BMI del Ecuador Privacy Policy

1. Scope

This Privacy Policy shall apply to all Databases and/or Files containing Personal Data that are processed by BMI DEL ECUADOR COMPAÑÍA DE SEGUROS DE VIDA S.A. (hereinafter BMI), considered the controller of the Processing of Personal Data.

 

2. Definitions

2.1. Authorization: The prior, express and informed consent of the Personal Data Subject to carry out the Processing of Personal Data.

2.2. Privacy Notice: Written communication generated by BMI, addressed to the TDP for the Processing of their Personal Data, through which they are informed of the existence of the information Privacy Policies that will apply to them, how to access them and the purposes of the Processing intended for the Personal Data.

2.3. Database: Organized set of Personal Data that is subject to Processing.

2.4. Clients: Natural or legal person whose Personal Data is subject to Processing and who has a contractual relationship with BMI and/or has submitted an application to BMI to enter into a Policy. Clients shall also be understood to include those natural persons listed as insureds or dependents under an individual or corporate Policy.

2.5. Personal Data: Any information linked to or that may be associated with one or more identified or identifiable natural persons, including medical information on diagnosis, treatments or health condition, as well as personal information, which includes asset and financial information.

2.6. Processor: Natural or legal person, public or private, that by itself or in association with others, carries out the Processing of Personal Data on behalf of BMI.

2.7. Controller: Natural or legal person, public or private, that by itself or in association with others, processes, safeguards or manages the Database and/or the Processing of data for the purposes established in the Policy.

2.8. Terms and Conditions: general framework establishing the conditions for participants in commercial or related activities.

2.9. Personal Data Subject (TDP): Natural person who is an insured or dependent under an individual or corporate Policy, whose Personal Data is subject to Processing, including those persons who have submitted an application for Medical Assistance insurance and did not complete the purchase.

2.10. Processing: Any operation or set of operations performed on Personal Data, such as collection, storage, use or verification.

2.11. Transfer: A data transfer takes place when the Controller and/or Processor sends, transmits or shares Personal Data with a third party or a Processor located within or outside Ecuador.

 

3. Processing

For the development of its commercial activities and due to the nature of the service it provides, BMI, as Controller of the Processing of Personal Data, collects, stores, uses and verifies Personal Data of Clients and/or TDPs.

 

4. Purpose

Personal Data is processed by BMI for the following purposes:

4.1. Participation in different types of surveys through offline/online registrations or forms.

4.2. Completion of subscription applications or online services, or to facilitate requests for specific information that may be requested from us.

4.3. To inform you of important news concerning BMI.

4.4. To inform you about our new products or services, updates, technical support matters, events and special offers.

4.5. To promote products and services on our website.

4.6. To prevent and detect fraud or other illicit or prohibited activities.

4.7. To ensure the security and integrity of our Website.

4.8. As part of an ongoing sales process.

4.9. To form part of automated means such as communication protocols.

4.10. To carry out analyses and evaluations of our business, as well as to analyze strategies for Client retention.

4.11. For the management and analysis of claim reimbursements.

4.12. To grant the Outpatient and/or Hospital Credit benefit.

4.13. For the provision of services by BMI.

4.14. To carry out due diligence procedures, where applicable, including the Policy known as “Know Your Customer”, in order to comply with the Ley de Prevención de Lavado de Activos y del Financiamiento de Delitos (Law on the Prevention of Money Laundering and the Financing of Crimes) or any international law or instrument to prevent or prosecute conduct arising from illicit acts.

4.15. To carry out the risk analysis and the calculation of the value of the insurable interest in Life or Personal Accident Policies, where applicable, or for the analysis of any type of risk within the lines of insurance approved for BMI.

4.16. To analyze whether the reinstatement/rehabilitation of the Life and/or Personal Accident Policy, or the restoration of validity of Medical Assistance Policies, is appropriate, where applicable, or in the case of contracts related to BMI's line of business or as may be relevant.

 

5. Rights of Personal Data Subjects

Clients and/or TDPs whose Personal Data is processed by BMI have the following rights, which they may exercise at any time:

5.1. To access and learn, free of charge, the Personal Data that BMI is processing.

5.2. To be informed by BMI, upon request, of the use it has made of their Personal Data.

5.3. To request that BMI delete their Personal Data, except for their medical information, since it relates to their Medical Record, and any information that by legal provision cannot be deleted, such as information related to the Ley de Prevención de Lavado de Activos y del Financiamiento de Delitos. However, the request to delete the information and the revocation of the authorization shall not apply when the TDP has a legal or contractual duty to remain in the Database and/or Files by virtue of which their data was collected.

5.4. To request the updating or rectification of their Personal Data, except for data related to health or information related to the prevention of money laundering and the financing of crimes. BMI may request additional information from the TDP to support the need to update or rectify.

 

6. Authorization

As a result of the contractual relationship it has with each Client, or through the acceptance of the conditions set forth in the Applications for Medical Assistance, Life, Personal Accident or any other insurance application related to BMI's line of business, BMI is authorized to process their Personal Data. The authorization is granted through various instruments, such as:

6.1. The Application for Medical Assistance, Life or Personal Accident Insurance.

6.2. The Medical Assistance, Life or Personal Accident Insurance Policy.

6.3. Through unequivocal conduct that allows it to be concluded that authorization was granted, for example, through express acceptance of the Terms and Conditions of an activity and/or use of a Website and/or electronic application in which the Privacy Notice is communicated and participants' authorization is required for the Processing of their Personal Data, whether given directly by the Client/TDP or by a third party representing them, such as an insurance producer advisor or someone related to the latter.

 

7. Special provisions for the processing of health data

  • Health data is considered to be data containing information on diagnoses, treatments, medical status, personal and family medical history, and any information that serves to identify the prior or current health condition of the TDP or the Client. Health data may include data related to racial or ethnic origin and sex life, which, in general, is not normally requested but may be required because the services are health-related.

  • In this case, since BMI handles medical information, the Client/TDP acknowledges that the Personal Data will be used and analyzed in the course of the contractual relationship between the parties.

     

8. Special provisions for the processing of personal data of children and adolescents

The Client/TDP acknowledges that BMI will process Personal Data of children and adolescents related to their health condition due to the type of service it provides; this does not affect the right to privacy, since BMI uses Personal Data consistently with the service it provides or the evaluation of an application. The Client acknowledges having parental authority, being the legal representative of the TDP or being authorized by the legal representative, and is therefore entitled to share and authorize the processing of the TDP's personal data in accordance with the provisions of this Privacy Policy.

 

9. Special provisions for the processing of personal data related to the prevention of money laundering and the financing of crimes

The Client/TDP acknowledges that BMI will process Personal Data related to compliance with the Ley Orgánica de Prevención de Lavado de Activos y Financiamiento de Delitos (Organic Law on the Prevention of Money Laundering and the Financing of Crimes) or any international law or instrument to prevent or prosecute conduct arising from illicit acts, and that it is authorized to submit information to the competent authority.

 

10. Procedure for handling and responding to requests and inquiries

  • The Subjects of the Personal Data being collected, stored and used by BMI may at any time exercise their rights to access, update and rectify their own information or that of those they represent. In compliance with the law, the medical record is unique and cannot be altered or modified; therefore, it is prohibited to modify in any way the Personal Data related to medical information, since such data is related to the TDP's medical record.
  • In the case of updating or rectifying Personal Data, BMI reserves the right to request additional documents that corroborate or confirm the inaccuracy of the data to be updated or corrected.
  • To exercise the rights established in this clause, the TDP must send a communication to the email address postventa@bmi.com.ec, setting out their request. In the electronic communication, the TDP must identify themselves with their first name, last name, identification document, Policy number and the email address at which they can receive the response. BMI will respond to the inquiry within 2 business days of receipt of the email. If a written request is submitted, it will be received Monday through Friday from 8:30 a.m. to 5:30 p.m. at the following addresses:
    • Av. De Los Shyris y Suecia, edificio Renazzo Plaza, piso 12,
    • Av. Jaime Roldós Aguilera, Parq. Empresarial Colón Edif. Corporativo 2, Piso 1
    • Autopista Cuenca Azogues Edificio Cardeca Business Center
  • If you have any questions or inquiries regarding the processing, retention and handling of your personal data, please contact: postventa@bmi.com.ec.

  • If BMI changes its registered address, this will be communicated.

     

11. Anonymization

BMI declares that, for greater security, it may adopt measures to anonymize the personal data of TDPs. Through the anonymization process, the data cannot be linked to a natural person or TDP; anonymized data is not Personal Data. All anonymized personal data shall belong to BMI, which may use, commercialize or transfer it as it deems necessary, and shall not require any authorization or permission from the TDP.

 

12. Security of Personal Data

In strict application of the principle of security in the Processing of Personal Data, BMI will implement the technical and organizational measures necessary to guarantee the confidentiality, integrity and security of health data and records, preventing their adulteration, loss, consultation, use or unauthorized or fraudulent access.

BMI's obligation and responsibility is limited to implementing the appropriate security measures in accordance with the available state of the art and within technical and economic limitations. BMI will adopt all appropriate security measures; the Client/TDP accepts and acknowledges that these security measures are not infallible and that technical failures or unauthorized access may occur.

BMI shall not be liable for unauthorized access to or alteration of information as a result of technical failures or unauthorized access by third parties who have breached the security systems adopted by BMI.

BMI will require service providers to adopt adequate measures for the protection of the Personal Data in relation to which such providers act as Processors.

 

13. Transfer, transmission and disclosure of Personal Data

  • The TDP accepts and acknowledges that BMI may transfer their personal data to related third parties or providers, located within the national territory or in other countries, to carry out the processing of their personal data. The TDP authorizes BMI to transfer data related to the nature of the service associated with medical benefits, financial services, additional benefits and audit processes.
  • The medical record and health status information are relevant for the diagnosis and treatment of illnesses, for the various health service providers or BMI advisors, who, for the purposes of this Policy, will act as Processors.
  • The TDP accepts and acknowledges that BMI may transfer their personal data to the corresponding administrative and judicial authorities for the resolution of administrative proceedings, contractual disputes or disputes related to the provision of health services, or in response to reasoned requests made by government entities. BMI shall not be responsible for the security and confidentiality of the data and information delivered to government entities.

  • The TDP acknowledges that BMI uses computer systems located in the cloud, or “cloud computing”, and the TDP acknowledges that the servers providing these services are located in other countries. The TDP accepts that their personal data may be hosted on servers located in other countries, and therefore expressly accepts the international transfer of the data, in particular all the sensitive data described in this Policy.

     

14. Effective date

This Privacy Policy shall be effective as of September 15, 2020. BMI reserves the right to update the Privacy Policy whenever it deems necessary. BMI will notify the TDP if future updates modify essential terms or rights of TDPs.