Logo Christelijke Mutaliteit

CM Insurance Privacy Statement

MOB Insurance CM-Vlaanderen (hereinafter: CM Insurance) respects your privacy in accordance with applicable legislation, regardless of whether you are a member or not, a healthcare provider, interested in working at CM Insurance or a visitor to the website www.cm .be/insurance.

CM - jouw gezondheidsfonds

CM Insurance strives to inform you in a transparent and clear manner with its privacy statement about:

  • What is processing of personal data?
  • For what purposes does CM Insurance process your personal data?
  • Which personal data does CM Insurance process about you and how?
  • What are your rights regarding your personal data and how can you exercise them?
  • How can you contact us?

What is a processing of personal data?

  • Personal data
    All information about an identified or identifiable natural person ('the data subject') (i.e. not a company). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, psychological, economic, cultural or social identity of that natural person.
     
  • Processing
    An operation or set of operations performed on personal data or on sets of personal data, whether or not carried out by automated means, such as collecting, recording, organizing, structuring, storing, updating or modifying, retrieving, consulting, using, providing by means forwarding, disseminating or otherwise making available, aligning or combining, blocking, erasing or destroying data.
     
  • Controller
    A natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
     
  • Processor
    A natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

Who processes your data?

Your personal data is processed by MOB Verzekeringen CM-Vlaanderen, hereinafter CM-verzekeringen, with registered office Haachtsesteenweg 579, 1031 Schaarbeek, Belgium, with company number 851.601.503.

For what purposes is CM Insurance allowed to process your personal data?

Processing your personal data is necessary:

  • to identify, contact and correctly advise you;
  • for managing your insurance.

CM Insurance offers a customized insurance package to CM members. CM Insurance must be able to collect and process certain personal data for this:

  • to assess whether you meet the conditions for taking out the insurance policies offered by CM Insurance;
  • to be able to offer and manage the insurance policies, if necessary with the help of CM insurance processors;
  • to inform you proactively or otherwise about our insurance policies and to pay you the benefits to which you are entitled;
  • to manage your contacts with our services through any channel used: face to face, telephone, SMS, e-mail, chat, website, letter;
  • for the proper management and optimization of our insurance policies, through audits, surveys, studies, scientific, statistical or historical investigations and through security and protection measures for persons, goods and data;
  • to optimize our services;
  • for compliance with our legal obligations as an insurance company vis-à-vis the supervisory authorities (Sickness Fund Control Service, National Bank of Belgium, etc.).

What are the legal provisions for the processing of your data?

For the management of its optional insurance policies, CM Insurance processes the data of its policyholders on the basis of the following articles in the General Data Protection Regulation.

  • Article 6.1. a: consent.
  • Article 6.1. c: comply with the legal obligations applicable to CM insurance.
  • Article 6.1. f: legitimate interests.
  • Article 9.2. a: explicit consent for health data.
  • Article 9.2. f: the processing is necessary for the establishment, exercise or defense of legal claims.
  • Article 9.2. j and Article 89: archiving, scientific or historical research or statistics.

To this end, CM Insurance bases itself on, among other things, the following specific laws and implementation decisions.

  • Act of 6 August 1990 on health insurance funds and national associations of health insurance funds and its implementing decrees.
  • Act of 26 April 2010 containing various provisions regarding the organization of supplementary health insurance.
  • Act of 4 April 2014 on insurance and its implementation decrees.
  • Act of 13 March 2016 on the status and supervision of insurance or reinsurance companies and its implementing decrees and regulations.

How long does CM Insurance store your data?

CM Insurance will store and use your personal data to the extent necessary for compliance with legal obligations and within the context of our activities. In certain cases, CM Insurance is bound by statutory retention periods for storing certain personal data. If the law does not prescribe a period, the personal data may be retained for a period that CM Insurance itself deems necessary for the efficient execution of the insurance contract.

For what purposes is CM Insurance allowed to process your personal data in the context of promotion, telephone conversations, camera surveillance and others?

  • Promotion, direct marketing, membership recruitment
    CM Insurance collects and processes your personal data to the extent that you have given your permission directly to CM Insurance or to a third party (address file brokers, etc.): in connection with a competition, a trade fair, in the context of an App, registration on a newsletter, activity…
    CM Insurance processes your data for these purposes for a maximum of three years for non-members, from receipt of 'opt-in' and for ex-members from change.
     
  • Exchange with other entities or third parties subject to your consent
    To the extent that you have given your permission for this, CM Insurance exchanges data with, for example, the National Association of Christian Mutualities and the MOB Services and Operations. This is to ensure that your file is processed more smoothly or for other purposes for which you have given your consent (participation in surveys, etc.).
     

  • Recording of chat, video and telephone conversations
    In some cases, CM Insurance can listen to and record the information through its telephone, video or chat conversations. This is to improve our services or in the context of providing evidence in the event of a dispute. You will always be informed about this in advance by a recorded message.
    The retention period for telephone conversations is:

    • 3 months for training and coaching of employees and improvement of services;
    • 18 months in the context of complaints.

    The retention period for chat conversations is:

    • 3 months for training and coaching of employees and improvement of services;
    • 24 months in the context of complaints.
  • Camera surveillance
    CM Insurance may use cameras in and around the offices and buildings where it operates. When it comes to surveillance cameras, CM Insurance respects the legal rules.
    The retention period for image recordings by surveillance cameras is:
    • maximum one year;
    • exception: this period can be extended if it appears that the images can be useful and have some evidentiary value for, for example, a crime.
  • Recruitment of new employees
    For the recruitment of new employees, CM Insurance calls on the HR departments (depending on the place of employment) of the National Association of Christian Mutualities (LCM) and CM Flanders respectively. There is a separate privacy policy for this.

Which personal data does CM-verzekeringen process about you?

Depending on the data you provide and the various objectives, CM Insurance processes the following categories depending on the type of people involved.

  • Ordinary personal data
    • Identification data: name, first name, address, telephone number, e-mail address, etc.
    • Electronic identification data: IP addresses, cookies, connection times, etc.
    • Personal characteristics: age, gender, date of birth, place of birth, marital status, nationality.
    • Family composition.
    • Financial details: account number, payments, etc.
    • Physical data: size, weight…
    • Psychic data: personality, character…
    • Lifestyle: tobacco, alcohol consumption, travelling, etc.
    • Leisure activities and interests.
    • Memberships.
    • Consumption habits.
    • Home features.
    • Education and training.
    • Profession and employment.
    • Image recordings: camera surveillance, photos, videos.
    • Sound recording: call centers.
  • Special personal data
    • Data from the National Register and the national register number of CM members: surname, first name, official principal residence, date of birth, date and place of death, gender, marital status, nationality, family composition.
    • Social data: data from the Crossroads Bank for Social Security or that are necessary for the implementation of social security: CM connection, insurability, bank account number for reimbursements, etc.
    • Personal data relating to health is data that provides information about a person's health status. Medical reports and diagnoses, hospital data, degree of need for care, reimbursement of health care services, disability, pregnancy, medicines, genetic data ...
    • In the context of disputes, CM insurance will also process criminal and administrative convictions and criminal offenses: recoveries of health care and benefits caused by a liable third party, fraud.
    • In the context of scientific research, CM-verzekeringen can indirectly derive sensitive data such as race, ethnic origin, political opinions, religious or philosophical beliefs, sexual behavior or sexual orientation from the data it processes.

From whom or from what source does CM Insurance receive information about you?

This mainly concerns data that comes from:

  • from yourself, your legal representative or someone who has received a mandate or your approval for this;
  • from the healthcare providers (hospitals, doctors, nurses, etc.) that you have consulted, including via the third-party payment scheme;
  • from the National Association of Christian Mutualities (LCM) and from your health insurance fund:
    • because you must be a CM member to join CM insurance;
    • if you have given CM insurance and your health insurance fund permission for this (e.g. data from compulsory health insurance).

Which employees process your personal data?

Your personal data is processed carefully and confidentially by the authorized employees to perform their tasks in the context of the described activities. The employees are bound by professional secrecy and must comply with the duty of discretion. This is imposed legally (Crossroads Bank Act, National Register Act, Article 458 of the Criminal Code, Labor Code) and deontologically. In addition, CM Insurance requires its employees to sign a confidentiality agreement.

Certain data processing takes place in a fully automated manner without the intervention of an employee (e.g. calculation of the insurance premium due, pricing of reimbursements).

To whom does CM Insurance pass on your personal data?

Your personal data may be passed on to:

  • yourself, your legal representative (administrator, mediator, etc.), your representative (professional counselor, lawyer, etc.) or someone who has received a mandate or your agreement for this, directly or through the intervention of the healthcare professional of your choice;
  • an authorized third party (person, institution, government) solely on the basis of a law or contract;
  • your healthcare providers (hospitals, doctors, nurses, etc.) at your request or with your permission;
  • LCM or your health insurance fund insofar as you have given permission for this to CM insurance, for example if you are still entitled to an additional reimbursement via the 'Services and Activities' of your health insurance fund;
  • the Inspection Service of the Health Insurance Funds in the context of its statutory audit tasks;
  • our auditors who are bound by a duty of confidentiality;
  • counterparties, their lawyers, bailiffs, experts and to the judiciary in the event of disputes;
  • your creditors and their bailiffs in the context of an enforcement procedure (seizure, transfer, etc.);
  • our processors:
    • the National Association of Christian Mutualities;
    • CM Vlaanderen (which acts as an insurance intermediary for CM insurance) with which you are affiliated or which is contacted to handle your file;
    • Doccle as a digital platform mainly for the storage of documents: with your permission (Doccle account and activation CM insurance link) you can also consult your documents and use the functionalities of Doccle;
    • ICT processors;
    • mailing companies;
    • our lawyers and bailiffs, experts.

In what other situations can CM Insurance process your data?

  • Visit the CM insurance website ( www.cm.be/verzekeringen )
    If a form has to be completed on the website, the data communicated will be processed depending on the context-specific purposes for which it was requested (e.g. information request).
    What CM-verzekeringen processes and the user does not see (e.g. your IP address, browser type, operating system of your computer and the number of visits and pages visited): see cookie policy .
  • I want to work for CM insurance
    See separate privacy statement.

When can your data be transferred outside the European Economic Area (EEA)?

Your data can be sent outside the EEA (= European Union, Norway, Liechtenstein and Iceland) if:

  • this is necessary for the implementation of measures that must be taken before concluding the contract and at your request;
  • this is necessary for your vital interests;
  • this is necessary in your interest to conclude a contract with a third party or to execute a contract concluded or yet to be concluded with a third party;
  • this is possible under a processing agreement that contains the appropriate contractual clauses;
  • you have expressly consented to this.

How is your data secured?

  • We take appropriate measures to ensure the security, integrity and availability of your data, taking into account the state of the art, the scope and context of the processing purposes and the type of personal data.
  • CM Insurance takes appropriate physical, administrative, organizational and technical security measures to protect your personal data against loss, unauthorized access, unauthorized use and unauthorized disclosure.
  • CM Insurance contractually imposes the same security measures on its processors.

What are your rights with regard to personal data?

The data subject has certain rights with regard to his personal data, insofar as these do not conflict with legal obligations.

  • Right of access
    As a data subject, you have the right to inspect the data relating to you that is processed by CM Insurance. If you request this, a copy of your personal data can be provided.
    You can request a copy of your personal data to the extent that this does not infringe the rights and freedoms of others.
     
  • Right to rectification or amendment of your data
    You can request at any time to correct incorrect data or to complete your data.
    To adjust your data regarding your marital status, please contact the population department of your municipality in the first place. However, CM and your health insurance fund (which processes your administrative data and passes it on to CM insurance) cannot change the data from the national register, which is the authentic source of social security.
    Please remember to inform us as soon as possible of any change in your situation.
     
  • Withdraw your consent
    If the processing of your personal data is based on your consent, you have the right to withdraw your consent at any time without providing a reason. Withdrawing your consent does not change the validity of the processing that took place before that withdrawal.
    If you withdraw your consent for the processing of:
    • your health data is necessary for the execution of the insurance agreement, CM Insurance cannot execute the agreement and submitted costs are not eligible for any claims settlement by the company.
    • your health data from the mandatory insurance for medical care and benefits that we request, for example, from your health insurance fund or LCM for correct payment of the hospitalization guarantee and automatic payment of the allowances in the context of outpatient care, you will provide all supporting documents in connection with a claim must transfer this to CM insurance yourself. As a result, processing must be carried out completely manually and you may receive certain benefits to which you are entitled late.
    • your details from the insurance file that CM Insurance passes on to your health insurance fund. When you may be entitled to additional reimbursements via 'Services and Benefits', you will have to transfer all supporting documents for these additional reimbursements to your health insurance fund yourself. As a result, processing must be carried out completely manually and you may receive certain refunds to which you are entitled late.
  • Automated individual decision-making (profiling)
    You have the right not to be subject solely to automated decision-making, including profiling. After all, some data processing is completely automated without the intervention of the employee.
    If you do not agree with the course of a fully automated process, you can contact CM Insurance. You can request intervention from a CM insurance employee or let us know why you dispute this.
     
  • Right to object
    If you do not agree with the way CM Insurance processes certain data, you can object to this.
    • Without reason, in case of opposition to treatment for direct marketing and prospecting purposes.
    • If your data is processed in the context of a task carried out in the public interest, you must provide reasons related to your specific situation. However, CM Insurance may still process this data if there are compelling legitimate reasons for the processing that take precedence over your interests or the exercise of a legal claim.
    • If your data is processed for scientific or historical research purposes or for statistical purposes, you can object on grounds relating to your particular situation, unless the processing is necessary to fulfill a task carried out for reasons of public interest.
       
  • Right to erasure (right to be forgotten)
    You have the right to delete your personal data if it appears that CM Insurance is processing this data unlawfully:
    • if the data is no longer necessary for the purposes of the treatment;
    • if you have withdrawn your consent and there is no other legal basis for this treatment;
    • if your objection to the processing is well-founded;
    • if the treatment is illegal;
    • if erasure is required by law;
    • if the data relates to a child under the age of 16 and is collected via an application or website (Information Society Service).

  • Right to restriction of processing
    You can limit the use of your personal data:

    • until the time to check the accuracy of the data you dispute;
    • if you object to the illegal deletion of data processed by CM Insurance;
    • if you object to the deletion of data that CM-verzekeringen no longer needs, but which are necessary to establish, exercise or defend a right in court;
    • until the time to check whether the legitimate reasons for CM insurance override yours in case you oppose the treatment of this data by relying on your specific situation.

    CM Insurance will then have to limit the processing of such personal data to their storage. Any other processing is permitted with your consent, or for the establishment, exercise or defense of a right in legal proceedings or to protect a third party, or for important reasons of public interest. If this is the case, CM Insurance will inform you before this restrictive treatment is lifted.

  • Right to data portability
    You have the right to have the personal data that you have provided to CM Insurance transferred directly to you or to a third party. This is possible insofar as it is not limited by privacy legislation or other legal rules. However, this right can only be exercised if your data has been processed solely on the basis of your consent or a contract, and if this processing is done using automated processes.
    In the event of a change or transfer to another insurer, CM Insurance will pass on the start date and end date of your CM insurance to your new insurer so that you can (if applicable) enjoy a shorter waiting period or shorter period of pre-existence.

How can you exercise your rights?

If you wish to exercise any of the above privacy rights, you can always contact us .

Always be as specific as possible if you want to exercise your rights. Only in this way can CM Insurance handle your question specifically and correctly. To ensure that the data subject wishes to exercise his own privacy rights, CM Insurance may request a copy of the identity card for identification purposes.

How can you contact us or file a complaint?

  • General
    You can always contact us with a question, comment or request to exercise your rights:
    via the online contact form;
    • via ' My CM ' for the rectification of member data;
    • by letter to MOB Verzekeringen CM-Vlaanderen, Haachtsesteenweg 579, 1031 Schaarbeek, Belgium;
    • by telephone to the CM contact center or the CM insurance contact center (078 151 151);
    • via an appointment at CM;
    • just visit your CM consultant .
       
  • Data protection officer
    If you feel that the above channels cannot help you, you can also contact our data protection officer. This can be either:
    • by sending a letter to MOB Verzekeringen CM-Vlaanderen, attn. the data protection officer, Haachtsesteenweg 579, 1031 Schaarbeek, Belgium;
    • by email to [email protected] .
       
  • Data Protection Authority
    In addition to the option of contacting us directly, you also have the option of contacting the Data Protection Authority (formerly: Privacy Commission): Commission for the Protection of Privacy, Drukpersstraat 35, 1000 Brussels, www.privacycommission.be /nl/contact .