marketing - If you provide Vhi with your consent to send you marketing messages Vhi will process your personal data in order to make sure that any marketing messages that Vhi send you are relevant to you. Vhi also undertakes market research and surveys, which provides Vhi with market insights. Vhi's processing of your personal data in relation to marketing and market research will be subject to your consent.

  • Fraud prevention and claims management - It is an unfortunate feature of any insurance product that fraud can occur from time to time. We have a number of systems and procedures in place to monitor for potentially fraudulent claims. If we identify a suspicious claim or pattern of claims, we will process your personal data in order to investigate the claim and to take appropriate measures to protect us and our customers. Where we process health data in connection with fraud prevention and claims management, this will be on the basis that it is necessary and proportionate for the purposes of administering your insurance policy. Any other personal data that we process will be on the basis of our legitimate interests in preventing fraudulent claims.

  • Administering our computer systems - We rely on technology and computer systems to run our business and administer claims. We have an extensive team of developers and support engineers who are constantly testing our systems, running trials of new software, and providing support to our users. In order to do this, where possible we try to use test data or anonymised data, but on occasion we may have to access live data directly, or we will often make a copy of some of the data that sits in our live systems and run our tests on that to make sure everything is working before we roll out a change. These copies may include your personal data, including details in relation to claims you have made. In general this processing of your personal data is justified by our legitimate interests in making sure our computer systems run properly and are safe and secure. If we process health data when running these tests or providing support services to our users, this will be on the basis that it is necessary and proportionate for the purposes of providing insurance policies as part of our business.

Important information about when we ask for your consent to the processing of your personal data

In order to process certain personal data in relation to you, we need to get your consent. When we process your personal data on the basis of your consent, you are free to withdraw that consent at any time. You can withdraw your consent by contacting us using the contact details at the bottom of this notice. Please note that if you withdraw your consent we may not be able to continue providing you with the service to which the consent related.

Information you are obliged to provide

We require certain information from you in order to be able to enter into a contract with you and to provide you with our services. Where this is the case we will indicate on relevant forms what personal data is required in order to enter into the contract with you. If you do not provide the information, we will not be able to provide you with our services.

Categories of recipients of your personal data

We share your personal data with the following third parties:

  • Dental practices, Hospitals and Dentists - Intana will provide hospitals and dental practitioners with information that allows them to verify that your claim is covered by your policy and the current level of cover that you have.

  • Service providers - We rely on trusted third parties to help us run our businesses and to provide us with specialised services. This can include companies that provide IT services, from scanning letters that we receive and loading them onto our systems to hosting data on our behalf when providing software services. We also engage with companies that provide us with non-IT related services, such as legal advisors, accountants and consultants. We may also need to share personal data in order to handle any claim that you make. Who we need to share data with will depend on your particular circumstances at the time of your claim, but examples may include local claims administrators, cost containment specialists and medical/transport repatriation services. Where our service providers have access to your personal data we ensure that they are subject to appropriate contracts and other safeguards.

  • Underwriters - In the insurance industry it is common practice to engage an underwriter to take on the risks associated with a policy. In such circumstances, the underwriter will be given access to details about your claim in order to process your claim.

  • Regulators - In certain circumstances we are obliged to provide information to a regulator, such as in relation to the investigation of complaints.

  • Group companies - Vhi and Intana each consist of a number of separate companies. Some of these companies provide services on an intra-group basis, which may involve the sharing of your personal data between one or more group companies.

Transfers outside of the EU

There are certain circumstances where we will transfer your personal data outside of the European Union to a country which is not recognised by the European Commission as providing an equivalent level of protection for personal data as is provided for in the European Union. Where you make a claim under your policy we may need to transfer your personal data outside of the European Union in order to handle that claim for you (e.g. when you make a claim in relation to treatment at a hospital outside of the EU). Such transfers of personal data are on that basis that the transfer is necessary in order to perform our contractual obligations under your policy.

If we transfer your personal data outside of the European Economic Area for any other reason please rest assured that we will ensure that appropriate measures are in place to protect your personal data and to comply with our obligations under applicable data protection law. This may mean that we enter into contracts in the form approved by the European Commission, or we ensure that the company to which we transfer your personal data has agreed to abide by an approved transfer mechanism, such as the EU-US Privacy Shield framework. If you would like further details about the measures we have taken in relation to the transfer of your personal data, or copies of the agreements that we have put in place in relation to the transfers, please contact us using the details at the bottom of this notice.

Retention of personal data

We will retain your personal data in accordance with our record retention policies. The record retention policies operate on the principle that we keep personal data for no longer than is necessary for the purpose for which we collected it, and in accordance with any requirements that are imposed on us by our regulators or by law. This means that the retention period for your personal data will vary depending on the type of personal data. For further information about the criteria that we apply to determine retention periods please see below:

  • Statutory and regulatory obligations - As we work in a highly regulated industry, we have certain statutory and regulatory obligations to retain personal data for set periods of time.

  • Managing legal claims - When we assess how long we keep personal data we take into account whether that data may be required in order to defend any legal claims which may be made. If such data is required, we may keep it until the statute of limitations runs out in relation to the type of claim that can be made (which varies from 2 to 12 years).

  • Business requirements - As we only collect personal data for defined purposes, we assess how long we need to keep personal data for in order to meet our reasonable business purposes.

Your rights

You have various rights under data protection law, subject to certain exemptions, in connection with our processing of your personal data:

  • Right to access the data - You have the right to request a copy of the personal data that we hold about you, together with other information about our processing of that personal data.

  • Right to rectification - You have the right to request that any inaccurate data that is held about you is corrected, or if we have incomplete information you may request that we update the information such that it is complete.

  • Right to erasure - You have the right to request us to delete personal data that we hold about you. This is sometimes referred to as the right to be forgotten.

  • Right to restriction of processing or to object to processing - You have the right to request that we no longer process your personal data for particular purposes, or to object to our processing of your personal data for particular purposes.

  • Right to data portability - You have the right to request us to provide you, or a third party, with a copy of your personal data in a structured, commonly used machine readable format.


Vhi and Intana have agreed that Vhi will deal with requests to exercise your data protection rights. In order to exercise any of the above rights, please contact Vhi using the contact details set out below. However, please note that you may also make a request directly to Intana if you wish.

Questions and Complaints

If you have any queries or complaints in connection with our processing of your personal data, you can get in touch with us using the following contact details:

For claims matters contact Intana: Customer Service Line on +353 46 907 7337

Email: vhidentalclaims@intana-assist.com

You also have the right to lodge a complaint with the Data Protection Commission if you are unhappy with our processing of your personal data. Details of how to lodge a complaint can be found on the www.dataprotection.ie website, or you can call the Data Protection Commission on 1890 252 231.
Vhi International

What is the purpose of this notice?

In order to provide you with our products and services, we need to get to know you and what your needs are. This means that we collect certain information about you in the course of operating our business. This notice sets out details of the information that we collect, how we process it, to whom we disclose it, and your rights under data protection law in relation to our processing of your data.

Who controls the use of your personal data?

Vhi Healthcare DAC ("Vhi") works with Collinson Insurance Services Limited, trading as Intana and acting as agent for Astrenska Insurance Limited, ("Intana") to provide the Vhi International Health Insurance product. Unless we set out otherwise in this notice, Vhi and Intana are joint controllers of personal data that is collected and processed in connection with the Vhi International Health Insurance product. References to "we", "us" and "our" therefore should be read as references to Vhi and Intana jointly, whereas if there is a reference to Vhi this means that Vhi is the sole controller of that personal data. Similarly, any references to Intana means that Intana are the sole controller of that personal data.

Vhi's registered address is Vhi House, Lower Abbey Street, Dublin 1, and Intana's registered address is Cutlers Exchange, 123 Houndsditch, London, EC3A 7BU.

If you have any queries in relation to the processing of your personal data, Vhi has appointed a data protection officer that you can contact at dataprotection@vhi.ie You can also contact Intana's data protection officer at data.protection@intana-assist.com.

Why are Vhi and Intana both controllers of my personal data?

Vhi is responsible for selling you your Vhi International Health Insurance product, making any changes that you may need to make to it and undertaking any marketing with your permission once the policy has been sold. Intana needs to administer the underlying insurance policy, meet its regulatory obligations and deal with any claims that you may need to make. Vhi and Intana have entered into an agreement under which we have agreed that where the processing of your personal data is necessary in order to enter into the International Health Insurance policy and pay claims, we will act as joint controllers of your personal data. However, as there are certain aspects of the Vhi International Health Insurance product that are operated solely by Vhi (e.g. the sale of the product and any marketing that is undertaken with your permission) Vhi is in charge of, and is therefore the sole controller of, certain personal data that is processed for those purposes. In the event that Vhi's relationship with Intana is terminated, Intana will only continue to process your personal data to meets its contractual, regulatory or legal obligations and Vhi's role as controller will be unaffected by the termination.

What personal data is collected?

In order to provide the Vhi International Health Insurance product to you we need to process certain personal data in relation to you, which includes:

  • Biographical data - We collect the following biographical data: name, assumed names, address, mobile phone number, email address, gender, and date of birth.

  • Eligibility for membership - We may ask for evidence of your eligibility to purchase a Vhi International Healthcare policy (i.e. evidence that you are an Irish resident), and evidence on renewal in connection with your continued eligibility for the policy. We may also request further details from you in order to assess your application for a policy, including your state of health, employment or status.

  • Pre-existing conditions - If at the time of your application, you are not a member of a health insurance plan provided and underwritten by an Irish licensed insurer, we will require details of any pre-existing medical conditions

  • Payment data - Your payment details such as the IBAN, BIC and the name of your bank/building society will be collected and processed by us in the event that you purchase a Vhi International Health Insurance product and if you make a claim and receive payments through electronic funds transfers

  • Claims data - If you make a claim we will process details of the incident or event that gives rise to your claim. Where you make a claim in connection with medical treatment, we may process details of your medical history, details of services claimed, treatment dates, payments you have made and, if necessary, we may access or request further medical information relating to your claim. We may also process details of other insurance that may cover aspects of your claim, and further information that you provide in support of your claim, such as original or copy receipts.

  • Interactions with customer services - If you interact with our customer services departments we will record details of those interactions (e.g. records of phone calls, email correspondence and hard copy correspondence). If you make a complaint we will process details in relation to that complaint.

  • Digital platforms - When you interact with Vhi's digital platforms you will often provide personal data to Vhi, which you will be aware of when using the services. Vhi also automatically collects data about your use of its services, such as the IP address of the device you use to access the service, the type of device you are using, and how you interact with the services. Further details are available in the cookies policy and/or the data protection notice that accompanies the relevant service.

Where do we collect personal data from?

Most of the personal data that we collect about you will be provided by you through our application forms, claims forms and your interactions with customer services. However, certain information may be provided by third parties on your behalf, including the following:

  • Group schemes - Some of our customers avail of our services through a scheme that is operated by their employer. In order to sign you up as a customer your employer will give us certain details, such as your name, address, gender, age, contact details, and details of dependants that will be included on a policy.

  • Dependants - It is very common for our policies to cover not just the policyholder, but also their dependants. If you are a dependant covered by a policy, the policyholder will have provided us with certain details, such as your name and address, gender and age. In the event that a claim is made, the policyholder (or someone else with your permission) may provide us with the "claims data" outlined above.

  • Hospital and primary care providers - If you are making a claim or using one of our services, you may have had some interactions with a hospital or primary care provider. We will contact these entities so that they can provide us with details of the services that you have received, so that your claim can be properly assessed and processed.

  • Digital platforms - When you access Vhi's digital platforms Vhi will collect the information that you provide to Vhi through the platform, and will also automatically collect certain data in relation to your use of Vhi's services, such as the IP address of the device you use to access the service, the type of device you are using, and how you interact with the services.

Why do you process my personal data?

We process your personal data in order to provide you with our services and to assist us in the operation of our business. Under data protection law we are required to ensure that there is an appropriate basis for the processing of your personal data, and we are required to let you know what that basis is. There are various options under data protection law, but the primary bases that we use are (i) processing necessary for the performance of our contracts with you, (ii) processing necessary in order for us to pursue our legitimate interests, (iii) processing where we have your and or your dependants' consent, and (iv) processing that is required under applicable law. We set out further details of our processing of your personal data below, together with the basis for that processing:

  • Assessing eligibility - Vhi will process your personal data in order to assess your eligibility to purchase the Vhi International Health Insurance policy at the time you apply for the policy and on renewal. Vhi processes this personal data on the basis of its legitimate interests in ensuring that only eligible persons purchase a policy. Where Vhi processes health related data in the context of assessing eligibility, this will be on the basis that it is necessary and proportionate for the purposes of providing insurance policies as part of its business.

  • Administering your policies - We will process your personal data in order to administer your policy. This includes processing your personal data in order to make and receive payments, and to maintain our records of the insurance products that you have purchased. Where we process your personal data in order to administer your policy this will be on the basis that it is necessary in order for the performance of the contracts with you, or in the case of Vhi for our legitimate interest in ensuring the Intana operates the insurance policy in accordance with our agreement with Intana.

  • Providing you with services - Vhi provides different channels to engage with you in order to provide you with our services, including where you have opted to avail of electronic channels such as MyVhi, Vhi's website and mobile app. The MyVhi section of our website, and our mobile applications, give you access to your policy documents and information in one secure place, anytime, anywhere. Vhi is the sole controller of personal data that is processed to provide you with access to our digital channels, but personal data that is transmitted through these channels that relates to claims will be processed on a joint controller basis, as described at the beginning of this notice. Where we process health related claims data in the context of providing these services, this will be on the basis that it is necessary and proportionate for the purposes of providing insurance policies as part of our business. Any other data is processed on the basis that it is necessary in order for the performance of our contracts with you, and by Vhi for their legitimate interest in ensuring Intana operates the insurance policy in accordance with Vhi's agreement with Intana.

  • Administering claims - In order to administer a claim that you make under a policy we will need to process personal data in relation to the claim. Where you make a claim in connection with medical treatment, this will include the underlying medical condition that is treated, your medical history, and the medical services that you receive. We will also need to process your personal data in order to deal with claims queries or to deal with complaints queries. If your claim is successful, we will process your personal data in order to cover any claims that you have made, refund you fees that you may have incurred or to pay any service providers directly. Where we process health related claims data, this will be on the basis that it is necessary and proportionate for the purposes of administering your insurance policy. Any other data is processed on the basis that it is necessary in order for the performance of our contracts with you, and by Vhi for our legitimate interest in ensuring Intana operates the insurance policy in accordance with our agreement with Intana.

  • Running our business - In order to ensure that we can continue to provide you with cover, it is essential to ensure that we can manage the costs of claims and determine what events each of our policies can cover. In order to do this we undertake extensive modelling of the current and historic claims made by our customers, which we use to identify patterns in claims, to try to predict future trends and how they might affect our business, and to undertake pricing, profitability and propensity to claim studies. This information may be used to help us develop new product benefits and services. We also undertake auditing and quality control to check that our processes are robust and are being followed. In addition, we also need to process your data to meet certain regulatory and legislative obligations that apply to our businesses. We try to do all of the above by using aggregated or anonymous data where possible, so you won't be identifiable from the data, but some of this work involves processing your data without anonymising it. Where we process health related claims data, this will be on the basis that it is necessary and proportionate for the purposes of providing insurance policies as part of our business. Any other personal data that we process will be on the basis of our legitimate interests in operating our business, or on the basis of a legal obligation to which we are subject.

  • Marketing - If you provide Vhi with your consent to send you marketing messages Vhi will process your personal data in order to make sure that any marketing messages that Vhi send you are relevant to you. Vhi also undertakes market research and surveys, which provides Vhi with market insights. Vhi's processing of your personal data in relation to marketing and market research will be subject to your consent.

  • Fraud prevention and claims management - It is an unfortunate feature of any insurance product that fraud can occur from time to time. We have a number of systems and procedures in place to monitor for potentially fraudulent claims. If we identify a suspicious claim or pattern of claims, we will process your personal data in order to investigate the claim and to take appropriate measures to protect us and our customers. Where we process health data in connection with fraud prevention and claims management, this will be on the basis that it is necessary and proportionate for the purposes of administering your insurance policy. Any other personal data that we process will be on the basis of our legitimate interests in preventing fraudulent claims.

  • Administering our computer systems - We rely on technology and computer systems to run our business and administer claims. We have an extensive team of developers and support engineers who are constantly testing our systems, running trials of new software, and providing support to our users. In order to do this, where possible we try to use test data or anonymised data, but on occasion we may have to access live data directly, or we will often make a copy of some of the data that sits in our live systems and run our tests on that to make sure everything is working before we roll out a change. These copies may include your personal data, including details in relation to claims you have made. In general this processing of your personal data is justified by our legitimate interests in making sure our computer systems run properly and are safe and secure. If we process health data when running these tests or providing support services to our users, this will be on the basis that it is necessary and proportionate for the purposes of providing insurance policies as part of our business.

Important information about when we ask for your consent to the processing of your personal data

In order to process certain personal data in relation to you, we need to get your consent. When we process your personal data on the basis of your consent, you are free to withdraw that consent at any time. You can withdraw your consent by contacting us using the contact details at the bottom of this notice. Please note that if you withdraw your consent we may not be able to continue providing you with the service to which the consent related.

Information you are obliged to provide

We require certain information from you in order to be able to enter into a contract with you and to provide you with our services. Where this is the case we will indicate on relevant forms what personal data is required in order to enter into the contract with you. If you do not provide the information, we will not be able to provide you with our services.

Categories of recipients of your personal data

We share your personal data with the following third parties:

  • Hospitals and primary care providers - Intana will provide hospitals and primary care providers with information that allows them to verify that your claim is covered by your policy and the current level of cover that you have. Intana will also need to make sure that you receive the appropriate treatment.

  • Service providers - We rely on trusted third parties to help us run our businesses and to provide us with specialised services. This can include companies that provide IT services, from scanning letters that we receive and loading them onto our systems to hosting data on our behalf when providing software services. We also engage with companies that provide us with non-IT related services, such as legal advisors, accountants and consultants. We may also need to share personal data in order to handle any claim that you make. Who we need to share data with will depend on your particular circumstances at the time of your claim, but examples may include local claims administrators, cost containment specialists and medical/transport repatriation services. Where our service providers have access to your personal data we ensure that they are subject to appropriate contracts and other safeguards.

  • Underwriters - In the insurance industry it is common practice to engage an underwriter to take on the risks associated with a policy. In such circumstances, the underwriter will be given access to details about your claim in order to process your claim.

  • Regulators - In certain circumstances we are obliged to provide information to a regulator, such as in relation to the investigation of complaints.

  • Group companies - Vhi and Intana each consist of a number of separate companies. Some of these companies provide services on an intra-group basis, which may involve the sharing of your personal data between one or more group companies.

Transfers outside of the EU

There are certain circumstances where we will transfer your personal data outside of the European Union to a country which is not recognised by the European Commission as providing an equivalent level of protection for personal data as is provided for in the European Union. Where you make a claim under your policy we may need to transfer your personal data outside of the European Union in order to handle that claim for you (e.g. when you make a claim in relation to treatment at a hospital outside of the EU). Such transfers of personal data are on that basis that the transfer is necessary in order to perform our contractual obligations under your policy.

If we transfer your personal data outside of the European Economic Area for any other reason please rest assured that we will ensure that appropriate measures are in place to protect your personal data and to comply with our obligations under applicable data protection law. This may mean that we enter into contracts in the form approved by the European Commission, or we ensure that the company to which we transfer your personal data has agreed to abide by an approved transfer mechanism, such as the EU-US Privacy Shield framework. If you would like further details about the measures we have taken in relation to the transfer of your personal data, or copies of the agreements that we have put in place in relation to the transfers, please contact us using the details at the bottom of this notice.

Retention of personal data

We will retain your personal data in accordance with our record retention policies. The record retention policies operate on the principle that we keep personal data for no longer than is necessary for the purpose for which we collected it, and in accordance with any requirements that are imposed on us by our regulators or by law. This means that the retention period for your personal data will vary depending on the type of personal data. For further information about the criteria that we apply to determine retention periods please see below:

  • Statutory and regulatory obligations - As we work in a highly regulated industry, we have certain statutory and regulatory obligations to retain personal data for set periods of time.

  • Managing legal claims - When we assess how long we keep personal data we take into account whether that data may be required in order to defend any legal claims which may be made. If such data is required, we may keep it until the statute of limitations runs out in relation to the type of claim that can be made (which varies from 2 to 12 years).

  • Business requirements - As we only collect personal data for defined purposes, we assess how long we need to keep personal data for in order to meet our reasonable business purposes.

Your rights

You have various rights under data protection law, subject to certain exemptions, in connection with our processing of your personal data:

  • Right to access the data - You have the right to request a copy of the personal data that we hold about you, together with other information about our processing of that personal data.

  • Right to rectification - You have the right to request that any inaccurate data that is held about you is corrected, or if we have incomplete information you may request that we update the information such that it is complete.

  • Right to erasure - You have the right to request us to delete personal data that we hold about you. This is sometimes referred to as the right to be forgotten.

  • Right to restriction of processing or to object to processing - You have the right to request that we no longer process your personal data for particular purposes, or to object to our processing of your personal data for particular purposes.

  • Right to data portability - You have the right to request us to provide you, or a third party, with a copy of your personal data in a structured, commonly used machine readable format.


Vhi and Intana have agreed that Vhi will deal with requests to exercise your data protection rights. In order to exercise any of the above rights, please contact Vhi using the contact details set out below. However, please note that you may also make a request directly to Intana if you wish.

Questions and Complaints

If you have any queries or complaints in connection with our processing of your personal data, you can get in touch with us using the following contact details:

For claims matters contact Intana: Customer Service Line +353 46 9077377 for members in the USA (Toll Free) 1 800 852 7747

Email: vhi.international@intana-assist.com

You also have the right to lodge a complaint with the Data Protection Commission if you are unhappy with our processing of your personal data. Details of how to lodge a complaint can be found on the www.dataprotection.ie website, or you can call the Data Protection Commission on 1890 252 231.
Vhi MultiTrip

What is the purpose of this notice?

In order to provide you with our products and services, we need to get to know you and what your needs are. This means that we collect certain information about you in the course of operating our business. This notice sets out details of the information that we collect, how we process it, to whom we disclose it, and your rights under data protection law in relation to our processing of your data.

Who controls the use of your personal data?

Vhi Healthcare DAC ("Vhi") works with Collinson Insurance Services Limited, trading as Intana ("Intana") acting as agent for, Great Lakes Insurance SE, UK Branch, ("Your Insurer") to provide the Vhi Multitrip product. Unless we set out otherwise in this notice, Vhi and Intana are joint controllers of personal data that is collected and processed in connection with the Vhi Multitrip product. References to "we", "us" and "our" therefore should be read as references to Vhi and Intana jointly, whereas if there is a reference to Vhi this means that Vhi is the sole controller of that personal data. Similarly, any references to Intana means that Intana are the sole controller of that personal data.Your Insurer will also need to be a controller of your personal data for claims administration purposes and to meet their statutory obligations. For more information about this, please look at www.glise.com.

Vhi's registered address is Vhi House, Lower Abbey Street, Dublin 1, and Intana's registered address is Cutlers Exchange, 123 Houndsditch, London, EC3A 7BU.

If you have any queries in relation to the processing of your personal data, Vhi has appointed a data protection officer that you can contact at dataprotection@vhi.ie You can also contact Intana's data protection officer at data.protection@intana-assist.com.

Why are Vhi and Intana both controllers of my personal data?

Vhi is responsible for selling you your Vhi Multitrip product, making any changes that you may need to make to it and undertaking any marketing with your permission once the policy has been sold. Intana needs to administer the underlying insurance policy, meet its regulatory obligations and deal with any claims that you may need to make. Vhi and Intana have entered into an agreement under which we have agreed that where the processing of your personal data is necessary in order to enter into the Multitrip policy and pay claims, we will act as joint controllers of your personal data. However, as there are certain aspects of the Vhi Multitrip product that are operated solely by Vhi (e.g. the sale of the product and any marketing that is undertaken with your permission) Vhi is in charge of, and is therefore the sole controller of, certain personal data that is processed for those purposes. In the event that Vhi's relationship with Intana is terminated, Intana will only continue to process your personal data to meets its contractual, regulatory or legal obligations and Vhi's role as controller will be unaffected by the termination.

What personal data is collected?

In order to provide the Vhi Multitrip product to you we need to process certain personal data in relation to you, which includes:

  • Biographical data - We collect the following biographical data: name, assumed names, address, mobile phone number, email address, gender, and date of birth.

  • Payment data - Your payment details such as the IBAN, BIC and the name of your bank/building society will be collected and processed by us in the event that you purchase a Vhi Multitrip product and if you make a claim and receive payments through electronic funds transfers

  • Claims data - If you make a claim we will process details of the incident or event that gives rise to your claim. Where you make a claim in connection with medical treatment, we may process details of your medical history, details of services claimed, treatment dates, payments you have made and, if necessary, we may access or request further medical information relating to your claim. We may also process details of other insurance that may cover aspects of your claim, and further information that you provide in support of your claim, such as original or copy receipts.

  • Interactions with customer services - If you interact with our customer services departments we will record details of those interactions (e.g. records of phone calls, email correspondence and hard copy correspondence). If you make a complaint we will process details in relation to that complaint.

  • Digital platforms - When you interact with Vhi's digital platforms you will often provide personal data to Vhi, which you will be aware of when using the services. Vhi also automatically collects data about your use of its services, such as the IP address of the device you use to access the service, the type of device you are using, and how you interact with the services. Further details are available in the cookies policy and/or the data protection notice that accompanies the relevant service.

Where do we collect personal data from?

Most of the personal data that we collect about you will be provided by you through our application forms, claims forms and your interactions with customer services. However, certain information may be provided by third parties on your behalf, including the following:

  • Group schemes - Some of our customers avail of our services through a scheme that is operated by their employer. In order to sign you up as a customer your employer will give us certain details, such as your name, address, gender, age, contact details, and details of dependants that will be included on a policy.

  • Dependants - It is very common for our policies to cover not just the policyholder, but also their dependants. If you are a dependant covered by a policy, the policyholder will have provided us with certain details, such as your name and address, gender and age. In the event that a claim is made, the policyholder (or someone else with your permission) may provide us with the "claims data" outlined above.

  • Hospital and primary care providers - If you are making a claim or using one of our services, you may have had some interactions with a hospital or primary care provider. We will contact these entities so that they can provide us with details of the services that you have received, so that your claim can be properly assessed and processed.

  • Digital platforms -When you access Vhi's digital platforms Vhi will collect the information that you provide to Vhi through the platform, and will also automatically collect certain data in relation to your use of Vhi's services, such as the IP address of the device you use to access the service, the type of device you are using, and how you interact with the services.

Why do you process my personal data?

We process your personal data in order to provide you with our services and to assist us in the operation of our business. Under data protection law we are required to ensure that there is an appropriate basis for the processing of your personal data, and we are required to let you know what that basis is. There are various options under data protection law, but the primary bases that we use are (i) processing necessary for the performance of our contracts with you, (ii) processing necessary in order for us to pursue our legitimate interests, (iii) processing where we have your and or your dependants' consent, and (iv) processing that is required under applicable law. We set out further details of our processing of your personal data below, together with the basis for that processing:

  • Administering your policies - We will process your personal data in order to administer your policy. This includes processing your personal data in order to make and receive payments, and to maintain our records of the insurance products that you have purchased. Where we process your personal data in order to administer your policy this will be on the basis that it is necessary in order for the performance of the contracts with you, or in the case of Vhi for our legitimate interest in ensuring the Intana operates the insurance policy in accordance with our agreement with Intana.

  • Providing you with services - Vhi provides different channels to engage with you in order to provide you with our services, including where you have opted to avail of electronic channels such as MyVhi, Vhi's website and mobile app. The MyVhi section of our website, and our mobile applications, give you access to your policy documents and information in one secure place, anytime, anywhere. Vhi is the sole controller of personal data that is processed to provide you with access to our digital channels, but personal data that is transmitted through these channels that relates to claims will be processed on a joint controller basis, as described at the beginning of this notice. Where we process health related claims data in the context of providing these services, this will be on the basis that it is necessary and proportionate for the purposes of providing insurance policies as part of our business. Any other data is processed on the basis that it is necessary in order for the performance of our contracts with you, and by Vhi for their legitimate interest in ensuring Intana operates the insurance policy in accordance with Vhi's agreement with Intana.

  • Administering claims - In order to administer a claim that you make under a policy we will need to process personal data in relation to the claim. Where you make a claim in connection with medical treatment, this will include the underlying medical condition that is treated, your medical history, and the medical services that you receive. We will also need to process your personal data in order to deal with claims queries or to deal with complaints queries. If your claim is successful, we will process your personal data in order to cover any claims that you have made, refund you fees that you may have incurred or to pay any service providers directly. Where we process health related claims data, this will be on the basis that it is necessary and proportionate for the purposes of administering your insurance policy. Any other data is processed on the basis that it is necessary in order for the performance of our contracts with you, and by Vhi for our legitimate interest in ensuring Intana operates the insurance policy in accordance with our agreement with Intana.

  • Running our business - In order to ensure that we can continue to provide you with cover, it is essential to ensure that we can manage the costs of claims and determine what events each of our policies can cover. In order to do this we undertake extensive modelling of the current and historic claims made by our customers, which we use to identify patterns in claims, to try to predict future trends and how they might affect our business, and to undertake pricing, profitability and propensity to claim studies. This information may be used to help us develop new product benefits and services. We also undertake auditing and quality control to check that our processes are robust and are being followed. In addition, we also need to process your data to meet certain regulatory and legislative obligations that apply to our businesses. We try to do all of the above by using aggregated or anonymous data where possible, so you won't be identifiable from the data, but some of this work involves processing your data without anonymising it. Where we process health related claims data, this will be on the basis that it is necessary and proportionate for the purposes of providing insurance policies as part of our business. Any other personal data that we process will be on the basis of our legitimate interests in operating our business, or on the basis of a legal obligation to which we are subject.

  • Marketing - If you provide Vhi with your consent to send you marketing messages Vhi will process your personal data in order to make sure that any marketing messages that Vhi send you are relevant to you. Vhi also undertakes market research and surveys, which provides Vhi with market insights. Vhi's processing of your personal data in relation to marketing and market research will be subject to your consent.

  • Fraud prevention and claims management - It is an unfortunate feature of any insurance product that fraud can occur from time to time. We have a number of systems and procedures in place to monitor for potentially fraudulent claims. If we identify a suspicious claim or pattern of claims, we will process your personal data in order to investigate the claim and to take appropriate measures to protect us and our customers. Where we process health data in connection with fraud prevention and claims management, this will be on the basis that it is necessary and proportionate for the purposes of administering your insurance policy. Any other personal data that we process will be on the basis of our legitimate interests in preventing fraudulent claims.

  • Administering our computer systems - We rely on technology and computer systems to run our business and administer claims. We have an extensive team of developers and support engineers who are constantly testing our systems, running trials of new software, and providing support to our users. In order to do this, where possible we try to use test data or anonymised data, but on occasion we may have to access live data directly, or we will often make a copy of some of the data that sits in our live systems and run our tests on that to make sure everything is working before we roll out a change. These copies may include your personal data, including details in relation to claims you have made. In general this processing of your personal data is justified by our legitimate interests in making sure our computer systems run properly and are safe and secure. If we process health data when running these tests or providing support services to our users, this will be on the basis that it is necessary and proportionate for the purposes of providing insurance policies as part of our business.

Important information about when we ask for your consent to the processing of your personal data

In order to process certain personal data in relation to you, we need to get your consent. When we process your personal data on the basis of your consent, you are free to withdraw that consent at any time. You can withdraw your consent by contacting us using the contact details at the bottom of this notice. Please note that if you withdraw your consent we may not be able to continue providing you with the service to which the consent related.

Information you are obliged to provide

We require certain information from you in order to be able to enter into a contract with you and to provide you with our services. Where this is the case we will indicate on relevant forms what personal data is required in order to enter into the contract with you. If you do not provide the information, we will not be able to provide you with our services.

Categories of recipients of your personal data

We share your personal data with the following third parties:

  • Hospitals and primary care providers - Intana will provide hospitals and primary care providers with information that allows them to verify that your claim is covered by your policy and the current level of cover that you have. Intana will also need to make sure that you receive the appropriate treatment.

  • Service providers - We rely on trusted third parties to help us run our businesses and to provide us with specialised services. This can include companies that provide IT services, from scanning letters that we receive and loading them onto our systems to hosting data on our behalf when providing software services. We also engage with companies that provide us with non-IT related services, such as legal advisors, accountants and consultants. We may also need to share personal data in order to handle any claim that you make. Who we need to share data with will depend on your particular circumstances at the time of your claim, but examples may include local claims administrators, cost containment specialists and medical/transport repatriation services. Where our service providers have access to your personal data we ensure that they are subject to appropriate contracts and other safeguards.

  • Providers of additional benefits - Under your policy you are entitled to avail of the lounge access benefit, which is provided by a third party. Although the lounge access service provider is provided with information to confirm your entitlement to avail of its services, its processing of your personal data is subject to its own separate privacy statement.

  • Underwriters - In the insurance industry it is common practice to engage an underwriter to take on the risks associated with a policy. In such circumstances, the underwriter will be given access to details about your claim in order to process your claim.

  • Regulators - In certain circumstances we are obliged to provide information to a regulator, such as in relation to the investigation of complaints.

  • Group companies - Vhi and Intana each consist of a number of separate companies. Some of these companies provide services on an intra-group basis, which may involve the sharing of your personal data between one or more group companies.

Transfers outside of the EU

There are certain circumstances where we will transfer your personal data outside of the European Union to a country which is not recognised by the European Commission as providing an equivalent level of protection for personal data as is provided for in the European Union. Where you make a claim under your policy we may need to transfer your personal data outside of the European Union in order to handle that claim for you (e.g. when you make a claim in relation to treatment at a hospital outside of the EU). Such transfers of personal data are on that basis that the transfer is necessary in order to perform our contractual obligations under your policy.

If we transfer your personal data outside of the European Economic Area for any other reason please rest assured that we will ensure that appropriate measures are in place to protect your personal data and to comply with our obligations under applicable data protection law. This may mean that we enter into contracts in the form approved by the European Commission, or we ensure that the company to which we transfer your personal data has agreed to abide by an approved transfer mechanism, such as the EU-US Privacy Shield framework. If you would like further details about the measures we have taken in relation to the transfer of your personal data, or copies of the agreements that we have put in place in relation to the transfers, please contact us using the details at the bottom of this notice.

Retention of personal data

We will retain your personal data in accordance with our record retention policies. The record retention policies operate on the principle that we keep personal data for no longer than is necessary for the purpose for which we collected it, and in accordance with any requirements that are imposed on us by our regulators or by law. This means that the retention period for your personal data will vary depending on the type of personal data. For further information about the criteria that we apply to determine retention periods please see below:

  • Statutory and regulatory obligations - As we work in a highly regulated industry, we have certain statutory and regulatory obligations to retain personal data for set periods of time.

  • Managing legal claims - When we assess how long we keep personal data we take into account whether that data may be required in order to defend any legal claims which may be made. If such data is required, we may keep it until the statute of limitations runs out in relation to the type of claim that can be made (which varies from 2 to 12 years).

  • Business requirements - As we only collect personal data for defined purposes, we assess how long we need to keep personal data for in order to meet our reasonable business purposes.

Your rights

You have various rights under data protection law, subject to certain exemptions, in connection with our processing of your personal data:

  • Right to access the data - You have the right to request a copy of the personal data that we hold about you, together with other information about our processing of that personal data.

  • Right to rectification - You have the right to request that any inaccurate data that is held about you is corrected, or if we have incomplete information you may request that we update the information such that it is complete.

  • Right to erasure - You have the right to request us to delete personal data that we hold about you. This is sometimes referred to as the right to be forgotten.

  • Right to restriction of processing or to object to processing - You have the right to request that we no longer process your personal data for particular purposes, or to object to our processing of your personal data for particular purposes.

  • Right to data portability - You have the right to request us to provide you, or a third party, with a copy of your personal data in a structured, commonly used machine readable format.

Vhi and Intana have agreed that Vhi will deal with requests to exercise your data protection rights. In order to exercise any of the above rights, please contact Vhi using the contact details set out below. However, please note that you may also make a request directly to Intana if you wish.

Questions and Complaints

If you have any queries or complaints in connection with our processing of your personal data, you can get in touch with us using the following contact details:

For claims matters contact Intana: Customer Service Line on +353 46 9077358

Email: vhitravelclaims@intana-assist.com

You also have the right to lodge a complaint with the Data Protection Commission if you are unhappy with our processing of your personal data. Details of how to lodge a complaint can be found on the www.dataprotection.ie website, or you can call the Data Protection Commission on 1890 252 231.
Life and Mortgage Protection
Backpacker
Canada Cover
Please scroll down to view the Data Protection Statement for the services(s) that are relevant to you.
Vhi SwiftCare Clinics

What is the purpose of this notice?

Our promise to you is that 'when you need us, we're there'. In order to fulfil that promise, and to provide you with our products and services, we need to get to know you and what your needs are. This means that we collect certain information about you in the course of operating our business. This notice sets out details of the information that we collect, how we process it, to whom we disclose it, and your rights under data protection law in relation to our processing of your data.

Who controls the use of your personal data?

Vhi Investments DAC trading as Vhi SwiftCare Clinics, whose registered address is Vhi House, Lower Abbey Street, Dublin 1, is the company that provides the SwiftCare services to you. Vhi Investments DAC is therefore the company that controls and is responsible for personal data that is collected in relation to your treatment in Vhi SwiftCare Clinics. If you have any queries in relation to the processing of your personal data, we have appointed a data protection officer that you can contact at dataprotection@vhi.ie.

What personal data is collected?

In order to provide our services to you we need to process certain personal data in relation to you, which includes:

  • Biographical data - We collect the following biographical data: name, assumed names, address, phone number, email address, gender, family relationships (e.g. spouse, children), and date of birth.

  • Health data - We collect personal data from you in connection with the injury or illness that has brought you to the Vhi SwiftCare Clinic, including details of your medical history and details of the treatments or services that we provide to you.

  • Payment data - If you pay by credit or debit card we will process your credit or debit card details in order to take payment from you.

  • Vhi membership - As Vhi SwiftCare Clinics are only open to Vhi members, we will process details about your Vhi membership in order to ensure that you are entitled to avail of the Vhi SwiftCare Clinic services. We may also process your personal data in order to support a claim that you may make under your Vhi Healthcare plan in connection with your treatment

  • Interactions with customer services - If you interact with our customer services department we will record details of those interactions (e.g. records of phone calls, email correspondence and hard copy correspondence). If you make a complaint we will process details in relation to that complaint.

Where does Vhi collect personal data from?

Most of the personal data that we collect about you will be gathered as part of the consultation and treatment process. However, certain information may be provided by third parties on your behalf, including the following:

  • Group members - We will receive verification of your health insurance cover from Vhi Healthcare.

  • Medical service providers - We may request a copy of your medical files from third party service providers, such as your GP or other primary care givers.

Why do you process my personal data?

We process your personal data in order to provide you with our services and to assist us in the operation of our business. Under data protection law we are required to ensure that there is an appropriate basis for the processing of your personal data, and we are required to let you know what that basis is. There are various options under data protection law, but the primary basis that we use are (i) processing necessary to provide medical diagnosis, health care or treatments, or to manage the provision of health care services, (ii) processing necessary for the performance of our contracts with you, (iii) processing necessary in order for us to pursue our legitimate interests, (iv) processing where we have your consent, and (v) processing that is required under applicable law. We set out further details of our processing of your personal data below, together with the basis for that processing:

  • Providing you with services - Vhi SwiftCare clinics offer a range of consultations, treatments and medical services. When we process your personal data in connection with providing you with consultations, treatments and medical services, this will be on the basis that we have entered into a contract with you to provide you with the relevant service. Your health data that is processed in connection with the services is processed because it is necessary to process such health data in order to provide you with the relevant service.

  • Processing claims - As a Vhi member, If your consultation, treatment or medical service is covered by your Vhi Healthcare plan, we will make a claim for payment from the Vhi company that provides the Vhi Healthcare plan. In order to make the claim we will need to provide information in connection with the underlying medical condition that is treated, your medical history and the medical services that you receive. We will do so by submitting a copy of the receipt along with your signed claim to the Vhi company that processes and adjudicates claims under the terms of your health plan. We may also need to process your personal data in order to deal with queries about your level of cover and pre-certification/approval of treatment. Where we process this health related claims data this will be subject to your agreement to sign the claim form, but please note that if you do not provide your agreement we will not be able to make the claim on your behalf and you will be required to discharge the fees for your treatment to us in full.

  • Running our business - We will process your personal data in connection with the general administration of our business, including the generation of reports that detail how the business is functioning. We also undertake clinical and non-clinical auditing and quality control to check that our processes are robust and are being followed. In addition we also need to process your data to meet certain regulatory and legislative obligations that apply to our business. We try to do all of the above by using aggregated or anonymous data where possible, so you won't be identifiable from the data, but some of this work involves processing your data without anonymising it. Where we process your health data in connection with these activities it will be on the basis that the processing is necessary in order to manage the provision of Vhi SwiftCare's services. Where we process non-health data in connection with these activities this will be on the basis of our legitimate interest in operating our business.

  • Marketing and Surveys - If you provide us with your consent to send you marketing messages we will process your personal data in order to make sure that any marketing messages that we send you are relevant to you. We undertake annual patient satisfaction surveys for feedback purposes in order to assist us in improving our services. Our processing of your personal data in relation to marketing and market research will be subject to your consent at the time of your visit.

  • Administering our computer systems - Vhi relies on state of the art technology and computer systems to run our business and process claims. We have an extensive team of developers and support engineers who are constantly testing our systems, running trials of new software, and providing support to our users. In order to do this, where possible we try to use test data or anonymised data, but on occasion we may have to access live data directly, or we will often make a copy of some of the data that sits in our live systems and run our tests on that to make sure everything is working before we roll out a change. These copies may include your personal data, including details in relation to consultations, treatments or other medical services that you have received. In general this processing of your personal data is justified by our legitimate interests in making sure our computer systems run properly and are safe and secure. If we process health data when running these tests or providing support services to our users, it is on the basis that the processing is necessary for the management of Vhi SwiftCare services.

  • Legal Actions - If you require us to provide you or a third party with details of your treatment in connection with a personal injuries action against a third party, we will do so on the basis of your consent or where otherwise required by law.

Important information about when we ask for your consent to the processing of your personal data

In order to process certain personal data in relation to you, especially health data, we need to get your consent. This is particularly the case where we make a claim in connection with your Vhi Healthcare plan. When we process your personal data on the basis of your consent, you are free to withdraw that consent at any time. You can withdraw your consent by contacting us using the contact details at the bottom of this notice. Please note that if you withdraw your consent we may not be able to continue providing you with our services and/or making a claim on your behalf in connection with your Vhi Healthcare plan.

Information you are obliged to provide

We require certain information from you in order to be able to enter into a contract with you and to provide you with our services. Where this is the case we will indicate on relevant forms what personal data is required in order to enter into the contract with you. If you do not provide the information, we will not be able to provide you with our services.

Categories of recipients of your personal data

  • We share your personal data with the following trusted third parties:Group companies - The Vhi Group consists of a number of separate companies. We will share your data with the company that provides your health insurance as part of making a claim on your behalf. Some companies in our group provide services on an intra-group basis, which may involve the sharing of your personal data between one or more group companies.

  • Medical service providers - We may share personal data in relation to you with third parties that provide medical related services to us (e.g. labs that provide blood tests; radiology and diagnostic services; physiotherapy; orthopaedic services; podiatry services; dental; sports medicine; maxillofacial services and paediatric services), or if we refer you to another service provider outside of the services provided through the Vhi SwiftCare clinics(such as a consultant, hospital or a general practitioner).

  • Your GP - We will automatically send your GP a copy of your visit details for continuity of care purposes unless you are over 16 years of age and specifically request otherwise to our front desk staff. For children aged under 16 years of age, in line with the principles of Children First, the guidelines for the protection and welfare of children, a copy of a child's visit details will always be forwarded to their GP.

  • Service providers - We rely on trusted third parties to help us run the Vhi business and to provide us with specialised services. This can include companies that provide IT services, from scanning letters that we receive and loading them onto our systems, providing dictation and case management systems to hosting data on our behalf when providing software services. We also engage with companies that provide us with non-IT related services, such as legal advisors, accountants and consultants. Where our service providers have access to your personal data we ensure that they are subject to appropriate contracts and other safeguards.

  • Regulators/Public Authorities - In certain circumstances Vhi is obliged to provide information to a regulator or public authorities, such as in relation to public health warnings for a notifiable disease (e.g. measles but not HIV/AIDS).

  • Clinical audit programmes -Vhi SwiftCare have a robust clinical governance framework in place and as part of professional development obligations and medical research purposes will carry out regular clinical audit. Vhi SwiftCare's audit programme is carried out on aggregate and anonymised patient data that may be published or shared with other health professionals. Where it is intended that your data will be aggregated and anonymised to be shared externally or published this will be subject to your explicit consent.

Transfers outside of the EU

There are certain circumstances where we will transfer your personal data outside of the European Union to a country which is not recognised by the European Commission as providing an equivalent level of protection for personal data as is provided for in the European Union. If we transfer your personal data outside of the European Union please rest assured that we will ensure that appropriate measures are in place to protect your personal data and to comply with our obligations under applicable data protection law. This may mean that we enter into contracts in the form approved by the European Commission, or we ensure that the company to which we transfer your personal data has agreed to abide by an approved transfer mechanism, such as the EU-US Privacy Shield framework. If you would like further details about the measures we have taken in relation to the transfer of your personal data, or copies of the agreements that we have put in place in relation to the transfers, please contact us using the details at the bottom of this notice.

Retention of personal data

Vhi SwiftCare will retain your personal data in accordance with our record retention policy. The record retention policy operates on the principle that we keep personal data for no longer than is necessary for the purpose for which we collected it, and in accordance with any requirements that are imposed on us by law. This means that the retention period for your personal data will vary depending on the type of personal data.

For further information about the criteria that we apply to determine retention periods please see below:

  • Medical Data - Due to the nature of Vhi SwiftCare patients availing of urgent care, appointments and return treatments, in order to ensure continuity of care and protect your medical record, your medical information will be retained in Vhi SwiftCare in accordance with best medical practice and clinical governance as approved by our Medical Director.

  • Statutory and regulatory obligations - As we work in a highly regulated industry, we have certain statutory and regulatory obligations to retain personal data for set periods of time.

  • Managing legal claims - When we assess how long we keep personal data we take into account whether that data may be required in order to defend any legal claims which may be made.

  • If such data is required, we may keep it until the statute of limitations runs out in relation to the type of claim that can be made (which varies from 2 to 12 years).

  • Business requirements - As we only collect personal data for defined purposes, we assess how long we need to keep personal data for in order to meet our reasonable business purposes.

Your rights

You have various rights under data protection law, subject to certain exemptions, in connection with our processing of your personal data:

  • Right to access the data - You have the right to request a copy of the personal data that we hold about you, together with other information about our processing of that personal data.

  • Right to rectification - You have the right to request that any inaccurate data that is held about you is corrected, or if we have incomplete information you may request that we update the information such that it is complete.

  • Right to erasure - You have the right to request us to delete personal data that we hold about you. This is sometimes referred to as the right to be forgotten.

  • Right to restriction of processing or to object to processing - You have the right to request that we no longer process your personal data for particular purposes, or to object to our processing of your personal data for particular purposes.

  • Right to data portability - You have the right to request us to provide you, or a third party, with a copy of your personal data in a structured, commonly used machine readable format.

In order to exercise any of the above rights, please contact us using the contact details set out below.

Questions and Complaints

If you have any queries or complaints in connection with our processing of your personal data, you can get in touch with us using the following contact details:

You also have the right to lodge a complaint with the Data Protection Commission if you are unhappy with our processing of your personal data. Details of how to lodge a complaint can be found on the dataprotection.ie website, or you can call the Data Protection Commission on 1890 252 231.
Medical Screening Services

What is the purpose of this notice?

Our promise to you is that 'when you need us, we're there'. In order to fulfil that promise, and to provide you with our products and services, we need to get to know you and what your needs are. This means that we collect certain information about you in the course of operating our business. This notice sets out details of the information that we collect, how we process it, to whom we disclose it, and your rights under data protection law in relation to our processing of your data.

Who controls the use of your personal data?

Vhi Health Services DAC, whose registered address is Waverley Business Park, Old Naas Road, Dublin 12, is the company that provides all of the Vhi Health Services available to you. Vhi Health Services DAC controls and is responsible for personal data that is collected in relation to our medical screening services. If you have any queries in relation to the processing of your personal data, we have appointed a data protection officer that you can contact at dataprotection@vhi.ie.

What personal data is collected?

In order to provide our services to you we need to process certain personal data in relation to you, which includes:

  • Biographical data - We collect the following biographical data: name, address, email address, phone numbers, date of birth, gender, employer, next of kin details, general practitioner name and address.

  • Health data - We collect personal data from you in connection with the particular health screening service that we are providing to you. This information is collected directly from you via questionnaires that you fill in, or during your screening. It will also include health related data that we derive from the screening tests that are undertaken (e.g. heart rate, blood pressure, blood tests, hearing tests etc.).

  • Payment data - If you pay by credit or debit card for your screening service we will process your credit or debit card details in order to take payment from you. If you pay by cheque, we will process the details listed on the cheque in order to process payment.

  • Vhi membership - If the screening service is being provided under your Vhi Healthcare plan, we will process details about your Vhi membership in order to ensure you are entitled to avail of the particular services that we are offering. We may also process your personal data in order to support a claim that you may make under your Vhi Healthcare plan in connection with the service.

  • Interactions with Vhi Healthcare customer services - If you interact with the Vhi customer services department we will record details of those interactions (e.g. records of phone calls, email correspondence and hard copy correspondence). If you make a complaint we will process details in relation to that complaint.

Where does Vhi collect personal data from?

The personal data that we collect about you will primarily be gathered from you as part of the services that we offer.

Why do you process my personal data?

We process your personal data in order to provide you with our services and to assist us in the operation of our business. Under data protection law we are required to ensure that there is an appropriate basis for the processing of your personal data, and we are required to let you know what that basis is. There are various options under data protection law, but the primary bases that we use are (i) processing necessary to provide medical diagnosis, health care or treatments, or to manage the provision of health care services, (ii) processing necessary for the performance of our contracts with you, (iii) processing necessary in order for us to pursue our legitimate interests, (iv) processing where we have your consent, and (v) processing that is required under applicable law. We set out further details of our processing of your personal data below, together with the basis for that processing:

  • Providing you with services - When we process your personal data in connection with providing you with a screening service, this will either be on the basis that we have entered into a contract with you to provide you with the relevant service, or if your employer has arranged for the screening service on your behalf it will be on the basis of our legitimate interest in making the screening service available. Your health data that is processed in connection with the services is processed because it is necessary to process such health data in order to provide you with the relevant service.

  • Processing claims - If the screening service is covered by your Vhi Healthcare plan, and you would like to claim for the cost of the service under that plan, we can make a claim for payment from the Vhi company that provides the Vhi Healthcare plan on your behalf. In order to make the claim, we will need to provide information in connection with the particular screening service that you have availed of. We may also need to process your personal data in order to deal with queries about your level of cover. Where we process health related data for these purposes this will be subject to your agreement to sign the claim form, but please note that if you do not provide your agreement we will not be able to claim for your screening on your behalf and you will be required to discharge the applicable fees for the screening services to us.

  • Running our business - We will process your personal data in connection with the general administration of our business, including the generation of reports that detail how the business is functioning. We also undertake clinical and non-clinical auditing and quality control to check that our processes are robust and are being followed. In addition we also need to process your data to meet certain regulatory and legislative obligations that apply to our business. We try to do all of the above by using aggregated or anonymous data where possible, so you won't be identifiable from the data, but some of this work involves processing your data without anonymising it. Where we process your health data in connection with these activities it will be on the basis that the processing is necessary in order to manage the provision of health care services. Where we process non-health data in connection with these activities this will be on the basis of our legitimate interest in operating our business.

  • Administering our computer systems - Vhi relies on state of the art technology and computer systems to run our business and process claims. We have an extensive team of developers and support engineers who are constantly testing our systems, running trials of new software, and providing support to our users. In order to do this, where possible we try to use test data or anonymised data, but on occasion we may have to access live data directly, or we will often make a copy of some of the data that sits in our live systems and run our tests on that to make sure everything is working before we roll out a change. These copies may include your personal data, including details in relation to consultations, treatments or other medical services that you have received. In general this processing of your personal data is justified by our legitimate interests in making sure our computer systems run properly and are safe and secure. If we process health data when running these tests or providing support services to our users, it is on the basis that the processing is necessary for the management of health services.


Providing company health reports - If your screening has been undertaken as part of an employee screening programme, we may share anonymised and aggregated data with your employer about the general state of the health of the company's employees. Your employer will not be able to identify you or any details about your health from any reports that we share with them. Our processing of your data to create these anonymised and aggregated reports is based on your consent. If you do not provide us with your consent for your data to be anonymised and aggregated for this purpose, we will not be in a position to provide you with these particular services.

  • Providing copies of screening results to your GP - Depending on the type of medical screening service received by you, sending a copy of results to your GP may be required. If sending a copy of results to your GP is a requirement of the service, this data will be shared because it is necessary to process such health data in order to provide you with the relevant service.

  • Legal Actions - If you require us to provide you or a third party with details of your treatment in connection with a personal injuries action against a third party, we will do so on the basis of your consent or where otherwise required by law.

Important information about when we ask for your consent to the processing of your personal data

In order to process personal data in relation to you, especially health data, we may need to get your consent in certain circumstances. When we process your personal data on the basis of your consent, you are free to withdraw that consent at any time. You can withdraw your consent by contacting us using the contact details at the bottom of this notice.

Information you are obliged to provide

We require certain information from you in order to be able to enter into a contract with you and to provide you with our services. Where this is the case we will indicate on relevant forms what personal data is required in order to enter into the contract with you. If you do not provide the information, we will not be able to provide you with our services.

Categories of recipients of your personal data

We share your personal data with the following third parties:

  • Group companies - Vhi consists of a number of separate companies. Some of these companies provide you with health and medical services. Some companies in our group also provide services on an intra-group basis, which may involve the sharing of your personal data between one or more group companies.

  • Medical service providers - We may share personal data in relation to you with third parties that provide medical related services to us (e.g. labs that provide blood tests).

  • Your GP - Depending on the type of screening service received by you, we may be required under best medical practice guidance to send your GP a copy of the results of your screening, and if serious issues are identified we may contact your GP or consultant directly in relation to the results.

  • Service providers - We rely on trusted third parties to help us run the Vhi business and to provide us with specialised services. This can include companies that provide IT services, from scanning letters that we receive and loading them onto our systems to hosting data on our behalf when providing software services. We also engage with companies that provide us with non-IT related services, such as payment service providers, legal advisors,accountants and consultants. Where our service providers have access to your personal data we ensure that they are subject to appropriate contracts and other safeguards.

Transfers outside of the EU

There are certain circumstances where we will transfer your personal data outside of the European Union to a country which is not recognised by the European Commission as providing an equivalent level of protection for personal data as is provided for in the European Union. If we transfer your personal data outside of the European Union please rest assured that we will ensure that appropriate measures are in place to protect your personal data and to comply with our obligations under applicable data protection law. This may mean that we enter into contracts in the form approved by the European Commission, or we ensure that the company to which we transfer your personal data has agreed to abide by an approved transfer mechanism, such as the EU-US Privacy Shield framework. If you would like further details about the measures we have taken in relation to the transfer of your personal data, or copies of the agreements that we have put in place in relation to the transfers, please contact us using the details at the bottom of this notice.

Retention of personal data

Vhi will retain your personal data in accordance with our record retention policy. The record retention policy operates on the principle that we keep personal data for no longer than is necessary for the purpose for which we collected it, and in accordance with any requirements that are imposed on us by law. This means that the retention period for your personal data will vary depending on the type of personal data. For further information about the criteria that we apply to determine retention periods please see below:

  • Statutory and regulatory obligations - As we work in a highly regulated industry, we have certain statutory and regulatory obligations to retain personal data for set periods of time.

  • Managing legal claims - When we assess how long we keep personal data we take into account whether that data may be required in order to defend any legal claims which may be made. If such data is required, we may keep it until the statute of limitations runs out in relation to the type of claim that can be made (which varies from 2 to 12 years).

  • Business requirements - As we only collect personal data for defined purposes, we assess how long we need to keep personal data for in order to meet our reasonable business purposes.

Your rights

You have various rights under data protection law, subject to certain exemptions, in connection with our processing of your personal data:

  • Right to access the data - You have the right to request a copy of the personal data that we hold about you, together with other information about our processing of that personal data.

  • Right to rectification - You have the right to request that any inaccurate data that is held about you is corrected, or if we have incomplete information you may request that we update the information such that it is complete.

  • Right to erasure - You have the right to request us to delete personal data that we hold about you. This is sometimes referred to as the right to be forgotten.

  • Right to restriction of processing or to object to processing - You have the right to request that we no longer process your personal data for particular purposes, or to object to our processing of your personal data for particular purposes.

  • Right to data portability - You have the right to request us to provide you, or a third party, with a copy of your personal data in a structured, commonly used machine readable format.In order to exercise any of the above rights, please contact us using the contact details set out below.

Questions and Complaints

If you have any queries or complaints in connection with our processing of your personal data, you can get in touch with us using the following contact details:

You also have the right to lodge a complaint with the Data Protection Commission if you are unhappy with our processing of your personal data. Details of how to lodge a complaint can be found on the dataprotection.ie website, or you can call the Data Protection Commission on 1890 252 231.
Hospital@Home

What is the purpose of this notice?

Our promise to you is that 'when you need us, we're there'. In order to fulfil that promise, and to provide you with our products and services, we need to get to know you and what your needs are. This means that we collect certain information about you in the course of operating our business. This notice sets out details of the information that we collect, how we process it, to whom we disclose it, and your rights under data protection law in relation to our processing of your data.

Who controls the use of your personal data?

Vhi Health Services DAC, whose registered address is Waverley Business Park, Old Naas Road, Dublin 12, is the company that provides all of the Vhi Health Services available to you under your policy. Vhi Health Services DAC controls and is responsible for personal data that is collected in relation to our Hospital@Home services. If you have any queries in relation to the processing of your personal data, we have appointed a data protection officer that you can contact at dataprotection@vhi.ie.

What personal data is collected?

In order to provide our services to you we need to process certain personal data in relation to you, which includes:

  • Biographical data - We collect the following biographical data: name, assumed names, address, phone number, title, email address, gender, family relationships (e.g. spouse, children), date of birth, religion, profession etc.

  • Health data - We collect personal data from you in connection with the particular health service that we are providing to you, this will include details of your medical history and details of the treatments or services that we provide to you.

  • Vhi membership - We will process details about your Vhi membership in order to ensure you are entitled to avail of the particular services that we are offering. We may also process your personal data in order to support the claim that you make under your Vhi Healthcare plan in connection with the service.

  • Interactions with Hospital@Home team - If you interact with our Hospital@Home team, we may record details of those interactions (e.g. logs and details of phone calls, email correspondence and hard copy correspondence). If you make a complaint we will process details in relation to that complaint.

Where does Vhi collect personal data from?

Most of the personal data that we collect about you will be gathered from you as part of the services that we offer. However, certain information may be provided by third parties on your behalf, including the following:

  • Group members- The Hospital@Home service is covered by your Vhi Healthcare plan and we will receive verification of your health insurance cover from Vhi Healthcare.

  • Medical service providers - We will request a copy of your medical files from third party service providers, such as your GP or other primary care givers.

Why do you process my personal data?

We process your personal data in order to provide you with our services and to assist us in the operation of our business. Under data protection law we are required to ensure that there is an appropriate basis for the processing of your personal data, and we are required to let you know what that basis is. There are various options under data protection law, but the primary bases that we use are (i) processing necessary to provide medical diagnosis, health care or treatments, or to manage the provision of health care services, (ii) processing necessary for the performance of our contracts with you, (iii) processing necessary in order for us to pursue our legitimate interests, (iv) processing where we have your consent, and (v) processing that is required under applicable law. We set out further details of our processing of your personal data below, together with the basis for that processing:

  • Providing you with services - When we process your personal data in connection with providing you with the Hospital@Home service, this will be on the basis that we have entered into a contract with you to provide you with the relevant service. Your health data, and information in relation to your religious beliefs, that is processed in connection with the services is processed because it is necessary to process such health data in order to provide you with the relevant service.

  • Processing claims -The Hospital@Home service is covered by your Vhi Healthcare plan. There is no payment required directly by you, and we will make a claim for payment for the services provided to you from the Vhi company that provides the Vhi Healthcare plan. In order to make the claim we will need to provide information in connection with the underlying medical condition that is treated, your medical history and the medical services that you receive. We may also need to process your personal data in order to deal with queries about your level of cover and pre-certification/approval of treatment. Where we process health related data for these purposes this will be subject to your agreement to sign the claim form, but please note that if you do not provide your agreement we will not be able to make the claim on your behalf and therefore we will be unable to provide the service.

  • Running our business - We will process your personal data in connection with the general administration of our business, including the generation of reports that detail how the business is functioning. We also undertake clinical and non-clinical auditing and quality control to check that our processes are robust and are being followed. In addition we also need to process your data to meet certain regulatory and legislative obligations that apply to our business. We try to do all of the above by using aggregated or anonymous data where possible, so you won't be identifiable from the data, but some of this work involves processing your data without anonymising it. Where we process your health data in connection with these activities it will be on the basis that the processing is necessary in order to manage the provision of health care services. Where we process non-health data in connection with these activities this will be on the basis of our legitimate interest in operating our business.

  • Administering our computer systems - Vhi relies on state of the art technology and computer systems to run our business and process claims. We have an extensive team of developers and support engineers who are constantly testing our systems, running trials of new software, and providing support to our users. In order to do this, where possible we try to use test data or anonymised data, but on occasion we may have to access live data directly, or we will often make a copy of some of the data that sits in our live systems and run our tests on that to make sure everything is working before we roll out a change. These copies may include your personal data, including details in relation to consultations, treatments or other medical services that you have received. In general this processing of your personal data is justified by our legitimate interests in making sure our computer systems run properly and are safe and secure. If we process health data when running these tests or providing support services to our users, it is on the basis that the processing is necessary for the management of health services.

  • Legal Actions - If you require us to provide you or a third party with details of your treatment in connection with a personal injuries action against a third party, we will do so on the basis of your consent or where otherwise required by law.

Important information about when we ask for your consent to the processing of your personal data

In order to process personal data in relation to you, especially health data, we may need to get your consent in certain circumstances. When we process your personal data on the basis of your consent, you are free to withdraw that consent at any time. You can withdraw your consent by contacting us using the contact details at the bottom of this notice. Please note that if you withdraw your consent we may not be able to continue providing you with our services.

Information you are obliged to provide

We require certain information from you in order to be able to enter into a contract with you and to provide you with our services. Where this is the case we will indicate on relevant forms what personal data is required in order to enter into the contract with you. If you do not provide the information, we will not be able to provide you with our services.

Categories of recipients of your personal data

We share your personal data with the following third parties:

  • Group companies - Vhi consists of a number of separate companies. Some of these companies also provide you with health and medical services. We will also share your data with the company that provides your health insurance as part of making a claim on your behalf and if a pre-certification or approval is required for your treatment. Some companies in our group also provide services on an intra-group basis, which may involve the sharing of your personal data between one or more group companies.

  • Medical service providers - We will share personal data in relation to you with third parties that provide medical related services to us (e.g. labs that provide blood tests, pharmacies that provide the required medications or outsourced service providers who assist us in providing particular services), or if we refer you to another service provider (such as a consultant, a general practitioner or public health nurse).

  • Discharge - When you are discharged from the Hospital@Home service we will provide details of your care to the consultant or general practitioner who is responsible for your continued care.

  • Service providers - We rely on trusted third parties to help us run the Vhi business and to provide us with specialised services. This can include companies that provide IT services, from scanning letters that we receive and loading them onto our systems to hosting data on our behalf when providing software services. We also engage with companies that provide us with non-IT related services, such as legal advisors, accountants and consultants. Where our service providers have access to your personal data we ensure that they are subject to appropriate contracts and other safeguards.

  • Regulators - In certain circumstances Vhi is obliged to provide information to a regulator, such as in relation to the investigation of complaints.

Retention of personal data

Vhi will retain your personal data in accordance with our record retention policy. The record retention policy operates on the principle that we keep personal data for no longer than is necessary for the purpose for which we collected it, and in accordance with any requirements that are imposed on us by law. This means that the retention period for your personal data will vary depending on the type of personal data. For further information about the criteria that we apply to determine retention periods please see below:

  • Statutory and regulatory obligations - As we work in a highly regulated industry, we have certain statutory and regulatory obligations to retain personal data for set periods of time.

  • Managing legal claims - When we assess how long we keep personal data we take into account whether that data may be required in order to defend any legal claims which may be made. If such data is required, we may keep it until the statute of limitations runs out in relation to the type of claim that can be made (which varies from 2 to 12 years).

  • Business requirements - As we only collect personal data for defined purposes, we assess how long we need to keep personal data for in order to meet our reasonable business purposes.

Your rights

You have various rights under data protection law, subject to certain exemptions, in connection with our processing of your personal data:

  • Right to access the data - You have the right to request a copy of the personal data that we hold about you, together with other information about our processing of that personal data.

  • Right to rectification - You have the right to request that any inaccurate data that is held about you is corrected, or if we have incomplete information you may request that we update the information such that it is complete.

  • Right to erasure - You have the right to request us to delete personal data that we hold about you. This is sometimes referred to as the right to be forgotten.

  • Right to restriction of processing or to object to processing - You have the right to request that we no longer process your personal data for particular purposes, or to object to our processing of your personal data for particular purposes.

  • Right to data portability - You have the right to request us to provide you, or a third party, with a copy of your personal data in a structured, commonly used machine readable format.In order to exercise any of the above rights, please contact us using the contact details set out below.

Questions and Complaints

If you have any queries or complaints in connection with our processing of your personal data, you can get in touch with us using the following contact details:

You also have the right to lodge a complaint with the Data Protection Commission if you are unhappy with our processing of your personal data. Details of how to lodge a complaint can be found on the dataprotection.ie website, or you can call the Data Protection Commission on 1890 252 231.
Midwife Support at Home

What is the purpose of this notice?

Our promise to you is that 'when you need us, we're there'. In order to fulfil that promise, and to provide you with our products and services, we need to get to know you and what your needs are. This means that we collect certain information about you in the course of operating our business. This notice sets out details of the information that we collect, how we process it, to whom we disclose it, and your rights under data protection law in relation to our processing of your data.

Who controls the use of your personal data?

Vhi Health Services DAC, whose registered address is Waverley Business Park, Old Naas Road, Dublin 12, is the company that provides all of the Vhi Health Services available to you under your policy. Vhi Health Services DAC controls and is responsible for personal data that is collected in relation to our Midwife Support at Home service. If you have any queries in relation to the processing of your personal data, we have appointed a data protection officer that you can contact at dataprotection@vhi.ie.

What personal data is collected?

In order to provide our services to you we need to process certain personal data in relation to you, which includes:

  • Biographical data - We collect the following biographical data: name, assumed names, address, phone number, title, email address, gender, family relationships (e.g. spouse, children), date of birth, religion, profession etc.

  • Health data - We collect personal data from you in connection with the particular health service that we are providing to you, this will include details of your medical history and details of the treatments or services that we provide to you.

  • Vhi membership - We will process details about your Vhi membership in order to ensure you are entitled to avail of the particular services that we are offering. We may also process your personal data in order to support the claim that you make under your Vhi Healthcare plan in connection with the service.

  • Interactions with Midwife Support at Home team - If you interact with our Midwife Support at Home team, we may record details of those interactions (e.g. logs and details of phone calls, email correspondence and hard copy correspondence). If you make a complaint we will process details in relation to that complaint.

Where does Vhi collect personal data from?

Most of the personal data that we collect about you will be gathered from you as part of the services that we offer. However, certain information may be provided by third parties on your behalf, including the following:

  • Group members - The Midwife Support at Home service is covered by your Vhi Healthcare plan and we will receive verification of your health insurance cover from Vhi Healthcare.

  • One to One Midwife Service - If you have been connected with our Midwife Support at Home service through the Vhi One to One Midwife service, we may receive data from them in order to assist us in providing you with the appropriate service.

  • Medical service providers - We will request a copy of your medical files from third party service providers, such as your GP or other primary care givers.

Why do you process my personal data?

We process your personal data in order to provide you with our services and to assist us in the operation of our business. Under data protection law we are required to ensure that there is an appropriate basis for the processing of your personal data, and we are required to let you know what that basis is. There are various options under data protection law, but the primary bases that we use are (i) processing necessary to provide medical diagnosis, health care or treatments, or to manage the provision of health care services, (ii) processing necessary for the performance of our contracts with you, (iii) processing necessary in order for us to pursue our legitimate interests, (iv) processing where we have your consent, and (v) processing that is required under applicable law. We set out further details of our processing of your personal data below, together with the basis for that processing:

  • Providing you with services - When we process your personal data in connection with providing you with the Midwife Support at Home service, this will be on the basis that we have entered into a contract with you to provide you with the relevant service. Your health data, and information in relation to your religious beliefs, that is processed in connection with the services is processed because it is necessary to process such health data in order to provide you with the relevant service.

  • Processing claims -The Midwife Support at Home service is covered by your Vhi Healthcare plan. There is no payment required directly by you, and we will make a claim for payment for the services provided to you from the Vhi company that provides the Vhi Healthcare plan. In order to make the claim we will need to provide information in connection with the underlying medical condition that is treated, your medical history and the medical services that you receive. We may also need to process your personal data in order to deal with queries about your level of cover and pre-certification/approval of treatment. Where we process health related data for these purposes this will be subject to your agreement to sign the claim form, but please note that if you do not provide your agreement we will not be able to make the claim on your behalf and therefore we will be unable to provide the service.

  • Running our business - We will process your personal data in connection with the general administration of our business, including the generation of reports that detail how the business is functioning. We also undertake clinical and non-clinical auditing and quality control to check that our processes are robust and are being followed. In addition we also need to process your data to meet certain regulatory and legislative obligations that apply to our business. We try to do all of the above by using aggregated or anonymous data where possible, so you won't be identifiable from the data, but some of this work involves processing your data without anonymising it. Where we process your health data in connection with these activities it will be on the basis that the processing is necessary in order to manage the provision of health care services. Where we process non-health data in connection with these activities this will be on the basis of our legitimate interest in operating our business.

  • Administering our computer systems - Vhi relies on state of the art technology and computer systems to run our business and process claims. We have an extensive team of developers and support engineers who are constantly testing our systems, running trials of new software, and providing support to our users. In order to do this, where possible we try to use test data or anonymised data, but on occasion we may have to access live data directly, orwe will often make a copy of some of the data that sits in our live systems and run our tests on that to make sure everything is working before we roll out a change. These copies may include your personal data, including details in relation to consultations, treatments or other medical services that you have received. In general this processing of your personal data is justified by our legitimate interests in making sure our computer systems run properly and are safe and secure. If we process health data when running these tests or providing support services to our users, it is on the basis that the processing is necessary for the management of health services.

  • Legal Actions - If you require us to provide you or a third party with details of your treatment in connection with a personal injuries action against a third party, we will do so on the basis of your consent or where otherwise required by law.

Important information about when we ask for your consent to the processing of your personal data

In order to process personal data in relation to you, especially health data, we may need to get your consent in certain circumstances. When we process your personal data on the basis of your consent, you are free to withdraw that consent at any time. You can withdraw your consent by contacting us using the contact details at the bottom of this notice. Please note that if you withdraw your consent we may not be able to continue providing you with our services.

Information you are obliged to provide

We require certain information from you in order to be able to enter into a contract with you and to provide you with our services. Where this is the case we will indicate on relevant forms what personal data is required in order to enter into the contract with you. If you do not provide the information, we will not be able to provide you with our services.

Categories of recipients of your personal data

We share your personal data with the following third parties:

  • Group companies - Vhi consists of a number of separate companies. Some of these companies also provide you with health and medical services. We will also share your data with the company that provides your health insurance as part of making a claim on your behalf and if a pre-certification or approval is required for your treatment. Some companies in our group also provide services on an intra-group basis, which may involve the sharing of your personal data between one or more group companies.

  • One to One Midwife Service - If you have been connected with our Midwife Support at Home service through the Vhi One to One Midwife service, we may share data with them in order to in order to assist us in providing you with the appropriate service.

  • Medical service providers - We will share personal data in relation to you with third parties that provide medical related services to us (e.g. labs that provide blood tests, pharmacies that provide the required medications or outsourced service providers who assist us in providing particular services, like Vhi's One to One Midwife service), or if we refer you to another service provider (such as a consultant, a general practitioner or public health nurse).

  • Discharge - When you are discharged from the Midwife Support at Home service we will provide details of your care to the One to One Midwife service and your general practitioner who is responsible for your continued care.

  • Service providers - We rely on trusted third parties to help us run the Vhi business and to provide us with specialised services. This can include companies that provide IT services,from scanning letters that we receive and loading them onto our systems to hosting data on our behalf when providing software services. We also engage with companies that provide us with non-IT related services, such as legal advisors, accountants and consultants. Where our service providers have access to your personal data we ensure that they are subject to appropriate contracts and other safeguards.

  • Regulators - In certain circumstances Vhi is obliged to provide information to a regulator, such as in relation to the investigation of complaints.

Retention of personal data

Vhi will retain your personal data in accordance with our record retention policy. The record retention policy operates on the principle that we keep personal data for no longer than is necessary for the purpose for which we collected it, and in accordance with any requirements that are imposed on us by law. This means that the retention period for your personal data will vary depending on the type of personal data. For further information about the criteria that we apply to determine retention periods please see below:

  • Statutory and regulatory obligations - As we work in a highly regulated industry, we have certain statutory and regulatory obligations to retain personal data for set periods of time.

  • Managing legal claims - When we assess how long we keep personal data we take into account whether that data may be required in order to defend any legal claims which may be made. If such data is required, we may keep it until the statute of limitations runs out in relation to the type of claim that can be made (which varies from 2 to 12 years).

  • Business requirements - As we only collect personal data for defined purposes, we assess how long we need to keep personal data for in order to meet our reasonable business purposes.

Your rights

You have various rights under data protection law, subject to certain exemptions, in connection with our processing of your personal data:

  • Right to access the data - You have the right to request a copy of the personal data that we hold about you, together with other information about our processing of that personal data.

  • Right to rectification - You have the right to request that any inaccurate data that is held about you is corrected, or if we have incomplete information you may request that we update the information such that it is complete.

  • Right to erasure - You have the right to request us to delete personal data that we hold about you. This is sometimes referred to as the right to be forgotten.

  • Right to restriction of processing or to object to processing - You have the right to request that we no longer process your personal data for particular purposes, or to object to our processing of your personal data for particular purposes.

  • Right to data portability - You have the right to request us to provide you, or a third party, with a copy of your personal data in a structured, commonly used machine readable format.

In order to exercise any of the above rights, please contact us using the contact details set out below.

Questions and Complaints

If you have any queries or complaints in connection with our processing of your personal data, you can get in touch with us using the following contact details:

You also have the right to lodge a complaint with the Data Protection Commission if you are unhappy with our processing of your personal data. Details of how to lodge a complaint can be found on the dataprotection.ie website, or you can call the Data Protection Commission on 1890 252 231.
Occupational Health Services

What is the purpose of this notice?

Our promise to you is that 'when you need us, we're there'. In order to fulfil that promise, and to provide you with our products and services, we need to get to know you and what your needs are. This means that we collect certain information about you in the course of operating our business. This notice sets out details of the information that we collect, how we process it, to whom we disclose it, and your rights under data protection law in relation to our processing of your data.

Who controls the use of your personal data?

Vhi Health Services DAC, whose registered address is Waverley Business Park, Old Naas Road, Dublin 12, is the company that provides all of the Vhi Health Services available to you. Vhi Health Services DAC controls and is responsible for personal data that is collected in relation to our occupational health services. If you have any queries in relation to the processing of your personal data, we have appointed a data protection officer that you can contact at dataprotection@vhi.ie.


We engage the professional services of a network of physicians, physiotherapists, alternative therapists, online pre employment provider, CBT Therapists, St Patrick Mental Health Services for the provision of certain Occupational Health and Rehabilitation Back to Work services. They control and are responsible for the personal data processed during the provision of those services. You will be provided with a separate data protection notice by these partners when you first interact with them.

What personal data is collected?

In order to provide our services to you we need to process certain personal data in relation to you, which includes:

  • Biographical data - We collect the following biographical data: name, address, phone number, gender, nationality, date of birth, job title/description, employer.

  • Health data - We collect personal data from you in connection with the particular occupational health service that we are providing to you. This information is collected directly from you via questionnaires that you fill in (or which is separately volunteered by you during the provision of the services), during meetings with health services providers, and from other medical services providers where you give your permission for them to share your data (e.g. your GP). It will also include health related data that we derive from any tests that are undertaken (e.g. heart rate, blood pressure, blood tests, hearing tests etc.).

  • Employment details - We will collect details in relation to your employment. This will include details of absences that result in a referral to the occupational health service. We may also collect details about the particular demands of your job, and any accommodations that are required in order to facilitate you undertaking your job safely.

  • Interactions with us - If you interact with us we will record details of those interactions (e.g. details and logs of phone calls, email correspondence, onsite visits and hard copy correspondence). If you make a complaint we will process details in relation to that complaint.

Where does Vhi collect personal data from?

Most of the personal data that we collect about you will be gathered from you as part of the services that we offer. However, certain information may be provided by third parties on your behalf, including the following:

  • Your employer - If you are referred to the occupational health service your employer will provide us with certain details, such as your name, job title and the reason that you are being referred to the occupational health service. This may therefore include some limited health data.

  • Medical service providers - With your permission, we may request a copy of your medical files from third party service providers, such as your GP or other primary care givers.

Why do you process my personal data?

We process your personal data in order to provide you with our services and to assist us in the operation of our business. Under data protection law we are required to ensure that there is an appropriate basis for the processing of your personal data, and we are required to let you know what that basis is. There are various options under data protection law, but the primary bases that we use are (i) processing necessary to assess the working capacity of an employee, provide medical diagnosis, health care or treatments, or to manage the provision of health care services, (ii) processing necessary for the performance of our contracts with you, (iii) processing necessary in order for us to pursue our legitimate interests, (iv) processing where we have your consent, and (v) processing that is required under applicable law. We set out further details of our processing of your personal data below, together with the basis for that processing:

  • Occupational health services - When we process your personal data in connection with providing you with occupational health services, this will be on the basis of our legitimate interest in making the occupational health services available to you and your employer. Your health data that is processed in connection with the services is processed because it is necessary to process such health data in order to provide you with the relevant service, or because it is necessary to process that health data in order to assess your working capacity.

  • Running our business - We will process your personal data in connection with the general administration of our business, including the generation of reports that detail how the business is functioning. We also undertake clinical and non-clinical auditing and quality control to check that our processes are robust and are being followed. In addition we also need to process your data to meet certain regulatory and legislative obligations that apply to our business. We try to do all of the above by using aggregated or anonymous data where possible, so you won't be identifiable from the data, but some of this work involves processing your data without anonymising it. Where we process your health data in connection with these activities it will be on the basis that the processing is necessary in order to manage the provision of health care services.

  • Administering our computer systems - Vhi relies on state of the art technology and computer systems to run our business and process claims. We have an extensive team of developers and support engineers who are constantly testing our systems, running trials of new software, and providing support to our users. In order to do this, where possible we try to use test data or anonymised data, but on occasion we may have to access live data directly, or we will often make a copy of some of the data that sits in our live systems and run our tests on that to make sure everything is working before we roll out a change. These copies may include your personal data, including details in relation to consultations, treatments or other medical services that you have received. In general this processing of your personal data is justified by our legitimate interests in making sure our computer systems run properly and are safe and secure. If we process health data when running these tests or providing supportservices to our users, it is on the basis that the processing is necessary for the management of health services.

  • Providing company health reports - If the occupational health services that we provide include what are described by us as 'General Health Programmes', we will share anonymised and aggregated data in summary reports with your employer about the general state of the health of the company's employees. These General Health Programmes form part of a comprehensive risk prevention programme for workers, and they include general health questionnaires, physical assessments, VDU eyesight examinations, audiometry (hearing examination), spirometry (Lung function test), ECG (Electrocardiograph- cardiac function test), urinalysis (Kidney function tests) and blood tests.Your employer will not be able to identify you or any details about your health from any reports that we share with them. Our processing of your data to create these anonymised and aggregated reports is based on your consent. If you do not provide us with your consent for your data to be anonymised and aggregated for this purpose, we will not be in a position to provide you with these particular services.

  • Legal Actions - If you require us to provide you or a third party with details of your treatment in connection with a personal injuries action against a third party, we will do so on the basis of your consent or where otherwise required by law.

Important information about when we ask for your consent to the processing of your personal data

In order to process certain personal data in relation to you, especially health data, we need to get your consent. When we process your personal data on the basis of your consent, you are free to withdraw that consent at any time. You can withdraw your consent by contacting us using the contact details at the bottom of this notice. Please note that if you withdraw your consent we may not be able to continue providing you with our services.

Information you are obliged to provide

You are not obliged to provide us with any information in relation to your employment or your health. However, if you do not provide such information, we will not be able to provide you with our services. If you fail to engage with an occupational health services provider, this may have implications for your employment relationship with your employer or prospective employer. We therefore advise you to consult your employer or prospective employer if you decide not to engage with us in connection with our occupational health services.

Categories of recipients of your personal data

We share your personal data with the following third parties:

  • Your employer - Where you have been referred to us by your employer, we may share a report with your employer that summarises our findings (e.g. when you attended our service, whether you are fit to return to work, whether you require accommodations in order to facilitate your return to work etc.). We will always seek your consent to sharing your personal data with your employer, and will provide you with details of the information that will be provided to your employer so that you can understand what information will be shared. Please note however that if you do not provide us with your consent for your data to be shared for this purpose, this may have implications for your employment relationship with your employer or prospective employer. We therefore advise you to consult your employer or prospective employer if you decide not to engage with us in connection with our occupational health services.

  • Group companies - Vhi consists of a number of separate companies. Some companies in our group provide services on an intra-group basis, which may involve the sharing of your personal data between one or more group companies.

  • Medical service providers - We may share personal data in relation to you with third parties that provide medical related services to us (e.g. doctors that undertake assessments, and labs that provide blood tests), or if we refer you to another service provider (such as your general practitioner).

  • Service providers - We rely on trusted third parties to help us run the Vhi business and to provide us with specialised services. This can include companies that provide IT services, from scanning letters that we receive and loading them onto our systems to hosting data on our behalf when providing software services. We also engage with companies that provide us with non-IT related services, such as payment service providers, legal advisors, accountants and consultants. Where our service providers have access to your personal data we ensure that they are subject to appropriate contracts and other safeguards.

  • Regulators - In certain circumstances Vhi is obliged to provide information to a regulator, such as in relation to the investigation of complaints.

Transfers outside of the EU

There are certain circumstances where we will transfer your personal data outside of the European Union to a country which is not recognised by the European Commission as providing an equivalent level of protection for personal data as is provided for in the European Union. If we transfer your personal data outside of the European Union please rest assured that we will ensure that appropriate measures are in place to protect your personal data and to comply with our obligations under applicable data protection law. This may mean that we enter into contracts in the form approved by the European Commission, or we ensure that the company to which we transfer your personal data has agreed to abide by an approved transfer mechanism, such as the EU-US Privacy Shield framework. If you would like further details about the measures we have taken in relation to the transfer of your personal data, or copies of the agreements that we have put in place in relation to the transfers, please contact us using the details at the bottom of this notice.

Retention of personal data

Vhi will retain your personal data in accordance with our record retention policy. The record retention policy operates on the principle that we keep personal data for no longer than is necessary for the purpose for which we collected it, and in accordance with any requirements that are imposed on us by law. This means that the retention period for your personal data will vary depending on the type of personal data. For further information about the criteria that we apply to determine retention periods please see below:

  • Statutory and regulatory obligations - As we work in a highly regulated industry, we have certain statutory and regulatory obligations to retain personal data for set periods of time.

  • Managing legal claims - When we assess how long we keep personal data we take into account whether that data may be required in order to defend any legal claims which may be made. If such data is required, we may keep it until the statute of limitations runs out in relation to the type of claim that can be made (which varies from 2 to 12 years).

  • Business requirements - As we only collect personal data for defined purposes, we assess how long we need to keep personal data for in order to meet our reasonable business purposes.

Your rights

You have various rights under data protection law, subject to certain exemptions, in connection with our processing of your personal data:

  • Right to access the data - You have the right to request a copy of the personal data that we hold about you, together with other information about our processing of that personal data.

  • Right to rectification - You have the right to request that any inaccurate data that is held about you is corrected, or if we have incomplete information you may request that we update the information such that it is complete.

  • Right to erasure - You have the right to request us to delete personal data that we hold about you. This is sometimes referred to as the right to be forgotten.

  • Right to restriction of processing or to object to processing - You have the right to request that we no longer process your personal data for particular purposes, or to object to our processing of your personal data for particular purposes.

  • Right to data portability - You have the right to request us to provide you, or a third party, with a copy of your personal data in a structured, commonly used machine readable format.

In order to exercise any of the above rights, please contact us using the contact details set out below.

Questions and Complaints

If you have any queries or complaints in connection with our processing of your personal data, you can get in touch with us using the following contact details:

You also have the right to lodge a complaint with the Data Protection Commission if you are unhappy with our processing of your personal data. Details of how to lodge a complaint can be found on the dataprotection.ie website, or you can call the Data Protection Commission on 1890 252 231.
Additional Notice for Website and App Users
General statement
This statement relates to the privacy practices of Vhi in connection with Vhi.ie and the Vhi Mobile Health Assistant (the "Website and App"). It sets out the basis on which any personal data that we collect from you, or that you supply to us, in connection with the Website or App will be processed by us. For the purposes of this Data Protection Statement, "we", "our" and "us" refers to Vhi.

We are not responsible for the content or privacy practices of other websites or mobile applications. Any external links to other websites will be clearly identifiable as such.
Mobile App
In order to use the App you must first download it to your smart phone from the iOS App Store and Google Play Store and then either register for the App by providing your name, e-mail, policy number, and date of birth to Vhi at the registration point or alternatively if you have already registered for MyVhi via the Vhi website you may log in with your MyVhi details. We will process such information in order to provide you with access to the Mobile Health Assistant app.

The App will allow you to do the following:

Medical ID: record your general medical information like your allergies or blood type in this feature of the App*

My Policy: view the benefits and details of your plan

My Team: contact the Vhi services available to you

Snap & Send: submit your day to day medical expenses claim with Snap & Send.

* It is important to note that your general medical information (allergies, blood type etc.) in the Medical ID feature of the App will remain on your phone only and this data will never be used by Vhi.

Please note that your general medical information (allergies, medical conditions etc.) in the Medical ID feature of the App will remain on your phone and will never be used by Vhi unless you use the Online Doctor feature, in which case please see below for further information.

If you use the Online Doctor feature:

  • We will, with your consent, share your Medical ID data with our Online Doctor provider VideoDoc Ltd. This data can either be taken directly from the Medical ID section of the App (if you have already included it there) or you can include it for the first time when you use the Online Doctor feature.
  • You may edit the Medical ID data you choose to send to Videodoc, but once the data is sent it will form part of your consult history and it will be stored by Videodoc.
  • Once Medical ID information is sent to Videodoc, for consistency the Medical ID data stored elsewhere in the App will automatically update to reflect the data sent to Videodoc. You may however edit the information in the Medical ID section subsequently if you wish.
MyVhi
The MyVhi area of the Website allows you to administer healthcare related products and services that we provide you, including viewing claims statements in relation to those products. In order to use the MyVhi section of the Website you must provide us with certain personal details, including your name, email, address, date of birth and policy numbers. We will process such information in order to provide you with access to the MyVhi section of the Website.
Other Information you provide via the Website and App
When you provide us with information through the Contact Us page, Ask an Expert feature, Current Vacancies feature on the site or through the feedback feature in the app we will process that information solely for the purposes of responding to your query or processing your job application and feedback.
Cookies
If you visit our Website to browse, read or download we automatically collect and store information about your use of the Website through certain cookies that are set. Please refer to our Cookies Policy, which is available here for further information.
Mobile App Analytics
Vhi uses a mobile app analytics tool called Google Analytics for Firebase to track events and clicks to identify the user journey throughout the App. Please note if you opt out of mobile app analytics you will need to delete the App from your smart phone. You can find more information about Google Analytics for Firebase here https://firebase.google.com/policies/analytics/.
parkrun
In the event that you use the App to locate a parkrun accessible to your current location please note that the App sends your request to parkrun directly (without disclosing any personal data other than your location). The App will then provide you with a list of the five nearest parkruns. The App does not use any location data other than as is strictly necessary to provide you with the list of parkruns and does not use it for any other purpose.
Data Protection Statement Changes
We may update this Data Protection Statement from time to time. By continuing to use this Website and App after such an update you are indicating that you consent to the processing of personal data that you provide through the Website or App in accordance with the updated statement. We therefore recommend that you check for updates to the Data Protection Statement before providing such personal data.