BMI Igualas Médicas Privacy Policy

1. Scope

This Privacy Policy shall apply to all Databases and/or Files containing Personal Data processed by BMI IGUALAS MÉDICAS DEL ECUADOR S.A. (hereinafter BMI), considered the controller of the Personal Data.

 

2. Definitions

2.1. Authorization: The prior, express and informed consent of the Personal Data Subject to carry out the Processing of Personal Data.

2.2. Privacy Notice: Written communication generated by BMI and addressed to the TDP for the Processing of their Personal Data, by which they are informed of the existence of the information Privacy Policies that will apply to them, how to access them and the purposes of the Processing intended for the Personal Data.

2.3. Database: Organized set of Personal Data subject to Processing.

2.4. Clients: Natural or legal person that has a contractual relationship with BMI and/or has submitted an application to BMI to enter into a contract. Clients shall also be understood to include those natural persons listed as members or dependents under an individual or corporate contract.

2.5. Personal Data: Any information linked or that may be associated with one or more identified or identifiable natural persons, including medical information on diagnosis, treatments or health condition, as well as personal information, which includes asset and financial information.

2.6. Processor: Natural or legal person, public or private, that by itself or in association with others, carries out the Processing of Personal Data on behalf of BMI.

2.7. Controller: Natural or legal person, public or private, that by itself or in association with others, processes, safeguards or manages the Database and/or the Processing of the data for the purposes established in the contract.

2.8. Terms and Conditions: general framework setting out the conditions for participants in commercial or related activities.

2.9. Personal Data Subject (TDP): Natural person who is a member or dependent under an individual or corporate contract, whose Personal Data is subject to Processing, including those persons who have submitted an application for prepaid comprehensive health care services and did not complete their enrollment.

2.10. Processing: Any operation or set of operations on Personal Data, such as collection, storage, use or verification.

2.11. Transfer: A data transfer takes place when the Controller and/or Processor sends, transmits or shares Personal Data with a third party, or a Processor is located inside or outside Ecuador.

 

3. Processing

For the development of its commercial activities and due to the nature of the service it provides, BMI, as Controller of Personal Data, collects, stores, uses and verifies Personal Data of Clients and/or TDPs.

 

4. Purpose

Personal Data is processed by BMI for the following purposes:

4.1. Participation in different types of surveys through offline/online registrations or forms.

4.2. Completion of subscription applications, online services, or to facilitate requests for specific information that may be requested from us.

4.3. Informing you of important news concerning BMI.

4.4. Informing you about our new products or services, updates, technical support matters, events and special offers.

4.5. Promoting products and services on our website.

4.6. Preventing and detecting fraud or other illicit or prohibited activities.

4.7. Ensuring the security and integrity of our Website.

4.8. As part of an ongoing sales process.

4.9. To form part of automated means such as communication protocols.

4.10. To carry out analyses and evaluations of our business, as well as to analyze strategies for strengthening Client relationships.

4.11. For the management and analysis of claim reimbursements.

4.12. To grant the Outpatient and/or Hospital Credit benefit.

4.13. For the provision of services by BMI.

 

5. Rights of Personal Data Subjects

Clients and/or TDPs whose Personal Data is processed by BMI have the following rights, which they may exercise at any time:

5.1. To access and know, free of charge, their Personal Data being processed by BMI.

5.2. To be informed by BMI, upon request, of the use it has made of their Personal Data.

5.3. To request that BMI delete their Personal Data, except their medical information, since it relates to their Medical Record. However, the request to delete the information and the revocation of the authorization shall not proceed when the TDP has a legal or contractual duty to remain in the Database and/or Files by virtue of which their data was collected.

5.4. To request the updating or rectification of their Personal Data, except data related to health data. BMI may request additional information from the TDP supporting the need to update or rectify.

 

6. Authorization

As a result of the contractual relationship it has with each Client, or through the acceptance of the conditions established in the Applications for Prepaid Comprehensive Health Care Services, BMI is authorized to process their Personal Data. The authorization is granted through various instruments, such as:

6.1. The Application for Prepaid Comprehensive Health Care Services.

6.2. The Prepaid Comprehensive Health Care Services Contract.

6.3. Through unequivocal conduct from which it can be concluded that authorization was granted, for example, through express acceptance of the Terms and Conditions of an activity and/or the use of a Website and/or electronic application, in which the Privacy Notice is communicated and the participants' authorization for the Processing of their Personal Data is required, whether given directly by the Client/TDP or by a third party representing them, such as an insurance producer advisor or a person related to the latter.

 

7. Special provisions for the processing of health data

  • Health data is considered to be data containing information on diagnoses, treatments, medical status, personal and family medical history, and any information that serves to identify the previous or current health condition of the TDP or the Client. Health data may include data related to racial or ethnic origin and sex life, which is generally not requested but may be required because the services are health-related.
  • In this case, since BMI handles medical information, the Client/TDP acknowledges that the Personal Data will be used and analyzed in the course of the contractual relationship between the parties.

 

8. Special provisions for the processing of personal data of children and adolescents

The Client/TDP acknowledges that, due to the type of service it provides, BMI will process Personal Data of children and adolescents related to their health condition; this does not affect the right to privacy, since BMI uses the Personal Data consistently with the service it provides or the evaluation of an application. The Client acknowledges having parental authority or being the legal representative of the TDP, or being authorized by the legal representative, and is therefore entitled to share and authorize the processing of the TDP's personal data in accordance with this Privacy Policy.

 

9. Procedure for handling and responding to requests and inquiries

  • The Subjects of the Personal Data being collected, stored and used by BMI may at any time exercise their rights to access, update and rectify their own information or that of those they represent. In compliance with the law, the medical record is unique and cannot be altered or modified; therefore, it is prohibited to modify in any way the Personal Data related to medical information, since such data relates to the TDP's medical record.
  • In the case of updating or rectifying Personal Data, BMI reserves the right to request additional documents corroborating or confirming the inaccuracy of the data to be updated or corrected.
  • To exercise the rights established in this clause, the TDP must send a communication to the email address postventa@bmi.com.ec, setting out their request. In the electronic communication, the TDP must identify themselves with their first name, last name, identification document, contract number and the email address at which they can receive the response. BMI will respond to the inquiry within 2 business days of receipt of the email. Written requests will be received Monday to Friday from 8:30 a.m. to 5:30 p.m. at the following addresses:
    • Av. De Los Shyris y Suecia, edificio Renazzo Plaza, piso 12,
    • Av. Jaime Roldós Aguilera, Parq. Empresarial Colón Edif. Corporativo 2, Piso 1
    • Autopista Cuenca Azogues Edificio Cardeca Business Center
  • If you have any questions or inquiries regarding the processing, retention and handling of your personal data, please contact: postventa@bmi.com.ec.

  • Should BMI change its address, this will be communicated.

     

10. Anonymization

BMI declares that, for greater security, it may adopt measures to anonymize the personal data of TDPs. Through the anonymization process, the data cannot be linked to a natural person or TDP; anonymized data is not Personal Data. All anonymized personal data shall belong to BMI, which may use, commercialize or transfer it as it deems necessary, without requiring any authorization or permission from the TDP.

 

11. Security of Personal Data

In strict application of the principle of security in the Processing of Personal Data, BMI will implement the technical and organizational measures necessary to guarantee the confidentiality, integrity and security of health data and records, preventing their tampering, loss, consultation, use or unauthorized or fraudulent access.

BMI's obligation and responsibility is limited to implementing appropriate security measures in accordance with the available state of the art and within technical and economic limitations. BMI will adopt all appropriate security measures; the Client/TDP accepts and acknowledges that these security measures are not infallible and that technical failures or unauthorized access may occur.

BMI shall not be liable for unauthorized access to or alteration of information as a result of technical failures or unauthorized access by third parties who have breached the security systems adopted by BMI.

BMI will require service providers to adopt appropriate measures for the protection of the Personal Data in relation to which such providers act as Processors.

 

12. Transfer, transmission and disclosure of Personal Data

  • The TDP accepts and acknowledges that BMI may transfer their personal data to related third parties or providers, located within the national territory or in other countries, to process their personal data. The TDP authorizes BMI to transfer data related to the nature of the service associated with medical benefits, financial services, additional benefits and audit processes.
  • The medical record and health status information are relevant for the diagnosis and treatment of illnesses, and may therefore be transferred to the various health service providers or advisors of BMI, who, for the purposes of this Policy, will act as Processors.
  • The TDP accepts and acknowledges that BMI may transfer their personal data to the relevant administrative and judicial authorities for the resolution of administrative proceedings, contractual disputes or disputes related to the provision of health care, or in response to reasoned requests made by state entities. BMI shall not be responsible for the security and confidentiality of the data and information delivered to government entities.

  • The TDP acknowledges that BMI uses computer systems located in the cloud, or “cloud computing”, and that the servers providing these services are located in other countries. The TDP accepts that their personal data is hosted on servers located in other countries, and therefore expressly accepts the international transfer of the data, especially all the sensitive data described in this Policy.

     

13. Effective date

This Privacy Policy shall be effective as of September 15, 2020. BMI reserves the right to update the Privacy Policy whenever it deems necessary. BMI will notify the TDP if future updates modify essential terms or rights of TDPs.