Privacy Notice

Data Protection Notice

Vitality values its customers trust and recognises that the safety and lawful use of everyone’s personal data is key to retaining that trust and confidence. Vitality needs to collect, store, share and use personal data about past, current and prospective customers to enable it to meet its requirements in the provision of innovative products and services.

Vitality takes compliance with privacy laws and regulation very seriously. We take appropriate measures including training our staff about our data protection obligations to protect your personal data and your legal rights. We have implemented effective policies and procedures and security measures to ensure we protect your personal data.

Our contact details

Changes to this Privacy Notice

Who we are

How we use your information

What type of information do we collect?

Why we use your information

How we share your information

Marketing

International Transfers

How long we keep your information for

Your rights

How to complain about a Data Protection issue

Information Commissioners Office

Our contact details

If you have any questions about our Privacy Notice or the information we hold about you then please contact:

Name: The Group Head of Data Protection

Address: 70 Gracechurch Street, 4th Floor, London, EC3V 0HR

Email: Data.Protection@Vitality.co.uk

Changes to this Privacy Notice

We reserve the right to update this Privacy Notice from time to time. Such changes may be necessary, for example, due to changes or developments in data protection laws, privacy best practice or the introduction of new technologies. You should check our website periodically to view the most up-to-date Privacy Notice. This Privacy Notice was last updated on September 2021.

Who we are

Vitality is part of the Discovery Group of companies and is owned by Discovery Limited, a financial services firm based in South Africa. Vitality is based in the United Kingdom and to find out more about who the Vitality Group is, please see www.vitality.co.uk/legal for the most up to date information.

This Privacy Notice covers all of the businesses within the Vitality Group.

To help you we have set out the meaning of certain words and terms used in this section as well as for our products and services.

Please make anyone whose personal information you have provided to us aware of this Privacy Notice. You must make sure any information you supply about anyone else is accurate and that they’ve agreed to their information being supplied.

How we use your information

If you have a plan with us or you are considering getting a plan with us, we collect information about you and any joint plan owners when you get:

a quote for insurance, when you buy or renew a plan from us, when you amend or cancel your plan or when you make a claim under your plan;
an investment plan from us, when you buy or amend an investment plan from us, when you withdraw funds or cancel your plan.

If you are a beneficiary under the plan, we collect information about you when you make a claim under the plan.

If you are a witness to an event giving rise to a claim, we collect your information to help us handle the claim.

We only collect information that is relevant and necessary for us to provide the product and to handle claims made under a plan.

If you contact us by telephone, we may record calls for training and monitoring purposes to help improve our service and to detect and prevent fraud and to establish facts in the event of a complaint.

What type of information do we collect?

Personal information provided by you and anyone named on the plan, directly or via the company who sold you the plan:
- Contact details
- Date of birth
- Occupation
- Gender
Financial information provided by you, directly or via the company who sold you the plan:
- Payment details
- Transactions and payments made for your plan
- VitalityCar: Details of County Court Judgements CCJs) and bankruptcy.
Sensitive information provided by you, directly or via the company who sold you the plan:
- Health information including medical conditions and your doctor/hospital details
- Information about what you are insuring provided by you, directly or via the company who sold you the plan.
- Motoring criminal convictions and offences (VitalityCar)
- Health information including medical conditions and associated restrictions on your driving licence (VitalityCar).
VitalityCar:
• Homeowner Status
• Marital Status
• Driving Licence details
• Residency Status
• Driving behaviour
• Images and videos from dash camera footage
• Other information about you provided by the company who sold you the plan

• Information about your insurance history provided by you, directly or via the company who sold you the plan:
- Recent quotes for insurance
- Your insurance history
- Claims details

• Information relating to fraudulent or potentially fraudulent activity provided by fraud agencies and databases or collected from publicly available sources of information:
- History of fraud
- Indicators of fraudulent behaviour
- Investigations into fraud

• Your credit information provided by credit reference agencies:
- Your credit history and score
- Information on the electoral register

• In addition to the information above, we also collect information from third parties, to assist us in assessing your insurance risk. Some of this information is publically available such as census data. We also collect information regarding your vehicle from HPI Ltd.

Why we use your information

The information we collect may be used by us, our employees and third party insurers and/or service providers who are acting under our instruction, for the reasons detailed below. We must always have a lawful basis for processing your information.

When we process your sensitive personal information, we must always have an additional lawful basis.

For each reason for processing your information, we have set out our lawful basis:

Vitality Health

Why do we use your information	Our legal basis for processing	Our legitimate business interest, where applicable	Retention guide
To provide you with a quote: Assessing your application for insurance and, if we can, the price and other terms we can offer. By submitting a quote you acknowledge that we will call you regarding that quote.	Personal Information: Entering into and the performance of a contract Legitimate interest Sensitive Information: Sch1, Part 2, s 20(1) DPA 2018. (Health/Life/Car)	To price our products based on your insurance risk and to set plan acceptance parameters to determine when we want to insure certain risks.	13 months if no other Vitality relationship exists. Or 4 years if linked to fraud (Car)
To provide existing members with a quote: To personalise and discount quotes, where appropriate, at an individual level based on Vitality member data. By submitting a quote you acknowledge that we will call you regarding that quote.	Personal Information: Entering into and the performance of a contract Legitimate interest Sensitive Information: Explicit Consent	As above and in addition price our products based on information known about you as an existing customer
To Assess your application. Assessing your application for insurance and, if we can, the price and other terms we can offer.	Personal Information: Entering into and the performance of a contract Legitimate interest Sensitive Information: Sch1, Part 2, s 20(1) DPA 2018. (Health/Life/Car)	To price our products based on your insurance risk and to set plan acceptance parameters to determine when we want to insure certain risks.	13 months if no other Vitality relationship exists.
To verify a Members identity. To identify and verify Members before we discuss a Members plan or perform a requested transaction. ID&V is available for IVR, chat, web, and mobile channels. The service securely verifies individuals by asking them for a range of personal data such as their account number, postcode, date of birth, and passwords.	Personal Information: Entering into and the performance of a contract Legitimate interest	To identify that we are communicating with the correct person. To minimise the risk of unauthorised disclosure of information.	7 years from end of the last active plan across Vitality Group as per standards
To administer and manage your plan Administering the purchase of your plan Managing your plan Processing your premiums (insurance plans) Arranging the renewal, cancellation or lapse of your Plan (Car) Managing investments Arranging the renewal, cancellation or lapse of your plan.	Personal Information: Entering into and the performance of a contract Legitimate interest Sensitive Information: Establish, exercise or defend our legal rights Sch1, Part 2, s 20(1) DPA 2018. (Health/Life/Car)	To price our products based on your insurance risk and to set plan acceptance parameters to determine when we want to insure certain risks	7 years from end of the last active plan across Vitality Group as per standards.
To handle claims made against your plan Registering your claim Assessing your claim Processing payments for your claim Processing reinsurance recoveries (insurance plans) Employee of business /corporate plans.	Personal Information: Entering into and the performance of a contract Legitimate interest Sensitive Information: Establish, exercise or defend our legal rights Sch1, Part 2, s 20(1) DPA 2018. (Health/Life/Car)	To undertake checks to validate and settle the claim.	7 years from end of the last active plan across Vitality Group as per standards 21years & 4mths for claims involving minors (Car)
To resolve any complaints you may have Register complaints Manage and resolve complaints	Personal Information: Entering into and the performance of a contract Legitimate interest Sensitive Information: Establish, exercise or defend our legal rights Sch1, Part 2, s 20(1) DPA 2018. (Health/Life/Car)	To investigate and resolve any complaints made.	3 years from date of closure. 5 Years of Investment complaints
To recover any debt that you owe to us Recovery of unpaid debts or reimbursement of damages under a contract	Personal Information: Entering into and the performance of a contract Legitimate interest Developing and improving our customer experience	To recover any debt that is owed to us even if we do not hold a contractual relationship with you.	7 years after debt recovered or end of plan whichever is longer
To prevent, detect and investigate fraud or money laundering Investigating suspicions of fraud and money laundering Prosecuting fraud	Personal Information: Legitimate interest Sensitive Information: Substantial public interest - preventing or detecting unlawful acts.	To prevent fraud and money laundering.	Civil cases & criminal cases: 6 years On sentence 3 years after length of sentence.
For management information purposes and internal analysis of products and services Accounting and financial records, analysis and reporting Audit requirements Legal and professional advice Research into market trends and customer demographics Pricing and underwriting analysis System security and effective operation	Personal Information: Legitimate interest Sensitive Information: Sch1, Part 2, s 20(1) DPA 2018. (Health/Life/Car)	To monitor our business performance and maintain appropriate company records. To develop, manage and improve our products and services.	7 years after which personal data removed.
For training purposes to improve your customer experience Assessing customer experiences Identify staff training needs Establish facts in event of complaints	Personal Information: Legitimate interest Sensitive Information Establish, exercise or defend our legal rights Sch1, Part 2, s 20(1) DPA 2018. (Health/Life/Car)	To improve the service we provide to customers. Defend against claims	Call recordings 3 years (where recorded)
Age Calculator: Automated decision making. This simple tool helps you understand more about your health by calculating your Vitality Age, which you can compare to your actual age. The tool does not produce legal effect concerning the individual.	Personal Information: Performance of a contact Sensitive Information: Performance of a contract	The tool does not produce legal effect concerning the individual. instead it is part of our product delivery to enable members to make positive life choices
For back-up purposes:	Personal Information: Entering into and the performance of a contract Legal obligations Legitimate Interest Sensitive Information: Legal obligations Legitimate interest	To maintain business continuity to assist the business with recovery of data required for day-to-day operations due to data loss in unforeseen circumstances.	5 years

Vitality Life

Why do we use your information	Our legal basis for processing	Our legitimate business interest, where applicable	Retention guide
To provide you with a quote: Assessing your application for insurance and, if we can, the price and other terms we can offer. By submitting a quote you acknowledge that we will call you regarding that quote.	Personal Information: Entering into and the performance of a contract Legitimate interest Sensitive Information: Sch1, Part 2, s 20(1) DPA 2018. (Health/Life/Car)	To price our products based on your insurance risk and to set plan acceptance parameters to determine when we want to insure certain risks.	13 months if no other Vitality relationship exists. Or 4 years if linked to fraud (Car)
To provide existing members with a quote: To personalise and discount quotes, where appropriate, at an individual level based on Vitality member data. By submitting a quote you acknowledge that we will call you regarding that quote.	Personal Information: Entering into and the performance of a contract Legitimate interest Sensitive Information: Explicit Consent	As above and in addition price our products based on information known about you as an existing customer
To Assess your application. Assessing your application for insurance and, if we can, the price and other terms we can offer.	Personal Information: Entering into and the performance of a contract Legitimate interest Sensitive Information: Sch1, Part 2, s 20(1) DPA 2018. (Health/Life/Car)	To price our products based on your insurance risk and to set plan acceptance parameters to determine when we want to insure certain risks.	13 months if no other Vitality relationship exists.
To verify a Members identity. To identify and verify Members before we discuss a Members plan or perform a requested transaction. ID&V is available for IVR, chat, web, and mobile channels. The service securely verifies individuals by asking them for a range of personal data such as their account number, postcode, date of birth, and passwords.	Personal Information: Entering into and the performance of a contract Legitimate interest	To identify that we are communicating with the correct person. To minimise the risk of unauthorised disclosure of information.	7 years from end of the last active plan across Vitality Group as per standards
To administer and manage your plan Administering the purchase of your plan Managing your plan Processing your premiums (insurance plans) Arranging the renewal, cancellation or lapse of your Plan (Car) Managing investments Arranging the renewal, cancellation or lapse of your plan.	Personal Information: Entering into and the performance of a contract Legitimate interest Sensitive Information: Establish, exercise or defend our legal rights Sch1, Part 2, s 20(1) DPA 2018. (Health/Life/Car)	To price our products based on your insurance risk and to set plan acceptance parameters to determine when we want to insure certain risks	7 years from end of the last active plan across Vitality Group as per standards.
To handle claims made against your plan Registering your claim Assessing your claim Processing payments for your claim Processing reinsurance recoveries (insurance plans) Employee of business /corporate plans.	Personal Information: Entering into and the performance of a contract Legitimate interest Sensitive Information: Establish, exercise or defend our legal rights Sch1, Part 2, s 20(1) DPA 2018. (Health/Life/Car)	To undertake checks to validate and settle the claim.	7 years from end of the last active plan across Vitality Group as per standards 21years & 4mths for claims involving minors (Car)
To resolve any complaints you may have Register complaints Manage and resolve complaints	Personal Information: Entering into and the performance of a contract Legitimate interest Sensitive Information: Establish, exercise or defend our legal rights Sch1, Part 2, s 20(1) DPA 2018. (Health/Life/Car)	To investigate and resolve any complaints made.	3 years from date of closure. 5 Years of Investment complaints
To recover any debt that you owe to us Recovery of unpaid debts or reimbursement of damages under a contract	Personal Information: Entering into and the performance of a contract Legitimate interest Developing and improving our customer experience	To recover any debt that is owed to us even if we do not hold a contractual relationship with you.	7 years after debt recovered or end of plan whichever is longer
To prevent, detect and investigate fraud or money laundering Investigating suspicions of fraud and money laundering Prosecuting fraud	Personal Information: Legitimate interest Sensitive Information: Substantial public interest - preventing or detecting unlawful acts.	To prevent fraud and money laundering.	Civil cases & criminal cases: 6 years On sentence 3 years after length of sentence.
For management information purposes and internal analysis of products and services Accounting and financial records, analysis and reporting Audit requirements Legal and professional advice Research into market trends and customer demographics Pricing and underwriting analysis System security and effective operation	Personal Information: Legitimate interest Sensitive Information: Sch1, Part 2, s 20(1) DPA 2018. (Health/Life/Car)	To monitor our business performance and maintain appropriate company records. To develop, manage and improve our products and services.	7 years after which personal data removed.
For training purposes to improve your customer experience Assessing customer experiences Identify staff training needs Establish facts in event of complaints	Personal Information: Legitimate interest Sensitive Information Establish, exercise or defend our legal rights Sch1, Part 2, s 20(1) DPA 2018. (Health/Life/Car)	To improve the service we provide to customers. Defend against claims	Call recordings 3 years (where recorded)
Age Calculator: Automated decision making. This simple tool helps you understand more about your health by calculating your Vitality Age, which you can compare to your actual age. The tool does not produce legal effect concerning the individual.	Personal Information: Performance of a contact Sensitive Information: Performance of a contract	The tool does not produce legal effect concerning the individual. instead it is part of our product delivery to enable members to make positive life choices
For back-up purposes:	Personal Information: Entering into and the performance of a contract Legal obligations Legitimate Interest Sensitive Information: Legal obligations Legitimate interest	To maintain business continuity to assist the business with recovery of data required for day-to-day operations due to data loss in unforeseen circumstances.	5 years

Vitality Invest

Why do we use your information	Our legal basis for processing	Our legitimate business interest, where applicable	Retention guide
To provide you with a quote: Assessing your for investment and, if we can, the price and other terms we can offer. By submitting a quote you acknowledge that we will call you regarding that quote	Personal Information: Entering into and the performance of a contract Legitimate interest	To price our products based on your risk and to set plan acceptance parameters to determine when we want to insure certain risks	13 months if no other Vitality relationship exists.
To verify a Members identity. To identify and verify Members before we discuss a Members plan or perform a requested transaction. ID&V is available for IVR, chat, web, and mobile channels. The service securely verifies individuals by asking them for a range of personal data such as their account number, postcode, date of birth, and passwords.	Personal Information: Entering into and the performance of a contract Legitimate interest	To identify that we are communicating with the correct person. To minimise the risk of unauthorised disclosure of information.	7 years from end of the last active plan across Vitality Group as per standards
To administer and manage your plan Administering the purchase of your plan Managing your plan Processing your premiums (insurance plans) Arranging the renewal, cancellation or lapse of your Plan (Car) Managing investments Arranging the renewal, cancellation or lapse of your plan.	Personal Information: Entering into and the performance of a contract Legitimate interest Sensitive Information: Establish, exercise or defend our legal rights Sch1, Part 2, s 20(1) DPA 2018. (Health/Life/Car)	To price our products based on your insurance risk and to set plan acceptance parameters to determine when we want to insure certain risks	7 years from end of the last active plan across Vitality Group as per standards.
To handle claims made against your plan Registering your claim Assessing your claim Processing payments for your claim Processing reinsurance recoveries (insurance plans) Employee of business /corporate plans.	Personal Information: Entering into and the performance of a contract Legitimate interest Sensitive Information: Establish, exercise or defend our legal rights Sch1, Part 2, s 20(1) DPA 2018. (Health/Life/Car)	To undertake checks to validate and settle the claim.	7 years from end of the last active plan across Vitality Group as per standards 21years & 4mths for claims involving minors (Car)
To resolve any complaints you may have Register complaints Manage and resolve complaints	Personal Information: Entering into and the performance of a contract Legitimate interest Sensitive Information: Establish, exercise or defend our legal rights Sch1, Part 2, s 20(1) DPA 2018. (Health/Life/Car)	To investigate and resolve any complaints made.	3 years from date of closure. 5 Years of Investment complaints
To recover any debt that you owe to us Recovery of unpaid debts or reimbursement of damages under a contract	Personal Information: Entering into and the performance of a contract Legitimate interest Developing and improving our customer experience	To recover any debt that is owed to us even if we do not hold a contractual relationship with you.	7 years after debt recovered or end of plan whichever is longer
To prevent, detect and investigate fraud or money laundering Investigating suspicions of fraud and money laundering Prosecuting fraud	Personal Information: Legitimate interest Sensitive Information: Substantial public interest - preventing or detecting unlawful acts.	To prevent fraud and money laundering.	Civil cases & criminal cases: 6 years On sentence 3 years after length of sentence.
For management information purposes and internal analysis of products and services Accounting and financial records, analysis and reporting Audit requirements Legal and professional advice Research into market trends and customer demographics Pricing and underwriting analysis System security and effective operation	Personal Information: Legitimate interest Sensitive Information: Sch1, Part 2, s 20(1) DPA 2018. (Health/Life/Car)	To monitor our business performance and maintain appropriate company records. To develop, manage and improve our products and services.	7 years after which personal data removed.
For training purposes to improve your customer experience Assessing customer experiences Identify staff training needs Establish facts in event of complaints	Personal Information: Legitimate interest Sensitive Information Establish, exercise or defend our legal rights Sch1, Part 2, s 20(1) DPA 2018. (Health/Life/Car)	To improve the service we provide to customers. Defend against claims	Call recordings 3 years (where recorded)
For periodic reporting to our Regulator and HM Revenue & Customs. Maintaining tax privileged status of the plan Complying with regulatory obligations.	Personal Information: Legal obligations Sensitive Information: Sch1, Part 2, s 20(1) DPA 2018. (Health/Life/Car)	Your plan retains the tax advantages and benefits	7 years – after this, personal data is removed
Age Calculator: Automated decision making. This simple tool helps you understand more about your health by calculating your Vitality Age, which you can compare to your actual age. The tool does not produce legal effect concerning the individual.	Personal Information: Performance of a contact Sensitive Information: Performance of a contract	The tool does not produce legal effect concerning the individual. instead it is part of our product delivery to enable members to make positive life choices
For back-up purposes:	Personal Information: Entering into and the performance of a contract Legal obligations Legitimate Interest Sensitive Information: Legal obligations Legitimate interest	To maintain business continuity to assist the business with recovery of data required for day-to-day operations due to data loss in unforeseen circumstances.	5 years

Vitality Car

Why do we use your information	Our legal basis for processing	Our legitimate business interest, where applicable	Retention guide
To provide you with a quote: Assessing your application for insurance and, if we can, the price and other terms we can offer. By submitting a quote you acknowledge that we will call you regarding that quote.	Personal Information: Entering into and the performance of a contract Legitimate interest Sensitive Information: Sch1, Part 2, s 20(1) DPA 2018. (Health/Life/Car)	To price our products based on your insurance risk and to set plan acceptance parameters to determine when we want to insure certain risks.	13 months if no other Vitality relationship exists. Or 4 years if linked to fraud (Car)
To provide existing members with a quote: To personalise and discount quotes, where appropriate, at an individual level based on Vitality member data. By submitting a quote you acknowledge that we will call you regarding that quote.	Personal Information: Entering into and the performance of a contract Legitimate interest Sensitive Information: Explicit Consent	As above and in addition price our products based on information known about you as an existing customer
To verify a Members identity. To identify and verify Members before we discuss a Members plan or perform a requested transaction. ID&V is available for IVR, chat, web, and mobile channels. The service securely verifies individuals by asking them for a range of personal data such as their account number, postcode, date of birth, and passwords.	Personal Information: Entering into and the performance of a contract Legitimate interest	To identify that we are communicating with the correct person. To minimise the risk of unauthorised disclosure of information.	7 years from end of the last active plan across Vitality Group as per standards
To administer and manage your plan Administering the purchase of your plan Managing your plan Processing your premiums (insurance plans) Arranging the renewal, cancellation or lapse of your Plan (Car) Managing investments Arranging the renewal, cancellation or lapse of your plan.	Personal Information: Entering into and the performance of a contract Legitimate interest Sensitive Information: Establish, exercise or defend our legal rights Sch1, Part 2, s 20(1) DPA 2018. (Health/Life/Car)	To price our products based on your insurance risk and to set plan acceptance parameters to determine when we want to insure certain risks	7 years from end of the last active plan across Vitality Group as per standards.
To handle claims made against your plan Registering your claim Assessing your claim Processing payments for your claim Processing reinsurance recoveries (insurance plans) Employee of business /corporate plans.	Personal Information: Entering into and the performance of a contract Legitimate interest Sensitive Information: Establish, exercise or defend our legal rights Sch1, Part 2, s 20(1) DPA 2018. (Health/Life/Car)	To undertake checks to validate and settle the claim.	7 years from end of the last active plan across Vitality Group as per standards 21years & 4mths for claims involving minors (Car)
To resolve any complaints you may have Register complaints Manage and resolve complaints	Personal Information: Entering into and the performance of a contract Legitimate interest Sensitive Information: Establish, exercise or defend our legal rights Sch1, Part 2, s 20(1) DPA 2018. (Health/Life/Car)	To investigate and resolve any complaints made.	3 years from date of closure. 5 Years of Investment complaints
To recover any debt that you owe to us Recovery of unpaid debts or reimbursement of damages under a contract	Personal Information: Entering into and the performance of a contract Legitimate interest Developing and improving our customer experience	To recover any debt that is owed to us even if we do not hold a contractual relationship with you.	7 years after debt recovered or end of plan whichever is longer
To conduct credit reference checks and to assess your application for credit: Verifying your identity Make decision about credit	Personal Information: Legitimate interest	To check the details you provide to verify your identity. To check your ability to afford the finance you are purchasing.	7 years
For back-up purposes:	Personal Information: Entering into and the performance of a contract Legal obligations Legitimate Interest Sensitive Information: Legal obligations Legitimate interest	To maintain business continuity to assist the business with recovery of data required for day-to-day operations due to data loss in unforeseen circumstances.	5 years

Business/Corporate Plans

Why do we use your information	Our legal basis for processing	Our legitimate business interest, where applicable	Retention guide
To provide you with a quote: Assessing your application for insurance and, if we can, the price and other terms we can offer. By submitting a quote you acknowledge that we will call you regarding that quote.	Personal Information: Entering into and the performance of a contract Legitimate interest Sensitive Information: Sch1, Part 2, s 20(1) DPA 2018. (Health/Life/Car)	To price our products based on your insurance risk and to set plan acceptance parameters to determine when we want to insure certain risks.	13 months if no other Vitality relationship exists. Or 4 years if linked to fraud (Car)
To verify a Members identity. To identify and verify Members before we discuss a Members plan or perform a requested transaction. ID&V is available for IVR, chat, web, and mobile channels. The service securely verifies individuals by asking them for a range of personal data such as their account number, postcode, date of birth, and passwords.	Personal Information: Entering into and the performance of a contract Legitimate interest	To identify that we are communicating with the correct person. To minimise the risk of unauthorised disclosure of information.	7 years from end of the last active plan across Vitality Group as per standards
To administer and manage your plan Administering the purchase of your plan Managing your plan Processing your premiums (insurance plans) Arranging the renewal, cancellation or lapse of your Plan (Car) Managing investments Arranging the renewal, cancellation or lapse of your plan.	Personal Information: Entering into and the performance of a contract Legitimate interest Sensitive Information: Establish, exercise or defend our legal rights Sch1, Part 2, s 20(1) DPA 2018. (Health/Life/Car)	To price our products based on your insurance risk and to set plan acceptance parameters to determine when we want to insure certain risks	7 years from end of the last active plan across Vitality Group as per standards.
To handle claims made against your plan Registering your claim Assessing your claim Processing payments for your claim Processing reinsurance recoveries (insurance plans) Employee of business /corporate plans.	Personal Information: Entering into and the performance of a contract Legitimate interest Sensitive Information: Establish, exercise or defend our legal rights Sch1, Part 2, s 20(1) DPA 2018. (Health/Life/Car)	To undertake checks to validate and settle the claim.	7 years from end of the last active plan across Vitality Group as per standards 21years & 4mths for claims involving minors (Car)
To resolve any complaints you may have Register complaints Manage and resolve complaints	Personal Information: Entering into and the performance of a contract Legitimate interest Sensitive Information: Establish, exercise or defend our legal rights Sch1, Part 2, s 20(1) DPA 2018. (Health/Life/Car)	To investigate and resolve any complaints made.	3 years from date of closure. 5 Years of Investment complaints
To recover any debt that you owe to us Recovery of unpaid debts or reimbursement of damages under a contract	Personal Information: Entering into and the performance of a contract Legitimate interest Developing and improving our customer experience	To recover any debt that is owed to us even if we do not hold a contractual relationship with you.	7 years after debt recovered or end of plan whichever is longer
To prevent, detect and investigate fraud or money laundering Investigating suspicions of fraud and money laundering Prosecuting fraud	Personal Information: Legitimate interest Sensitive Information: Substantial public interest - preventing or detecting unlawful acts.	To prevent fraud and money laundering.	Civil cases & criminal cases: 6 years On sentence 3 years after length of sentence.
For management information purposes and internal analysis of products and services Accounting and financial records, analysis and reporting Audit requirements Legal and professional advice Research into market trends and customer demographics Pricing and underwriting analysis System security and effective operation	Personal Information: Legitimate interest Sensitive Information: Sch1, Part 2, s 20(1) DPA 2018. (Health/Life/Car)	To monitor our business performance and maintain appropriate company records. To develop, manage and improve our products and services.	7 years after which personal data removed.
For training purposes to improve your customer experience Assessing customer experiences Identify staff training needs Establish facts in event of complaints	Personal Information: Legitimate interest Sensitive Information Establish, exercise or defend our legal rights Sch1, Part 2, s 20(1) DPA 2018. (Health/Life/Car)	To improve the service we provide to customers. Defend against claims	Call recordings 3 years (where recorded)
Management Reports to Corporate Entities on employee engagement.	Aggregated data only: No Personal information. Legitimate Interest	To provide Corporate clients insight into employee engagement with services	Indefinite.
Age Calculator: Automated decision making. This simple tool helps you understand more about your health by calculating your Vitality Age, which you can compare to your actual age. The tool does not produce legal effect concerning the individual.	Personal Information: Performance of a contact Sensitive Information: Performance of a contract	The tool does not produce legal effect concerning the individual. instead it is part of our product delivery to enable members to make positive life choices
For back-up purposes:	Personal Information: Entering into and the performance of a contract Legal obligations Legitimate Interest Sensitive Information: Legal obligations Legitimate interest	To maintain business continuity to assist the business with recovery of data required for day-to-day operations due to data loss in unforeseen circumstances.	5 years

Business/Corporate and Vitality at Work Plans - Data Processing Agreement

Between The Client; and Vitality Health Limited, the respective supplier engaged by the Client on the basis of the terms and condition of Service.

Both parties are Independent Data Controllers of the Shared Personal Data.

Vitality also receives personal and/or special category data of Employees and/or their Dependents directly from those Employees and/or their Dependents. This personal data and/or special category data is not Shared Personal Data. As such, this data falls outside of this Agreement and is governed by Vitality’s own Privacy Notice.

1. Interpretation

The following definitions and rules of interpretation apply in these terms and conditions (the “Agreement”).

1.1 Definitions

For the purposes of these this Agreement:

“Agreed Purposes” means the setting up, management and administration of private medical insurance pursuant to the Client’s Plan to the Client’s Employees and Employee Dependents;

“Client” shall mean the party which discloses Shared Personal Data to Vitality;

“Data Controller” means any party insofar as they are acting as a controller within the meaning of applied GDPR Art 4.7;

“Data Discloser” means the Client who agrees to share the Shared Personal Data with the Data Receiver;

“Data Receiver” means Vitality who agrees to use the Personal Data on the terms set out in this Agreement;

“Dependent” mean the husband, wife, partner or any dependent child of an Employee where added to the Plan by the Group Secretary;

“Employee” shall mean each individual with the benefit of private medical insurance cover under the Plan. “Personal data”, “Special Categories of data/Sensitive Data”,

“Group Secretary” means the person in control of the Client’s Plan;

“Plan” means the private medical insurance scheme underwritten by Vitality;

“Process/processing”, “Controller”, “Processor”, “Data Subject” and

“Supervisory Authority” shall have the same meaning as in the UK Data Protection Act 2018. For the purposes of this Agreement references to a “data subject” shall mean the Client’s Employees/Employee Dependents;

“Shared Personal Data” means the personal data to be shared between the parties, as further outlined at clause 2.4;

“UK Data Protection Laws”, all applicable data protection and privacy laws in force from time to time in the UK, including the UK General Data Protection Regulation, the Data Protection Act 2018; the Privacy and Electronic Communications Directive 2002/58/EC (as updated by Directive 2009/136/EC) and the Privacy and Electronic Communications Regulations 2003 (SI 2003/2426) as amended.

2. Purpose

2.1 This Agreement sets out the framework for the sharing of Shared Personal Data between the parties as independent Data Controllers.

2.2 The parties consider this data sharing initiative necessary as part of the provision of private medical insurance. The aim of the data sharing initiative is to make it easier for the Clients Employees and/or Dependents to get healthier and reward them when they do. It will serve to benefit the Client, Employees and/or Dependents of the Client’s Plan.

2.3 Each party acknowledges and agrees that:
a. the Client will regularly disclose to Vitality the Shared Personal Data collected by the Client for the Agreed Purposes;
b. Vitality provides private medical insurance directly to each of the Client’s individual Employees and any Employee Dependants who qualify for cover under the Client’s Plan. Accordingly Vitality determines the ways and means of its processing of the Shared Personal Data and does not act on the instructions of the Client in relation to the processing of the Shared Personal Data.

2.4 The following types of Shared Personal Data will be shared between the parties during the term of this agreement:
a. Name
b. Date of Birth
c. Designation
d. Email contact details
e. Address
f. Telephone number
Special categories of Personal Data will not be shared between the parties.

3. Lawful, fair and transparent processing

3.1 Each party shall ensure that it processes the Shared Personal Data fairly and lawfully in accordance with clause 3.2.

3.2 Each party shall ensure that it has legitimate grounds under the Data Protection Laws for the processing of Shared Personal Data.

3.3 The Data Discloser shall, in respect of Shared Personal Data, ensure that it provides clear and sufficient information to the data subjects, in accordance with the Data Protection laws, of the purposes for which it will process their personal data, the legal basis for such purposes and such other information as is required by Article 13 of the applied GDPR including:

a. if Shared Personal Data will be transferred to a third party, that fact and sufficient information about such transfer and the purpose of such transfer to enable the data subject to understand the purpose and risks of such transfer; and

b. if Shared Personal Data will be transferred outside the EEA pursuant to clause 0 of this Agreement, that fact and sufficient information about such transfer, the purpose of such transfer and the safeguards put in place by the controller to enable the data subject to understand the purpose and risks of such transfer.]

3.4 The Data Receiver undertakes to inform the Data Subjects, in accordance with the Data Protection laws, of the purposes for which it will process their personal data, the legal basis for such purposes and such other information as is required by Article 14 of the applied GDPR including:

4. Rights of Data Subjects

4.1 Each party agrees to have processes in place to comply with requests from Data Subjects to exercise their rights under the Data Protection Laws within the time limits imposed by the Data Protection Laws.

5. Data Retention and Deletion

5.1 The Data Receiver shall not retain or process Shared Personal Data for longer than is necessary to carry out the Agreed Purposes.

5.2 Notwithstanding clause 5.1, the parties shall continue to retain Shared Personal Data in accordance with any statutory or professional retention periods applicable in their respective countries and / or industry.

5.3 The Data Receiver shall ensure that any Shared Personal Data are destroyed in accordance with its deletion procedure in the following circumstances:
a. on termination of this Agreement;
b. on expiry of the Term of this Agreement;
c. once processing of the Shared Personal Data is no longer necessary for the
purposes it was originally shared for.

6. Transfers

6.1 For the purposes of this clause, transfers of personal data shall mean any sharing of Shared Personal Data by the Data Receiver with a third party, and shall include, but is not limited to, the following:
a. subcontracting the processing of Shared Personal Data;
b. granting a third party controller access to the Shared Personal Data.

6.2 If the Data Receiver appoints a third party processor to process the Shared
Personal Data it shall comply with Article 28 and Article 30 of the applied GDPR.

6.3 The Data Receiver may not transfer Shared Personal Data to a third party located outside the
EEA unless it:
a. complies with the provisions of Articles 26 of the applied GDPR (in the event the third party is a joint controller); and
b. ensures that:
i. the transfer is to a country approved by the European Commission as providing adequate protection pursuant to Article 45 of the applied GDPR;
ii. there are appropriate safeguards in place pursuant to Article 46 of the applied GDPR;
or
iii. one of the derogations for specific situations in Article 49 of the applied GDPR applies to the transfer.

6.4 The Data Receiver is part of the Discovery Group of companies and is owned by
Discovery Limited, a financial services firm based in South Africa. As part of this relationship, Discovery undertake a number of business processes on behalf of the Data Receiver. Such processes include underwriting and claims administration services. The delivery of such services requires the Data Receiver to share data relating to its customers with Discovery and is undertaken in accordance with Article 46 of the applied GDPR.

7. Security and training

7.1 The parties undertake to have in place appropriate technical and organisational security measures to:
a) prevent:
i. unauthorised or unlawful processing of the Shared Personal Data; and
ii. the accidental loss or destruction of, or damage to, the Shared Personal Data;
b) ensure a level of security appropriate to:
i. the harm that might result from such unauthorised or unlawful processing or accidental loss, destruction or damage; and
ii. the nature of the Shared Personal Data to be protected.

7.2 It is the responsibility of each party to ensure that
i) its staff members are appropriately trained to handle and process the Shared Personal Data in accordance with the technical and organisational security of that party together with any other applicable national data protection laws and guidance and
ii) have entered into confidentiality agreements relating to the processing of personal data.

8. Personal data Breaches and reporting procedures.

8.1 The parties shall each comply with its obligation to report a Personal Data Breach to the appropriate Supervisory Authority and (where applicable) data subjects in accordance with Article 33 of the applied GDPR.

8.2 Where appropriate Vitality will provide all reasonable information to the Client to enable them to manage their employee expectations, and will aim to do so within 72 hours, to ensure that any actions do not prejudice any internal investigations or those by the police/Regulator.

9. Resolution of disputes with data subjects or the Supervisory Authority.

9.1 In the event of a dispute or claim brought by a data subject or the Supervisory Authority concerning the processing of Shared Personal Data against either or both parties, the parties will inform each other about any such disputes or claims, where appropriate, and will cooperate with a view to settling them amicably in a timely fashion.

9.2 The parties agree to respond to any generally available non-binding mediation procedure initiated by a data subject or by the Supervisory Authority. If they do participate in the proceedings, the parties may elect to do so remotely (such as by telephone or other electronic means). The parties also agree to consider participating in any other arbitration, mediation or
other dispute resolution proceedings developed for data protection disputes.

9.3 Each party shall abide by a decision of a competent court of the Data Receiver's country of establishment or of the Supervisory Authority.

10. Warranties

10.1 Each party warrants and undertakes that it will:
a. Process the Shared Personal Data in compliance with all applicable laws,
enactments, regulations, orders, standards and other similar instruments that apply to its personal data processing operations.
b. Make available on request to the data subjects who are third party beneficiaries a copy of this Agreement, unless the Agreement contains confidential information.
c. Respond within a reasonable time and as far as reasonably possible to enquiries from the relevant Supervisory Authority in relation to the Shared Personal Data.
d. Respond to Subject Access Requests in accordance with the Data Protection Law.
e. Where applicable, pay the appropriate fees with all relevant Supervisory Authorities to process all Shared Personal Data for the Agreed Purpose.
f. Take all appropriate steps to ensure compliance with the security measures set out in clause 0 above.

10.2 The Data Discloser warrants and undertakes that it is entitled to provide the Shared Personal Data to the Data Receiver and it will ensure that the Shared Personal Data are accurate.

10.3 The Data Receiver warrants and undertakes that it will not disclose or transfer Shared Personal Data outside the EEA unless it complies with the obligations set out in clause 6.

10.4 Except as expressly stated in this Agreement, all warranties, conditions and terms, whether express or implied by statute, common law or otherwise are hereby excluded to the extent permitted by law.

11. Indemnity

11.1 The Data Discloser and Data Receiver undertake to indemnify each other and hold each other harmless from any cost, charge, damages, expense or loss which they cause each other as a result of their breach of any of the provisions of this Agreement, except to the extent that any such liability is excluded under clause 12.2.

11.2 Indemnification hereunder is contingent upon:
a. The party(ies) to be indemnified (the “indemnified party(ies)”) promptly notifying the
other party(ies) (the “indemnifying party(ies)”) of a claim,
b. the indemnifying party(ies) having sole control of the defence and settlement of any such claim, and
c. the indemnified party(ies) providing reasonable co-operation and assistance to the indemnifying party(ies) in defence of such claim.

12. Limitation of liability

12.1 Neither party excludes or limits liability to the other party for:
a. fraud or fraudulent misrepresentation;
b. death or personal injury caused by negligence;
c. a breach of any obligations implied by section 12 of the Sale of Goods Act 1979 or section 2 of the Supply of Goods and Services Act 1982; or
d. any matter for which it would be unlawful for the parties to exclude liability.

12.2 Subject to clause 12.1 neither party shall in any circumstances be liable whether in contract, tort (including for negligence and breach of statutory duty howsoever arising), and misrepresentation (whether innocent or negligent), restitution or otherwise, for:
a. any loss (whether direct or indirect) of profits, business, business opportunities, revenue, turnover, reputation or goodwill;
b. loss (whether direct or indirect) of anticipated savings or wasted expenditure
(including management time); or
c. any loss or liability (whether direct or indirect) under or in relation to any other contract.

12.3 Clause 12.2 shall not prevent claims, for:
a. direct financial loss that are not excluded under any of the categories set out in clause 12.2 (a); or
b. tangible property or physical damage.

13. Third party rights

13.1 Except as expressly provided in clause 4 (data subjects rights) a person who is not a party to this Agreement shall not have any rights under the Contracts (Rights of Third Parties) Act 1999 to enforce any term of this Agreement.

13.2 The rights of the parties to terminate, rescind or agree any variation, waiver or settlement under this Agreement are not subject to the consent of any other person.

14. Direct marketing

14.2 If the Data Receiver processes the Shared Personal Data for the purposes of direct marketing, each party shall ensure that:
a. the appropriate level consent has been obtained from the relevant data subjects to allow the Shared Personal Data to be used for the purposes of direct marketing in compliance with the Data Protection Law; and
b. effective procedures are in place to allow the data subject to "opt-out" from having their Shared Personal Data used for such direct marketing purposes.

15. Variation

15.1 No variation of this Agreement shall be effective unless it is in writing and signed by the parties (or their authorised representatives).

16. Waiver

16.1 No failure or delay by a party to exercise any right or remedy provided under this Agreement or by law shall constitute a waiver of that or any other right or remedy, nor shall it prevent or restrict the further exercise of that or any other right or remedy. No single or partial exercise of such right or remedy shall prevent or restrict the further exercise of that or any other right or remedy.

17. Severance

17.1 If any provision or part-provision of this Agreement is or becomes invalid, illegal or unenforceable, it shall be deemed deleted, but that shall not affect the validity and enforceability of the rest of this agreement.

17.2 If any provision or part-provision of this agreement is deemed deleted under clause 17.1, the parties shall negotiate in good faith to agree a replacement provision that, to the greatest extent possible, achieves the intended commercial result of the original provision.

18. Changes to the applicable law

18.1 If during the duration of this Agreement the Data Protection Law changes in a way that this Agreement is no longer adequate for the purpose of governing lawful data sharing exercises, the parties agree that the parties will negotiate in good faith to review the Agreement in the light of the new laws.

19. No partnership or agency

19.1 Nothing in this Agreement is intended to, or shall be deemed to, establish any partnership or joint venture between any of the parties, constitute any party the agent of another party, or authorise any party to make or enter into any commitments for or on behalf of any other party.

19.2 Each party confirms it is acting on its own behalf and not for the benefit of any other person.

20. Entire agreement

20.1 This Agreement constitutes the entire agreement between the parties and supersedes and extinguishes all previous agreements, promises, assurances, warranties, representations and understandings between them, whether written or oral, relating to its subject matter.

20.2 Each party acknowledges that in entering into this Agreement it does not rely on, and shall have no remedies in respect of any statement, representation, assurance or warranty (whether made innocently or negligently) that is not set out in this Agreement.

20.3 Each party agrees that it shall have no claim for innocent or negligent misrepresentation or negligent misrepresentation based on any statement in this Agreement.

21 Further assurance

21.1 At its own expense, each party shall, and shall use all reasonable endeavours to procure that any necessary third party shall, promptly execute and deliver such documents and perform such acts as may reasonably be required for the purpose of giving full effect to this Agreement.

Vitality at Work Enterprise

Why do we use your information	Our legal basis for processing	Our legitimate business interest, where applicable	Retention guide
To verify a Members identity. To identify and verify Members before we discuss a Members plan or perform a requested transaction. ID&V is available for IVR, chat, web, and mobile channels. The service securely verifies individuals by asking them for a range of personal data such as their account number, postcode, date of birth, and passwords.	Personal Information: Entering into and the performance of a contract Legitimate interest	To identify that we are communicating with the correct person. To minimise the risk of unauthorised disclosure of information.	7 years from end of the last active plan across Vitality Group as per standards
To administer and manage your programme Administering your profile Managing your programme Arranging the renewal, cancellation or lapse of your programme.	Personal Information: Entering into and the performance of a contract Legitimate interest Sensitive Information: Establish, exercise or defend our legal rights	To monitor delivery of services.	7 years from end of the last active plan across Vitality Group as per standards.
To resolve any complaints you may have Register complaints Manage and resolve complaints	Personal Information: Entering into and the performance of a contract Legitimate interest Sensitive Information: Establish, exercise or defend our legal rights Sch1, Part 2, s 20(1) DPA 2018. (Health/Life/Car)	To investigate and resolve any complaints made.	3 years from date of closure. 5 Years of Investment complaints
To prevent, detect and investigate fraud or money laundering Investigating suspicions of fraud and money laundering Prosecuting fraud	Personal Information: Legitimate interest Sensitive Information: Substantial public interest - preventing or detecting unlawful acts.	To prevent fraud and money laundering.	Civil cases & criminal cases: 6 years On sentence 3 years after length of sentence.
For training purposes to improve your customer experience Assessing customer experiences Identify staff training needs Establish facts in event of complaints	Personal Information: Legitimate interest Sensitive Information Establish, exercise or defend our legal rights Sch1, Part 2, s 20(1) DPA 2018. (Health/Life/Car)	To improve the service we provide to customers. Defend against claims	Call recordings 3 years (where recorded)
For management information purposes and internal analysis of products and services Provision of anonymous data to client e.g. number of people using the programme. Employee’s Vitality Status	Personal Information: Legitimate Interest Performance of contract	To monitor our business performance and maintain appropriate company records To develop, manage and improve our products and services.	7 years after which personal data removed.
For back-up purposes:	Personal Information: Entering into and the performance of a contract Legal obligations Legitimate Interest Sensitive Information: Legal obligations Legitimate interest	To maintain business continuity to assist the business with recovery of data required for day-to-day operations due to data loss in unforeseen circumstances.	5 years

Mobile apps

Why do we use your information	Our legal basis for processing	Our legitimate business interest, where applicable	Retention guide
To verify a Members identity. To identify and verify Members before we discuss a Members plan or perform a requested transaction. ID&V is available for IVR, chat, web, and mobile channels. The service securely verifies individuals by asking them for a range of personal data such as their account number, postcode, date of birth, and passwords.	Personal Information: Entering into and the performance of a contract Legitimate interest	To identify that we are communicating with the correct person. To minimise the risk of unauthorised disclosure of information.	7 years from end of the last active plan across Vitality Group as per standards
For back-up purposes:	Personal Information: Entering into and the performance of a contract Legal obligations Legitimate Interest Sensitive Information: Legal obligations Legitimate interest	To maintain business continuity to assist the business with recovery of data required for day-to-day operations due to data loss in unforeseen circumstances.	5 years

Business Contacts

Why do we use your information	Our legal basis for processing	Our legitimate business interest, where applicable	Retention guide
To verify a Members identity. To identify and verify Members before we discuss a Members plan or perform a requested transaction. ID&V is available for IVR, chat, web, and mobile channels. The service securely verifies individuals by asking them for a range of personal data such as their account number, postcode, date of birth, and passwords.	Personal Information: Entering into and the performance of a contract Legitimate interest	To identify that we are communicating with the correct person. To minimise the risk of unauthorised disclosure of information.	7 years from end of the last active plan across Vitality Group as per standards
For back-up purposes:	Personal Information: Entering into and the performance of a contract Legal obligations Legitimate Interest Sensitive Information: Legal obligations Legitimate interest	To maintain business continuity to assist the business with recovery of data required for day-to-day operations due to data loss in unforeseen circumstances.	5 years

Job candidates

Why do we use your information	Our legal basis for processing	Our legitimate business interest, where applicable	Retention guide
Recruitment: Making a decision about your recruitment or appointment or determining the terms on which you work for us, for example, part-time hours	Personal Information: Entering into and the performance of a contract Legal obligations Sensitive Information: Legal obligations	To demonstrate compliance with employment and Diversity laws.	1 year for unsuccessful candidates 2 months Visitors logs from completion of book 7 years from end of employment successful candidates.
For back-up purposes:	Personal Information: Entering into and the performance of a contract Legal obligations Legitimate Interest Sensitive Information: Legal obligations Legitimate interest	To maintain business continuity to assist the business with recovery of data required for day-to-day operations due to data loss in unforeseen circumstances.	5 years

How we share your information

In order to sell, manage and provide our products and services, prevent fraud and comply with legal and regulatory requirements, we may need to share your information with third parties, including:

Our re-insurers (excluding VitalityInvest or VitalityCar)

Re-insurance is insurance that is purchased by an insurance company. It allows insurance companies to remain solvent after major claims events and is sometimes used for tax mitigation and other reasons.

We may need to share your personal health or medical data provided by you with our re-insurers in order for them to do the following:

to analyse key demographic information;
to analyse patterns of claims by customers and their claims experiences;
to analyse the risk they are reinsuring and to set a price for the re-insurance with Vitality;
to determine the validity of a claim; and
to set approval limits for claims and underwriting.

Our auditors (for management information purposes)

Vitality will only share your personal data with other companies or organisations where there is a legitimate reason for doing so. For example we are obligated to provide information to specific Government departments such as HM Revenue and Customs and to regulatory bodies who govern our activity such as:

Information Commissioner’s Office (ICO)
Financial Conduct Authority (FCA)
Prudential Regulation Authority (PRA)
Financial Ombudsman Service (FOS)

We may also share your personal data where we conduct further investigations with law enforcement and fraud prevention agencies and databases, our regulators (such as the FCA, PRA and ICO) as well as other insurers, to facilitate the prevention and detection of fraud or crime.

Fraud prevention agencies

Crime prevention agencies, including the police

Sharing your personal data with your authorised representative

If you have appointed an insurance or financial adviser, we may send them copies of correspondence relating to the plan and any renewal documentation. We may disclose information to them if you have made a claim although no medical information will be provided without your consent.

Please be sure to tell us if you authorise a new representative so that we are able to only send your personal data to the right representative so that we send your personal data to the right person.

Our use of other companies to provide our products and services to you.

To assist us in the provision of administration, services or benefits for your plan and any claims you make, we use other companies who work under contracts with us. We ensure that the level of security and the quality of service provided by those other companies is equivalent to the standard of services we provide to you.

We need to advise you that as part of the application process we will share your data with credit reference agencies for security purposes. This check (known as a “soft search” or “quotation search”) will not affect your credit score or be visible to lenders.

Some of the companies who work under contract with us are located in countries outside of the United Kingdom and the European Economic Area. Where this is the case we transfer your personal data to them on terms that are approved by the Information Commissioner. This is to ensure the appropriate security for your information, both in the transfer stage and when it is processed, and that your rights and confidentiality are protected in the same way as they would be if your personal data was processed in the UK.

Please click here to see the list of other companies who assist us in the provision of administration services.

Sharing your personal data with benefit providers

The Vitality group’s products are designed to enable you to accrue points related to your fitness and this in turn enables you to access a number of rewards and benefits. The exchange of your personal data, health and medical information will only occur with your consent and only with the benefit providers you choose to engage with.

The full list of benefit and reward providers can be found here.

Marketing

We will carry out direct marketing for customers of this product and other products and services that are managed by the Vitality Group where you have consented. Members can manage their preferences through their Member Zone.

You’ll get communications or emails about your plan or any changes to that plan as we have a statutory obligation to do so.

If your relationship with Vitality ends you should amend your preferences first as they will still be active. However you can contact data.protection@Vitality.co.uk if necessary to request amendment to your preferences retrospectively. We have one month in which to process these requests.

International Transfers

We have detailed third parties that we may share your information with in the ‘How we share your information’ section. Some of these third parties may be in countries outside of the United Kingdom (UK) or the European Economic Area (EEA).

Under data protection law, when personal information is being transferred outside the UK, we as data controller, are under an obligation to ensure that such transfers are performed in a manner that ensures that your personal information is adequately protected.

In the event that we transfer your personal information outside of the UK, we will always put in place adequate safeguards to ensure that your personal information is protected. Adequate safeguards may include placing contractual obligations on the third party that we are transferring your information to.

How long we keep your information for

We only keep your personal information for as long as is necessary in line with the purposes for which we collected your information. We have set out in our general retention schedule below however in certain circumstances it will be necessary for us to keep your information for longer, for example when we are required to due to legal obligations or to defend or manage legal claims.

If you get a quote from us for insurance but do not take up the plan, we will keep your information for up to 13 months from the expiry date of the quote. This is to support customers returning in the near future and to prevent and detect fraud.

In most cases, we will keep your information for 7 years from the expiry date of the plan or from the settlement/closure of the claim, whichever is the latter. This is applicable if you get a quote from us and you buy the plan, if you have a plan with us, if you make a claim under one of our plans (including if you are a third party claimant) or if you are a witness to an event giving rise to a claim under one of our plans. This is so that we can administer the contract of insurance and handle claims made against the plan.

It is of utmost importance to ensure that data is always protected and available for operational purposes. In the event, there is data loss due to unforeseen circumstances backup is an effective mechanism to assist business with the recovery of the data required for day-to-day operations. Our retention period for system back-ups is 5 years.

If we suspect, detect or investigate fraud or money laundering, information will be held on a case by case basis for up to 7 years. We also provide a retention guide in the table under “Why we use your information?”

Your rights

The UK GDPR provides the following rights for individuals:

Right to be informed: to be informed about the collection and use of your personal data e.g. the purpose of processing your personal data, our retention periods for that personal data, and who it will be shared with. This information can be found in our Privacy Notice. We have one month to respond to a request.
Right of Access: the right to access and receive a copy of your personal data. Request can be made verbally or in writing. Information is provided in an accessible, concise and intelligible format (not a machine-readable format). Information identifying a third party may be removed. We must respond without delay and within one month of receipt of the request but may extend the time limit by a further two months if the request is complex or if you receive a number of requests from the individual.
Right to Rectification: The right for individuals to have inaccurate personal data rectified, or completed if it is incomplete. An individual can make a request for rectification verbally or in writing. However this is not an absolute right. If you provide false information this may not be corrected as it is not inaccurate. We have one month to respond to a request. We have one calendar month to respond to a request.
Right to Erasure: (“the right to be forgotten”). Individuals can make a request for erasure verbally or in writing. The right is not absolute and only applies in certain circumstances. In many case we have a legal obligation to retain that data for 7 years even when the relationship no longer exists, which is because we are regulated by the Financial Conduct Authority. Information may be erased from our production ‘live’ systems however backup information will be retained for 5 years as part of our business continuity planning. We have one calendar month to respond to a request.
Right to Restriction: Individuals have the right to request the restriction or suppression of their personal data. This is not an absolute right and only applies in certain circumstances. An individual can make a request for restriction verbally or in writing. We have one calendar month to respond to a request.
Right to Portability: The right to data portability allows you to obtain and reuse your personal data for your own purposes across different services. It allows them to move, copy or transfer personal data easily from one IT environment to another in a safe and secure way, without affecting its usability. The right only applies to information an individual has provided to a controller. The information should be provided in a structured, commonly used and machine-readable format. We have one calendar month to respond to a request.
Right to object to processing: The UK GDPR gives individuals the right to object to the processing of their personal data in certain circumstances. You have an absolute right to stop your data being used for direct marketing, but in some cases you may still receive marketing material that is in production at the time of your request is processed. However in other cases where the right to object applies we may be able to continue processing if we can show that we have a compelling reason for doing so. For example in notifying you of changes to your plan where you may be disadvantaged. An individual can make an objection verbally or in writing. We have one calendar month to respond to an objection.

In some cases, we will be unable to comply with your request as a result of our own legal or regulatory requirements but we will always respond to your request and if we cannot comply, we will explain why.

If you would like to know more about your rights, you can find out more information on the ICO’s website.

How to complain about a Data Protection issue

If you have concerns about how we are handling your personal data then these can be raised with the Group Head of Data Protection, even if you have already dealt with our Complaints Team.

We will contact you if we require any more information to help us respond, otherwise we will respond within one month. This is in accordance with the Information Commissioners guidance.

If you are still unhappy then you can complain to the Information Commissioners Office (ICO). The ICO’s address:

Information Commissioner’s Office,
Wycliffe House,
Water Lane,
Wilmslow,
Cheshire,
SK9 5AF

Helpline number: 0303 123 1113

ICO website: https://www.ico.org.uk

Information Commissioners Office

We will always ask you to raise any concerns you have about how we handle your data with our Data Protection Officer first, but if you are still unhappy then you can contact the Information Commissioners Office:

Information Commissioners Office,
Wycliffe House,
Water Lane,
Wilmslow,
Cheshire,
SK9 5AF

Tel: 0303 123 1113 (local rate) or
01625 545 745 (National rate)
https://ico.org.uk/make-a-complaint/