Controllership

In the context of this Notice, IMG acts as a data processor for the Personal Data we process.

Categories of Personal Data

We may collect, use, store, disclose, and transfer (collectively, “process”) the following categories of Personal Data:

• Name;
• Contact information such as email, mailing, or alternate address, telephone, mobile, fax number;
• Gender;
• Marital status;
• Citizenship:
• Date of birth:
• Physical attributes;
• Activity records such as exercise routines;
• Current or former medical condition, treatment and health status including other factors affecting insurability;
• Information about or related to any claim you make or other use of our products, records of interactions, communications and correspondence between us;
• Relationship to the policy holder, insured, or claimant; ;
• Employment information and history;
• Affiliated company or sponsoring organization;
• Insurance carrier;
• Travel information, including travel dates, destinations and itinerary details;
• Financial information such as payment card number, bank account information and billing address;
• Government issued ID’s such as social security number, driver’s license or passport;
• Telephone recordings of calls to our representatives and call centers;
• Unique identifiers such as certificate, group, insured or member ID, producer, and Individual Taxpayer Identification Number;
• Information about your contacts such as your beneficiaries;
• Your medical practitioner’s name, address, and contact information; and
• Any other information provided to us by you or on your behalf.

Purpose of Processing

IMG collects many kinds of information to operate effectively and provide its constituents with the best products, services and experiences we can. We process this information for the following purposes:

• To assist in the fulfillment of the insurance and services that customers purchase or processing the insurance claims or other requests for services customers submit.
• To communicate with you.
• To operate, subject to the appropriate processes and controls, to improve and personalize the products and services we offer and to maintain and improve the quality, security and integrity of our products and services.
• To prevent, investigate or identify or take other actions with regard to suspected or actual fraudulent or illegal activity or activities that violate our policies.
• To comply with applicable laws, regulations, legal processes, industry standards and our company policies.

When the purposes of processing are satisfied, we will delete such Personal Data in accordance with our Data Retention Policies.

Data Subject Rights

IMG acknowledges the right of EU and UK individuals to access their Personal Data pursuant to the Data Privacy Framework and will grant individuals reasonable access to personal information received pursuant to the Data Privacy Framework Principles. In addition, IMG will take reasonable steps to permit individuals to correct, amend, or delete such information that is demonstrated to be inaccurate or processed in violation of the Principles. An individual may request to access their information, or otherwise correct, amend, or delete their information in line with the EU-U.S. (and its UK Extension) Data Privacy Framework Principles by contacting us using the contact information listed below.

Sharing Personal Data with Third Parties

We may share Personal Data with third parties who provide services on our behalf to help with our business activities. These third parties are authorized to process Personal Data on behalf of IMG only as necessary to provide services to us. These third parties include those:

• Adjudicating and managing the claims process
• Processing payments to healthcare providers
• Providing customer service
• Sending marketing communications (subject only to your express consent)
• Providing IT systems and infrastructure
• Managing our IT systems and infrastructure

Our service providers may be located outside of the United States; however, we will either obtain your explicit consent to transfer your Personal Data to such third parties, or we will require those third parties to maintain at least the same level of confidentiality that we maintain for such Personal Data ourselves. IMG remains liable for the protection of your Personal Data that we transfer to our service providers, except to the extent that we are not responsible for the event giving rise to any unauthorized or improper processing.

Other Disclosure of Your Personal Data

We may disclose your Personal Data (i) to the extent required by law or if we have a good-faith belief that such disclosure is necessary in order to comply with official investigations or legal proceedings initiated by governmental and/or law enforcement officials, or private parties, including but not limited to: in response to subpoenas, search warrants, or court orders, or (ii) if we sell or transfer all or a portion of our company’s business interests, assets, or both, or in connection with a corporate merger, consolidation, restructuring, or other company change, or (iii) to our subsidiaries or affiliates only if necessary for business and operational purposes as described above.

We reserve the right to use, transfer, sell, and share aggregated, anonymous data, which does not include any Personal Data, about our insureds, clients, and customers as a group for any legal business purpose, such as analyzing usage trends and seeking compatible advertisers, sponsors, clients, and customers.

If we must disclose your Personal Data to comply with official investigations or legal proceedings initiated by governmental and/or law enforcement officials, we may not be able to ensure that such recipients of your Personal Data will maintain the privacy or security of your Personal Data.

Access & Review

If you are a data subject about whom we store Personal Data, you may have a right to request access to, and the opportunity to update, correct, or delete, such Personal Data. To submit such requests or raise any other questions, please contact us using the contact information listed below.

Choice

You may opt out of having your Personal Data shared with third parties by us, and you may revoke your consent that you have previously provided for us to share your Personal Data with third parties, except as required by law. You may also have the right to opt out if your Personal Data is used for any purpose that is materially different from the purpose(s) for which it was originally collected or which you originally authorized. To do this, you may send your request to us using the contact information listed below.

Changes to this Privacy Notice

If we make any material change to this Notice, we will post the revised Notice to this web page and update the “Effective Date” above to reflect the date on which the new Notice became effective. We encourage you to periodically review the Notice.

Contact Us

If you have any questions about this Notice or our processing of your Personal Data, please write to our Data Protection Officer by email at DPO@imglobal.com. You may also contact us by phone at 1-800-628-4664, and by mail at:

International Medical Group, Inc.
9200 Keystone Crossing
Suite 800
Indianapolis, IN USA 46240

Please allow up to four weeks for us to reply.

Dispute Resolution

Where a privacy complaint or dispute cannot be resolved through IMG’s internal processes, IMG has agreed to participate in the VeraSafe Data Privacy Framework Procedure. Subject to the terms of the VeraSafe Data Privacy Framework Dispute Resolution Procedure, VeraSafe will provide appropriate recourse free of charge to you. To file a complaint with VeraSafe and participate in the VeraSafe Data Privacy Framework Dispute Resolution Procedure, please submit the required information here: https://www.verasafe.com/public-resources/dispute-resolution/submit-dispute/

If your dispute or complaint cannot be resolved by us, nor through the dispute resolution program established by VeraSafe, you may have the right to require that we enter into binding arbitration with you pursuant to the Data Privacy Framework’s Recourse, Enforcement and Liability Principle and Annex I of the Data Privacy Framework.

In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF, IMG commits to cooperate and comply respectively with the advice of the panel established by the EU data protection authorities (DPAs) and the UK Information Commissioner’s Office (ICO) with regard to unresolved complaints concerning our handling of human resources data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF in the context of the employment relationship.

Regulatory Oversight

IMG is subject to the investigatory and enforcement powers of the United States Federal Trade Commission.