Date last updated: 8 June 2020

About this policy

When you trust Vspry Australia Limited (ABN 41 631 026 330), Vspry Rewards Pty Limited (ABN 88 638 677 595), Vspry Money Pty Limited (ABN 88 638 831 857), Vspry Live Well Trust (ARSN 639 486 132) and Vspry International Limited (ABN 59 631 026 027) ("we", "us", "our" and "Vspry") with your personal information, we know that you expect us to protect it and keep it safe. This policy explains how we handle and manage your personal information. We may review and update this privacy policy from time to time. Revised versions of this privacy policy will be available on our website.

What is personal information?

Personal information includes any information or opinion about an identified individual or that can be used to reasonably identify an individual. Personal information does not include information that has been made anonymous, and cannot reasonably identify a specific person. The information that Vspry seeks to collect about you will depend on the products or services that we provide.

If you do not allow us to collect all of the information we request or we are unable to verify your personal information, we may not be able to deliver our services effectively or provide you with our products.

Our partners

Vspry’s merchants (which may include health and wellness practitioners and retailers) and commercial partners (together, ‘our Partners’) are independent of Vspry and Vspry is not responsible for their privacy practices. Please contact our Partners directly for further information on their privacy policies.

What kinds of personal information do we collect and hold?

When you apply for our products or services, we may ask for identification information. This could include your name, address, contact details, gender, marital status, date of birth, drivers licence, medicare number and passport details. We may also collect your tax file number if we are authorised to collect it and if you choose to supply it. In order to add funds to your digital wallet, we will need to obtain your bank account details in order to direct debit your bank account. Throughout the life of your product or service, we may collect and hold additional personal information about you. This could include transaction information or making a record of queries you make.

The collection of sensitive information is restricted by law. This includes information relating to about your religion, racial or ethnic origin, political opinions, criminal record, sexual orientation, health information and bio-metric information. Generally, we only collect sensitive information if it is necessary to provide you with a specific product or service and you have consented to that collection. For example, we may collect voice and facial bio-metric information to verify your identity or authorise transactions where you have consented for us to do so.

You may choose to provide us with access to certain personal information stored by third parties such as social media sites (e.g., Facebook and Instagram). The information we may receive varies by site and is controlled by that site and you should refer to their privacy policies and terms of use. By associating an account managed by a third party with your Vspry account and authorising Vspry to have access to this information, you agree that Vspry may collect, store and use this information in accordance with this Privacy Policy. We won’t ask you to supply personal information publicly over Facebook, Instagram, YouTube or any other social media platform that we use. Sometimes we may invite you to send your details to us via private messaging, for example, to answer a question about your account.

We may also collect your personal information if you enter a competition or promotion we run (either directly or through our marketing agents or our Partners), or if you apply for employment with us either directly or through a recruitment or employment agency.

We may collect personal information about our Partners’ staff directly from those staff or from our Partners. The information we collect about our Partners’ staff may include your name, position, contact details and training records.

We may also collect the personal information of our suppliers and service providers’ staff during the course of our business activities. This information may include your name, contact details and position. We will collect this information directly from you, or from the applicable supplier or service provider.

For what purposes do we collect, hold, use and disclose personal information?

We may use personal information we collect about you for a number of purposes including:

• to provide (or assess whether to provide) Vspry products and services to you including organising the provision of health insurance policies;
• to provide you with customer support;
• for processing transactions and send you notices about your transactions;
• to resolve concerns, and troubleshoot problems;
• in order to investigate and prevent potentially prohibited or illegal activities;
• to enforce our contracts and agreements with you;
• learning more about your level of satisfaction, your expectations of us and our Partners, and how we can exceed them;
• to customise, measure, and improve the content, layout, and operation of our websites;
• delivering targeted marketing, service update notices, and promotional offers based on your communication preferences;
• contacting you via telephone, text (SMS) or email messaging, including as authorised by our agreements and contracts with you;
• to compare information for accuracy and verify it with third parties;
• so we may confirm your identity for the purposes of anti-money laundering and counter-terrorism laws and assess applications and your suitability for Vspry products and services;
• to consider you for a position at Vspry for which you have applied;
• to acquire goods or services from you or from your employer;
• for the purpose of performing data analytics including to improve our and our Partners’ services;
• for other purposes to which you have consented; and
• as required or permitted by relevant laws and regulations, for example under Anti-Money Laundering and Counter-Terrorism Financing laws, regulations and rules.

How do we collect personal information?

Generally, we collect personal information directly from you. For example, we will collect your personal information when you apply for or use a product or service or talk to us in person or on the phone.

We also collect information from you via cookies, for example, when you visit our website or whenever you apply for or access Vspry products and services electronically. Cookies are small pieces of information stored on your hard drive or in memory. They can record information about your visit to the site, allowing it to remember you the next time you visit and provide a more meaningful experience. One of the reasons for using cookies is to offer you increased security. The cookies we send to your computer cannot read your hard drive, obtain any information from your browser or command your computer to perform any action. They are designed so that they cannot be sent to another site or be retrieved by any non-Vspry Group site. We generally will collect information relating to the date and times you visit our websites, page views and IP addresses. You have the option of disabling cookies through your browser preferences, however, if you disable cookies, some parts of our website may not function effectively, or at all, or may be considerably slower.

Sometimes we collect personal information about you from other people or organisations. This may happen without your direct involvement. For instance, we may collect personal information about you from:​

• other Vspry Group businesses;
• healthcare providers;
• publicly available sources of information, such as public registers;
• your representatives (including your legal adviser, financial adviser, executor, administrator, guardian, trustee, or attorney);
• your employer;
• other organisations, who jointly with us, provide products or services to you; and
• commercial information service providers, such as companies that provide fraud prevention reports and identity verification.

How do we hold personal information?

Much of the information we hold about you will be stored electronically in secure data centres owned by either the Vspry Group or external service providers. Some information we hold about you will be stored in paper files. We use a range of physical and electronic security measures to protect the security of the personal information we hold. For example:

• access to information systems is controlled through identity and access management;
• employees are bound by internal information security policies and are required to keep information secure;
• all employees are required to complete training about information security; and
• we regularly monitor and review our compliance with internal policies and industry best practice. We also take reasonable steps to destroy or permanently de-identify any personal information after it can no longer be used for the purposes for which it was collected.

Who do we disclose your personal information to, and why?

We may share your personal information with other companies within the Vspry Group. We may also provide personal information about our customers to organisations outside the Vspry Group. We generally disclose personal information to organisations that help us with our business, including:

• our agents, contractors and external service providers (for example, our technology service providers);
• healthcare providers;
• other Vspry Group businesses;
• payment systems participants (for example, merchants receiving payments);
• other organisations, who jointly with us, provide products or services to you;
• debt collectors;
• our financial advisers, legal advisers or auditors;
• your representatives (including your health practitioner, legal adviser, accountant, financial adviser, executor, administrator, guardian, trustee, or attorney);
• identity verification service providers;
• fraud bureaus or other organisations to identify, investigate or prevent fraud or other misconduct;
• external dispute resolution schemes; and
• regulatory bodies, government agencies and law enforcement bodies in any jurisdiction.

We may also disclose your personal information to others outside the Vspry Group where:

• we are required or authorised by law;
• you may have expressly consented to the disclosure or the consent may be reasonably inferred from the circumstances; or
• we are otherwise permitted to disclose the information under privacy regulations.

Do we disclose personal information overseas?

We may disclose your personal information to recipients located outside Australia. This includes for international transactions, such as currency exchanges, we may need to disclose your information to the corresponding international party in order to process the transaction. The countries we disclose your information to will depend on the details of the transaction you ask us to carry out and may include recipients located in the United States of America, New Zealand and India.

Do we use or disclose personal information for marketing?

We may use your personal information to offer you products and services we believe may interest you, but we will not do so if you tell us not to. These products and services may be offered by a member of the Vspry Group, or one of our preferred suppliers. We may offer you products and services by various means, including by mail, telephone, email, SMS or other electronic channels, such as through social media or targeted advertising through Vspry Group or non-Vspry Group websites. We may also disclose your personal information to companies outside the Vspry Group who assist us to market products and services to you. If you don’t want to receive marketing offers from us, please contact us or opt-out through any opt-out mechanism contained in such marketing communications.

Access to and correction of personal information.

You can request access to the personal information we hold about you. You can also ask for corrections to be made. To do so, please contact us. There is no fee for requesting that your personal information is corrected or for us to make corrections, however, in processing your request for access to your personal information, a reasonable cost may be charged. This charge covers such things as locating the information and supplying it to you (i.e. postage). There are some circumstances in which we are not required to give you access to your personal information. If we refuse to give you access to or to correct your personal information, we will give you a notice explaining our reasons except where it would be unreasonable to do so or prohibited by law. If we refuse your request to correct your personal information, you also have the right to request that a statement be associated with your personal information noting that you disagree with its accuracy. If we refuse your request to access or correct your personal information, we will also provide you with information on how you can complain about the refusal.

Resolving your privacy concerns - your rights.

If you have any questions or are concerned about how your personal information is being handled, please contact us by calling 1800 934 185 and ask to speak with our Compliance Officer, or by writing to our Compliance Officer at PO Box 311 Wynnum QLD 4178, or by sending an email to compliance@vspry.com.

We will acknowledge your request as soon as we can. We will let you know if we need any further information from you. We aim to resolve any queries or concerns as quickly as possible, and strive to do so within seven days, but some may take longer to resolve. If your query or concern is taking longer, we will let you know what is happening and a date by which you can reasonably expect a response (if we are permitted to do so). If you are unhappy with our response, you can request that your query or concern is referred to our Chief Executive Officer.

Vspry is a member of the Australian Financial Complaints Authority (AFCA) which is the sole external dispute resolution (EDR) scheme for financial disputes in Australia. Its purpose is to provide free, fair, independent and effective solutions for financial disputes, facilitated by professional and experienced staff, whom follow a clear complaint resolution process, working with both you and Vspry. If you are unhappy with Vspry's response to your concerns, you can lodge a complaint with AFCA by contacting them on 1800 931 678 (free call) or visiting their website, or by mail addressed to Australian Financial Complaints Authority Limited, GPO Box 3 Melbourne VIC 3001.

You can also approach the Office of the Australian Information Commissioner about the way we handle your personal information. The Commissioner can be contacted via post to GPO Box 5218 Sydney NSW 2001, or via telephone on 1300 363 992, or via their website.