VITALITY PRIVACY NOTICE
EFFECTIVE: 02 February 2022
The Vitality Group, LLC (“Vitality”; “We”; “Us”; “Our”) owns and operates the Beyond Health and Wellness mobile application (“Program”). The Program is made available to you through either your employer, your spouse’s employer, or another provider (“Program Provider”).
Vitality is committed to complying with laws that protect Personal Information (as defined below). The purpose of this Privacy Statement is to provide information about the collection, use and storage of your Personal Information.
By accessing or using the Program, you consent to the collection, receipt, use, disclosure and retention of your information as described in this Privacy Notice and accept the terms of this Privacy Notice and Our Terms of Use. If you wish to revoke such consent, please contact your Program Provider or authorized third parties. Please note that such revocation will make you ineligible to participate in the Program. Please redeem your rewards prior to withdrawing your consent.
This Privacy Notice applies to Personal Information (defined below) collected by Vitality whether online or offline.
You can request a copy of this Privacy Notice in English or your own language by e-mailing help@vitalitygroup.com
This Privacy Notice will address the following:
As part of your eligibility for the Program, your Program Provider will provide Vitality the information necessary to verify your identity on registration and thereafter for ongoing account management purposes. If you do not want Vitality to receive this information, please contact your Program Provider – this will however make you ineligible to participate in the Program.
By engaging with the Program, information linked to you and your interactions with the Program (e.g. your physical activity, reward earning events and redemption, and/or form submission) will be collected or created by Vitality. You can also choose to allow certain devices and mobile applications, such as Google Fit, to sync data to the Program – you can modify these permissions at any time through the settings menu of the Program. We will only have access to such data where you have allowed such access.
When you or your Program Provider grant authorization, Vitality may receive information about your participation with third-party service providers.
If you engage with Vitality on a social media platform, Vitality may respond or contact you through the applicable social media platform.
For the purposes of this Privacy Notice, Personal Information means any information relating to an identified or identifiable natural person.
The types of Personal Information, set out below, processed about you, will depend on the particular Program elected by your Program Provider and the activities in which you participate:
Vitality may receive the below Special Categories of Personal Information from your Program Provider or authorized third parties, or directly from you, depending on the particular Program you are using and the activities in which you participate:
Vitality receives the above, based on the consent you provided to your Program Provider or authorized third party/ies. If you wish to revoke such consent, please contact your Program Provider or authorized third parties. Please note that such revocation will make you ineligible to participate in the Program. Please redeem your rewards prior to withdrawing your consent.
In relation to Special Categories of Personal Information which you submit to Vitality on your own, Vitality will request your consent to process such information during the Program enrolment process. If you wish to revoke such consent, please refer to your rights in terms of section 13 to 21 below, as applicable. Please note that such revocation will make you ineligible to participate in the Program. Please redeem your rewards prior to withdrawing your consent.
Vitality acts as a Processor/ Operator/ equivalent under applicable law and signs a data protection addendum (“DPA”) with the Controller/ Responsible Party/ equivalent under applicable law, that is most often a Program Provider. This DPA, provides the legal basis for which Vitality may process Personal Information.
Where the jurisdiction in which you utilize the Program, has data protection laws which do not differentiate between processing roles, Vitality will process your Personal Information in accordance with the DPA as a service provider.
In addition to the above, in instances where Vitality will collect Personal Information from you directly We may rely on the legal basis of consent or the agreement you have entered into with your Program Provider.
In such instances:
Vitality will process the Personal Information and Special Categories of Personal Information set out in this Privacy Notice, in the United States of America, Canada, South Africa, Philippines and other countries where Vitality has entered into to the required agreements. Such Personal Information will be subject to foreign laws and may be disclosed to foreign authorities under such law. Where the GDPR applies, Vitality and the Program Provider have entered into the Standard Contractual Clauses, issued by the European Commission, to make provision for the applicable transfer. In terms of other jurisdictions which laws require consent or a DPA to be in place for the cross border transfer of Personal Information, Vitality relies on the consent you provide to your Program Provider and/or the DPA for the transfer.
Vitality will use the personal information that it collects about you to facilitate the Vitality Program. Vitality will only use your Personal Information in accordance with this Privacy Notice. For example Personal Information collected from a mobile application or device such as Google Fit, will only be used to facilitate the Vitality Program. Additional instances of use cases may include:
6.1 To administer and manage your account
6.2 To resolve any complaints or inquiries you may have
6.3 For management of any debts owed to Vitality, if applicable
6.4 To prevent, detect, and investigate fraud or security incidents
6.5 For company and management information purposes and internal analysis of products and services
6.6 To report to your Program Provider for your incentive administration
6.7 For training purposes – to improve your customer experience
6.8 To fulfill legal obligations
6.9 Creating Anonymized or Aggregated Data Sets
Vitality may also seek to use your Personal Information in a way not described above, such as in using a testimonial you have written on our website. Before using your Personal Information in this way, Vitality will first seek your voluntary and explicit consent.
Personal Information that you share through the Program is kept strictly confidential and fully secure. Your encrypted (encoded) Personal Information is protected using “Secure Socket Layers (SSL)”. We follow generally accepted industry standards to protect the Personal Information we receive, both during transmission and upon receipt. Personal Information collected by the Program, for example Personal Information received from Google Fit, will be stored securely in accordance with accepted industry standards.
No method of transmission over the Internet, or method of electronic storage, is 100% secure. Therefore, while we strive to use reasonable and commercially acceptable means to protect your Personal Information, we cannot guarantee absolute security.
Your Program Provider: Vitality may share with your Program Provider the minimum necessary information for them to administer your incentives, such as for the calculation of health plan premium discounts, health club dues subsidies, applicable taxation, reward redemption, or other arrangements for which such information is relevant.
Your Program Provider’s authorized Third-Party Wellness Service Providers: Your Program Provider may make additional incentives available to you that are provided by Third-Party Wellness Service Providers. In order to administer this benefit, your Program Provider may authorize Vitality to share your information to the extent necessary for the above third-party service provider to make its offering available to you.
Service Providers to Vitality: There are instances when Vitality may disclose your Personal Information, such as Personal Information collected from Google Fit, to our agents, third-party partners, affiliates and subsidiaries to enable them to perform functions on our behalf. These service providers are only permitted to share, store and/or use Personal Information for contracted business purposes and have been approved by your Program Provider. Additionally, We may share your Personal Information when We believe that such action is necessary to:
With your express authorization and consent, We may share your Personal Information for a specific purpose not provided above. Agreeing to the terms and conditions and this Privacy Notice is not your express authorization for such additional uses. When appropriate, while you are logged into the Program, you will be presented with a specific electronic authorization form on which you may or may not provide your consent. You may revoke such authorization at any time in terms of section 13 to 21 below, as applicable.
The Program, may contain links to other websites that are not owned or controlled by Us. If you choose to submit Personal Information while visiting these websites or using these mobile applications, please be aware your rights will be governed by the third parties’ privacy policies. We strongly encourage you to carefully read the privacy policies of any website or mobile application you visit or use. Vitality will indicate that you are leaving the Program with a pop-up or using the below external link icon:
Unless otherwise specified herein, Personal Information will only be retained for as long as is required for Us to administer the Program, subject to: legislative or regulatory retention periods; requirements by the Program Provider; or as required for Our legitimate business reasons – after which any Personal Information will be anonymized, archived or destroyed.
Vitality reserves the right to update this Privacy Notice from time to time. If We decide to change this Program’s Privacy Notice, We will post those changes to this Privacy Notice in the Program, which you should check periodically, and other places that We deem appropriate.
We will deliver rewards updates, status updates, or other informational emails to you via the email address you provide to your Program Provider. Push notifications and triggered communication may be sent to you through the Program. You may opt out of receiving these emails and/or push notifications at any time by adjusting the settings of your account in the Program.
Certain communications are necessary and cannot be turned off, these include: transactional emails; communications from our Customer Care team in response to queries initiated by you; or other important updates like security and fraud notices or change in services.
If you send a query to an email address listed within the Program or via a contact form provided within the Program, We will share your correspondence with a Vitality associate most capable of addressing your query. We will retain your communications in order to deal with your query. Ultimately, We will either discard your communication or, in some cases, archive it.
Email has become a standard communication tool. Unfortunately, by design standard Internet email is not secure. For that reason, please do not use unsecured email to communicate information to us that you may consider to be confidential.
Under the Australian Privacy Act No, 119 1988 you have certain rights to be informed, access and/or rectify Personal Information we have collected from you or received from your Program Provider or authorized third party, in order to provide the Program to you. If you wish to exercise the above right/s you can contact Vitality directly by using the link help@vitalitygroup.com or the details set out at the end of this Privacy Notice.
Under the General Personal Data Protection Law, (as amended by Law No. 13.853 of 8 July 2019) (LGPD) you have the following rights regarding your Personal Information collected by Vitality:
• The right to be informed
• The right of access
• The right to rectification
• The right to erasure
• The right to data portability
• The right to object or blocking
• The right not to be subject to automated decision making
In order to exercise rights enumerated above, please initiate your request with your Program Provider, as they are the Controller, and they will make this request to Vitality as their Processor. If you would like Vitality to support you in making this request, please contact Vitality directly by using the link help@vitalitygroup.com or the details set out at the end of this Privacy Notice.
In the first instance We ask that you notify your Program Provider and/or Us of any concerns you have about how we handle your Personal Information but if you are still unhappy you can contact the Brazilian Data Protection Authority, the details of which can be found using this link https: https://www.gov.br/anpd/pt-br
Please note that the following terms used in this Privacy Notice will have the corresponding meaning as set out in the LGPD:
• Personal Information shall mean Personal Data
Under Personal Information Protection and Electronic Documents Act (PIPEDA), You have certain rights to access, update, correct and withdraw Personal Information we have collected from you or received from your Program Provider or authorized third party, in order to provide the Program to you. If you wish to exercise the above right/s you can contact Vitality directly by using the link help@vitalitygroup.com or the details set out at the end of this Privacy Notice.
Please note that the following terms used in this Privacy Notice will have the corresponding meaning as set out in PIPEDA:
Under the General Data Protection Regulation or the UK’s Data Protection Act (collectively referred to as “GDPR”), you have the following rights regarding your Personal Information collected by Vitality:
• The right to be informed
• The right of access
• The right to rectification
• The right to erasure
• The right to restrict processing
• The right to data portability
• The right to object
• Rights in relation to automated decision making and profiling
In order to exercise rights enumerated above, please initiate your request with your Program Provider, as they are the Controller, and they will make this request to Vitality as their Processor. If you would like Vitality to support you in making this request, please contact Vitality directly by using the link help@vitalitygroup.com or the details set out at the end of this Privacy Notice.
Where you submit a request directly to Vitality, We will first contact your Program Provider to inform them of the request and then work with them to complete the request.
In the first instance We ask that you notify your Program Provider and/or Us of any concerns you have about how we handle your Personal Information but if you are still unhappy you can contact your applicable Supervisory Authority, the details of which can be found using this link https://ec.europa.eu/justice/article-29/structure/data-protection-authorities/index_en.htm
Please note that the following terms used in this Privacy Notice will have the corresponding meaning as set out in the GDPR:
• Personal Information shall mean Personal Data.
Under the Personal Data Protection Act, 2010 (PDPA), you have the following rights regarding your Personal Information collected by Vitality:
• The right of access
• The right to require a Controller to correct Personal Information
• The right to withdraw consent to the processing of Personal Information
• The right to prevent processing likely to cause damage or distress
In order to exercise rights enumerated above, please initiate your request with your Program Provider, as they are the Controller, and they will make this request to Vitality as their Processor. If you would like Vitality to support you in making this request, please contact Vitality directly by using the link help@vitalitygroup.com or the details set out at the end of this Privacy Notice.
In the first instance We ask that you notify your Program Provider and/or Us of any concerns you have about how we handle your Personal Information but if you are still unhappy you can contact your Department of Personal Data Protection, the details of which can be found using this link https://www.pdp.gov.my/jpdpv2/pusat-media/penerbitan/buletin-jpdp/
Please note that the following terms used in this Privacy Notice will have the corresponding meaning as set out in the PDPA:
• Personal Information shall mean Personal Data
• Controller shall mean Data User
Under Federal Law on the Protection of Personal Data held by Private Parties (and the Regulations Relating thereto), you have certain rights to access, rectification, cancellation or objection in relation to the Personal Information we have collected from you or received from your Program Provider or authorized third party, in order to provide the Program to you.
In order to exercise rights enumerated above, please initiate your request with your Program Provider, as they are the Responsible Party, and they will make this request to Vitality as their Processor. If you would like Vitality to support you in making this request, please contact Vitality directly by using the link help@vitalitygroup.com or the details set out at the end of this Privacy Notice.
Where you submit a request directly to Vitality, We will first contact your Program Provider to inform them of the request and then work with them to complete the request.
Please note that the following terms used in this Privacy Notice will have the corresponding meaning as set out in the above-mentioned Federal Law:
Under the Data Privacy Act of 2012 and the rules relating thereto, you have the following rights regarding your Personal Information collected by Vitality:
• The right to be informed
• The right of access
• The right to rectification
• The right to erasure
• The right to data portability
• The right to object
• Right not be subject to auto-mated decision making
In order to exercise rights enumerated above, please initiate your request with your Program Provider, as they are the Controller/ Personal Information Controller, and they will make this request to Vitality as their Processor/ Personal Information Processor. If you would like Vitality to support you in making this request, please contact Vitality directly by using the link help@vitalitygroup.com or the details set out at the end of this Privacy Notice.
Where you submit a request directly to Vitality, We will first contact your Program Provider to inform them of the request and then work with them to complete the request.
In the first instance We ask that you notify your Program Provider and/or Us of any concerns you have about how we handle your Personal Information but if you are still unhappy you can contact your National Privacy Commission, the details of which can be found using this link https://www.privacy.gov.ph/
Under the Personal Data Protection Act 2012 and the amendments and regulations relating thereto you have the following rights regarding your Personal Information collected by Vitality:
• The right to be informed
• The right of access
• The right to rectification
• The right to withdraw consent
In order to exercise rights enumerated above, please initiate your request with your Program Provider, as they are the Controller/ Organization, and they will make this request to Vitality as their Processor/ Data Intermediary. If you would like Vitality to support you in making this request, please contact Vitality directly by using the link help@vitalitygroup.com or the details set out at the end of this Privacy Notice.
Where you submit a request directly to Vitality, We will first contact your Program Provider to inform them of the request and then work with them to complete the request.
Please note that the following terms used in this Privacy Notice will have the corresponding meaning as set out in the Personal Data Protection Act:
• Personal Information shall mean Personal Data
Under the Protection of Personal Information Act, 2013 (“POPIA”) you have the following rights regarding your Personal Information collected by Vitality:
In order to exercise rights enumerated above, please initiate your request with your Program Provider, as they are the Controller/ Responsible Party, and they will make this request to Vitality as their Processor/ Operator. If you would like Vitality to support you in making this request, please contact Vitality directly by using the link help@vitalitygroup.com or the details set out at the end of this Privacy Notice.
Where you submit a request directly to Vitality, We will first contact your Program Provider to inform them of the request and then work with them to complete the request.
In the first instance We ask that you notify your Program Provider and/or Us of any concerns you have about how we handle your Personal Information but if you are still unhappy you can contact the Information Regulator (South Africa) complaints.IR@justice.gov.za or inforeg@justice.gov.za
Individuals with inquiries or complaints regarding the privacy of their Personal Information at Vitality or this Privacy Notice should first contact The Vitality Group at:
The Vitality Group, LLC
Attn: Data Privacy Officer
200 W. Monroe St., Suite 1900
Chicago, IL 60606
US_Privacy@vitalitygroup.com
