Privacy Policy

1 Scope

1.1 Who we are and what we do

CBHS Corporate Health Pty Ltd ABN 85 609 980 896 (CBHS Corporate Health) is an open-access private health insurer and provides insurance policies (including Overseas Visitor Health Cover (OVHC) and Overseas Student Health Cover (OSHC)) to persons who are eligible to become members of CBHS Corporate. CBHS Corporate trades under the registered business name “CBHS International Health” in relation to its OVHC and OSHC insurance policies.

1.2 Purpose of this document

This document is CBHS International Health’s privacy policy (Policy). It provides information on how CBHS International Health collects Personal Information that is necessary for its functions and activities.

The term “Personal Information” is defined in section 2 (Definitions) below.

The Policy is based on relevant requirements in:

a) Our “Customer First” values;
b) The Privacy Act and its APPs;
c) The privacy legislation of Australian States and Territories; and
d) The GDPR.

The terms “APPs”, “GDPR” and “Privacy Act” are defined in section 2 (Definitions) below.

The relevant requirements in the GDPR apply to a Person whose Personal Information We Collect while the Person is or was resident in a EU Country.

The terms “Collect”, “EU Country”, “GDPR”, “Insurance Policy”, “Person” and “Personal Information” are defined in section 2 (Definitions) below.

The Policy is set out under the following headings:

1. Scope
2. Definitions
3. Individuals whose information we collect
4. Types of information we collect
5. Purposes for which we collect information
6. When and how we collect information
7. Dealing with us anonymously or using a pseudonym
8. Who we disclose information to
9. Disclosing information outside Australia
10. Direct marketing
11. Information we collect when you use our website
12. How we hold and protect information
13. Accessing and requesting correction of your information
14. Complaints about your privacy
15. Contacting us about this policy
16. Your consent
17. Changing and notifying changes to this Policy

2 Definitions

The words in bold in this section have the following meanings in this Policy:

a) APPs means the Australian Privacy Principles in the Privacy Act (as defined below).

b) Collect includes use, disclose, disclosure, holding and Processing of Personal Information. “Collects”, “collecting”, “collected” or “collection” has a corresponding meaning. The terms “Processing” and “Personal Information” are defined below.

c) Correct includes “rectification” of inaccurate personal data as described in Article 16 of the GDPR (as defined below). “Correction” or “corrected” has a corresponding meaning.

d) De-identify means removing or altering information that identifies a Person or is reasonably likely to identify a Person and includes the meaning of “pseudonymisation” given in Article 4 (5) of the GDPR (as defined below).

e) Destroy includes “erasure” of personal data as described in Article 17 (1) of the GDPR. “Destroyed” or “destruction” has a corresponding meaning.

f) EU Country means a current Member State of the European Union.

g) GDPR means the General Data Protection Regulation (Regulation (EU) 2016/679) of the European Parliament and of the Council.

h) Health Hub means an interactive health and wellness assessment centre We have set up at various locations in Australia, which provides an assessment of a user’s health status. “Health Hubs” has a corresponding meaning.

i) Information means Personal Information (as defined below), unless the context indicates otherwise.

j) Insurance Policy means private health insurance policy, Overseas Visitor Health Cover or Overseas Student Health Cover taken with CBHS International Health. “Insurance policies” has a corresponding meaning.

k) Person means a natural person and includes a “data subject” as described in Article 4 (1) of the GDPR (as defined below). “Persons” has a corresponding meaning.

l) Personal Information means information or a statement or opinion about an identified Person (as defined above), or from which a Person is reasonably identifiable. Personal Information includes Sensitive Information (as defined below) and “personal data” as defined in Article 4 (1) of the GDPR (as defined below).

m) Policy means this document, unless the context indicates otherwise.

n) Privacy Act means the Privacy Act 1988 of the Commonwealth Government of Australia.

o) Processing has the meaning given in Article 4 (2) of the GDPR unless the context indicates otherwise. “Process” or “processed” has a corresponding meaning.

p) Sensitive Information means Personal Information (as defined above), that is health, wellbeing, biometric, genetic, sexual orientation or practices information or biometric templates. Sensitive Information includes information of a similar nature mentioned in Article 9 (1) of the GDPR (as defined below).

q) Supervisory Authority has the meaning given in Article 4 (21) of the GDPR (as defined below).

r) You or Your means any Person (as defined above) whose information We (defined below) Collect.

s) We, Us or Our means CBHS International Health as identified in section 1.1 (Who we are and what we do) above.

3 Individuals whose information we collect

We Collect Information from or about the following types of persons:

Our members (current and former members) and their family members insured under the same Insurance Policy.
Applicants for membership with Us.
Applicants for employment or business opportunity with Us.
Referees who are persons notified to Us by an applicant for employment or business opportunity with Us.
Our contractors or service providers who are persons.
Health care professionals or health care service providers who are persons.
Visitors to Our premises or places of business.
Directors or officers of a body corporate who has or proposes to have a business relationship with Us.

4 Types of information we collect

Depending upon Your needs or circumstances or the relationship You have with Us, We will Collect the following types of Information:

4.1 General

Personal details such as name, address, other contact Information, date of birth, gender, marital status, photograph and signature.
Information necessary to manage payment of Your insurance premiums or contributions and to pay claims and other moneys due to You.
Medicare number.
Tax file number if You are Our employee.
Superannuation fund account number or membership details if You are Our employee.
Household or family income information (to assess eligibility for government rebates and incentives in relation to an Insurance Policy).
Information to assess eligibility for benefits from the Department of Veterans’ Affairs
"Sensitive Information" as defined in section 2 (Definitions) above.
Previous health fund/s membership and details of insurance policies You held with them.
Educational and technical qualifications, work history and professional associations or relationships if You apply for employment or business opportunities with Us.

4.2 Sensitive information

We Collect Sensitive Information (as defined in section 2 (Definitions) above) in various circumstances including when You:

Apply for some types of insurance policies.
Access treatments or health services covered by Your Insurance Policy.
Make a claim for treatments or services covered by Your Insurance Policy.
Join a specialised health program (see section 5.3 (Specialised health and wellbeing programs) below).

Whenever practicable, We will require Your express consent to Collect Your Sensitive Information.

4.3 Visitors to our website

We Collect information that is not Personal Information of visitors to Our website; see section 11 (Information we collect when you use our website) below. Such Information is Collected regardless of whether You complete a form from Our website.

5 Purposes for which we collect information

5.1 Products and services

We Collect Information for the purposes of providing, administering and marketing its products and services. These purposes include:

Determining Your eligibility for membership with Us.
Matching products and services to Your individual needs and circumstances.
Collecting and processing Insurance Policy contributions or premiums.
Assessing and communicating to You the coverage and benefits of the products and services provided to You.
Communicating with You from time to time.
Communicating with hospitals and other health care service providers about Your cover and benefits.
Verifying Your identity from time to time.
Administering and processing Your claims and payments.
Managing, evaluating, developing and improving Our products or services.
Conducting quality assurance or risk management activities.
Developing, improving or testing Our information technology services or capabilities.
Enrolling You in specialised health and wellbeing programs.
Conducting member surveys, research, analysis and providing online member services.
Resolving any legal and/or commercial complaints or issues in relation to products or services You have applied for or taken with Us.
Undertaking direct marketing activities and related communications with You.

5.2 Compliance with laws

We also Collect Information to meet Our compliance and reporting obligations in Australian Commonwealth Government laws including the:

Corporations Act.
Private Health Insurance Act.
Private Health Insurance (Risk Equalisation Policy) Rules.
Private Health Insurance (Risk Equalisation Administration) Rules.
Private Health Insurance (Data Provision) Rules.
Private Health Insurance (Incentives) Rules.
Private Health Insurance (Lifetime Health Cover) Rules.

5.3 Specialised health and wellbeing programs

We develop specialised health and wellbeing programs and initiatives to assist members with day to day health and wellbeing issues such as diet and exercise as well as chronic disease management.

We Collect Sensitive Information, as defined in section 2 (Definitions) above, to identify and communicate with members who can be enrolled in these programs. Participation in the programs is not mandatory. You may choose to or not to participate in them. If You join a program, You can withdraw from it at any time.

5.4 Consequences if information we ask for is not provided

We have assessed Information We will Collect as reasonably necessary for the purposes set out above. Your needs or circumstances determine the set of Information We will Collect from or about You.

We cannot compel You to provide any Information We ask for. However, in most cases, We will be unable to provide or continue to provide You with Our products or services if You fail or refuse to provide Information We ask for. Also, if You later withdraw Your consent for Your Information to be handled in accordance with all or some requirements of this Policy, We may not be able to provide or continue to provide You with Our products or services.

6 When and how we collect information

We Collect Information in the following ways or circumstances.

6.1 Collecting information directly from you

Where practicable, We will Collect Information directly from You, including when You:

Visit Our office or a place of business.
Contact Us by telephone, email or regular mail.
Complete a paper form we have issued You.
Complete a form on Our website.
Interact with Us via a mobile app.
Visit any of Health Hubs and provide Information.
Complete a government-issued form We have made available to You.
Apply to Us for employment or business opportunity.
Enter a contract for services with Us.

6.2 Collecting information from someone else

Sometimes We Collect Information from another Person or organisation including in the following circumstances.

Policies insuring more than one Person - We Collect Your Information from the main member or from a Person You have authorised to provide the Information on Your behalf. Any main member or authorised Person is deemed to have obtained the consent of any Person whose Information they provide in relation to the Insurance Policy.
Health services You received or when You make a claim – We may Collect Information about those services directly from the health service provider (e.g. a hospital, medical or allied health provider) You have dealt with.
Health and wellbeing partners – We may Collect Your Information from a Person or organisation We have engaged to provide a specialised health and wellbeing or chronic disease management program (see section 5.3 ( Specialised health and wellbeing programs) above) to Our members if You wish to participate in any such program.
Online review platform providers – We may Collect Your Information from online review platform providers with whom We have partnered to help You provide reviews of services You received from healthcare providers.
Relevant government departments – We may Collect Your Information from government departments We deal with in relation to insurance policies including the Department of Health, the Department of Home Affairs, the Private Health Insurance Ombudsman and the Office of the Australian Information Commissioner.
Call centres – We may collect Your Information from call centres acting on Our behalf.
Other private health insurers – We may Collect Your Information from Your previous private health insurer (for example, Information on Your transfer certificate);
Basic contact Information from referrers – We may obtain this Information from Our business associates, business partners or existing members to inform You about Our products or services, if We consider You may be eligible to join Us, or to inform You about an employment or business opportunity with Us.
Referees of job or business opportunity applicants – We may Collect Your Information from recruitment agencies or referees You have notified to Us in relation to an application for employment or business opportunity with Us. In any such case, You are deemed to have given Your consent to the recruitment agency or the referee to provide Your Information to Us for the purposes of the employment or business opportunity application.
Superannuation funds – If You are Our, We may Collect Your Information from a superannuation fund You have advised Us.
Publicly available Information – We may Collect Your Information from publicly available sources including from public registers, telephone or business directories, social media platforms and the internet.

If You wish to deal with any Person or organisation we have engaged to act on Our behalf, We strongly advise You to first read their Privacy Policy before providing them Your Information.

7 Dealing with us anonymously or using a pseudonym

When You are dealing with Us, and it is lawful and practicable to do so, You can remain anonymous (that is, without providing Information that identifies You), or use a pseudonym (that is, use a name, term or descriptor that is different to Your actual name).

Examples of when You can remain anonymous or use a pseudonym are when You:

Are making general enquiries only about Us or about Our products or services.
Are participating in a product or service survey or research We are doing.
Wish to make a report of wrongdoing on the part of any of Our officers or employees, unless Your identity is required to investigate the wrongdoing properly.
Consider identifying Yourself may pose a serious risk of harm to You or some other Person.

However, there are many circumstances in which it will not be lawful or practicable for Us to deal with anonymously or for You to use a pseudonym. Examples of such circumstances are when You wish to:

Join Us or take an Insurance Policy.
Claim a government rebate or incentive through Us.
Join any of Our specialised health and wellbeing program.
Make a complaint under Our internal complaints handling procedure.
Access and/or request correction or update of Information We hold about You or any Person on the same Insurance Policy.
Lodge a claim under Your Insurance Policy.

If You wish to remain anonymous or use a pseudonym when dealing with Us, tell Us at the time and We can confirm with You whether You can do so in the circumstances.

8 Who we disclose information to

The types of Persons or organisations CBHS Corporate usually discloses Information to are:

Hospitals or health care service providers from whom You have received, or from whom You intend to seek, treatments.
Providers of specialised health and wellbeing and chronic disease management programs; see section 5.3 (Specialised health and wellbeing programs) above.
Persons or organisations who provide contracted mail, mailing or messaging services on CBHS Corporate’s behalf.
Australian government departments or agencies (such as the Australian Taxation Office, Medicare Australia, the Australian Prudential Regulation Authority, the Australian Securities and Investments Commission, the Private Health Insurance Ombudsman, the Department of Health and the Department of Home Affairs.
Other private health insurers, when You transfer to or from another private health insurer.
Organisations providing marketing services on Our behalf.
Organisations providing call centre services on Our behalf.
Online review platform providers We have partnered with to help You provide reviews of services You received from healthcare providers.
Organisations, developing, improving or testing Our information technology services or capabilities.
Third-party advisers (such as auditors, actuaries, consultants and legal advisers).
Social media platforms including Facebook and Google to communicate with You on Our behalf about Our products and services.
The Australian Health Service Alliance (AHSA) who assists Us to assess and pay claims for members’ who have received treatments and services in hospitals and other health care facilities and to meet Our statutory reporting obligations.

AHSA’s privacy policy and contact details can be accessed from the following link https://www.ahsa.au/privacy-policy/.

You can make a complaint to the AHSA if You consider they have breached Your privacy. Also, You can ask them for access to the Information they hold about You or request the Information to be corrected.

9 Disclosing information outside Australia

If business needs require Us to disclose Your Information to an overseas recipient, We will take all reasonable steps to ensure the overseas recipient will not breach the Australian Privacy Principles, the Privacy Act or the GDPR in relation to the Information.

Other circumstances in which We will disclose Your Information to an overseas recipient are:

a) If the disclosure is authorised under an Australian law or by court order; or
b) If You request Us to disclose Your Information to an overseas recipient.

9.1 Managing requests for overseas disclosure

If You request Us to disclose Your Information to an overseas recipient, We will provide You a clear statement explaining the potential consequences of disclosing the Information to the overseas recipient.

10 Direct marketing

We or organisations acting on Our behalf may contact Our members individually or directly about Our products and services. We call this “direct marketing”. Direct marketing may be via regular mail, email, telephone, SMS or social media.

10.1 Request not to be sent direct marketing

You may request Us at any time not to send You direct marketing communication:

Logging into Your Member Centre account (if one is set up for You) and changing Your preferences.
Sending an email to Us at help@cbhscorp.com.au.
Calling Us on 1300 586 462 (Monday to Friday 8am-7pm AEDT).

We include in all direct marketing communications, information on how You can request us not to send You such communication in the future. A request will be updated as soon as reasonably practicable after receiving it.

Note that while You cannot opt out of receiving information or notices We are required by law to send to You, You can tell Us how You would like Us to send such information or notices to You.

11 Information we collect when you use our website

Our website uses “cookies”. A “cookie” is a packet of information that allows the website server to identify and interact more effectively with Your computer.

When You use the website, We send a cookie that gives each computer a unique identification number. Cookies do not identify individuals, although they do enable Us to identify Your browser type and internet service provider. Your browser may be configured to accept all cookies, reject all cookies or notify the user when a cookie is sent. If You reject all cookies, You may not be able to use Our website or the Member Service Centre.

We use third-party service providers such as Google to undertake demographic analysis of visitors to Our website (“Google Analytics”). We Collect and use information from cookies and Google Analytics to:

Better understand how visitors use Our website.
Link with social media networks.
Communicate relevant advertisements that may be of interest.
Measure the time spent on the website.
Determine the effectiveness of the navigation options.
Record information obtained during the visit to streamline subsequent visits.

By using Our website, You consent to the Collection of information about the use of Your computer by Google in the manner described in Google's Privacy Policy and for the purposes set out above. You can opt out of Google Analytics if You disable or refuse the cookie, disable JavaScript, or use the Google opt out feature at: https://tools.google.com/dlpage/gaoptout.

Also, Our website uses interfaces with social media sites such as Facebook. If You choose to "like" or “share" information from Our website through such sites, You should read the privacy policy of the social media site. The interfaces Our website uses may allow the social media site to connect Your visits to Our website with the information the social media site holds about You.

12 How we hold and protect information

We primarily store Information on Our premises in electronic form in Our information technology systems.

To meet legislative, regulatory and business continuity requirements, We store copies of some documents containing Information in a remote, secure location in Australia.

If We convert paper-based documents to electronic form, We Destroy the originals securely. Paper-based documents We hold on temporary basis are held securely at Our premises or by third-party document management or mail processing service providers in Australia.

We maintain physical and operational security over Our paper and electronic data stores. We also maintain computer and network security for Our information technology systems. For example, We use firewalls and other security systems, such as user identifiers and passwords, to control access to Our information technology systems.

12.1 Information we no longer need

If We no longer need Information, and We are not required by law to retain it, We will take reasonable and practical steps to destroy or De-identify the Information securely in accordance with Our document retention policy.

The criteria We use to determine the period for which We keep Information include:

The period We are required by law, a Regulator or court order to keep the Information.
The period We consider is necessary to keep the Information to resolve a complaint in relation to the Information.
The period We consider is necessary to keep the Information to defend or take legal action in relation to the Information.
The period We take to come to a reasonable conclusion that the Person does not wish to continue an application for a product, service, employment or business opportunity with Us.

12.2 Dealing with unsolicited information

If We receive Information We did not ask for and We determine it is not required for any of Our functions or activities, We will attempt to return it to the sender if it is contained in a document. If We cannot return the document to the sender, or the Information is contained in a voice recording, We will destroy the Information or document securely as soon as reasonably practicable.

13 Accessing and requesting correction of your information

13.1 Reasons for seeking access

You can request access to Your Information at any time by using the contact details set out in section 15 (Contacting us about this policy ) below. Your reason for seeking access could be simply to know what information We hold about You, to request a copy the Information, to request its correction or to exercise any right You have under the GDPR, including the rights to request correction, destruction or restriction of Processing of the Information (see section 1.3 (When rights under the GDPR apply) above).

13.2 Request for access to information

When You request access to Your Information, We will first identify You to ensure You are the right Person to be given access to the Information.

Requests for access are actioned as soon as practicable, and in any case within 30 days of receiving the request.

If We refuse to give access to Information, We will give You a written notice setting out Our reasons, Your right to make a complaint about Our refusal and any matter We are required by law to notify You about.

13.3 Fee for providing access

While requests for access to Information are free of charge, administrative fees may be charged for retrieving some types of Information and providing it in the form You have requested. If the circumstances apply in Your case, We will inform You and request payment of the fee before giving You access to the Information.

13.4 Requesting correction of information

If You believe Information We hold about You is inaccurate, out-of-date, incomplete, irrelevant or misleading, You can request Us to Correct it at any time by using the contact details set out in section 15 (Contacting us about this policy) below.

13.5 Responding to requests to correct information

We will respond to the request as soon as practicable, in any case within 30 days of Us receiving the request.
If We refuse to Correct Your Information as requested, We will give You a written notice setting out Our reasons (unless it is unreasonable to do so), Your right to make a complaint about Our decision and any matter We are required by law to notify You about.

13.6 Associating a statement if we refuse to correct information

If We refuse to Correct Your Information, You can ask Us to associate a statement with the Information that You believe the Information is inaccurate, out-of-date, incomplete, irrelevant or misleading. We will respond to the request as soon as practicable, in any case within 30 days of Us receiving the request.

13.7 Notifying others about correction of your information

You may ask as to notify another Person We previously disclosed Your Information to that We have corrected it. We will action Your request as soon as reasonably practicable.

If the GDPR applies to your Information (see section 1.3 (When rights under the GDPR apply) above), We will notify any such Person as soon as practicable unless this proves impossible or involves disproportionate effort.

14 Complaints about your privacy

CBHS Corporate has a Complaint Handling and Dispute Resolution Policy for member complaints including privacy complaints. A copy of this policy is available at:

https://www.cbhscorporatehealth.com.au/about-us/contact/disputes-complaints

You may make a complaint about a breach of Your privacy under the Privacy Act or under the GDPR (if the latter apples to You, see section 1.3 (When rights under the GDPR apply) above). You can contact Our Privacy Officer through the contact details are set out in section 15.1 (Privacy Officer’s contact details) below. You should first make Your complaint in writing.

Our Privacy Officer will first determine if, on the information available, We have breached Your privacy, and if so, take steps to resolve the complaint within 3 days of receiving the complaint. If Your complaint requires more detailed consideration or investigation, the Privacy Officer may ask You to provide further information. In such a case, the Privacy Officer will endeavour to respond to the complaint as soon as reasonably practicable and, in any case, within 30 days.

If You are not satisfied with Our response to Your complaint, You may take the complaint to either the Private Health Insurance Ombudsman (PHIO) or to the Office of the Australian Information Commissioner (OAIC) whose contact details are below.

14.1 PHIO’s contact details:

Telephone: 1300 362 072 (option 4 for private health insurance)
Online complaint form:
https://forms.business.gov.au/smartforms/servlet/SmartForm.html?formCode=oco-complaint-form
Email: phio.info@ombudsman.gov.au
Address:
The Private Health Insurance Ombudsman
Office of the Commonwealth Ombudsman
GPO Box 442
Canberra ACT 2601
Fax: (02) 6276 0123
Website: www.ombudsman.gov.au

Additional information:
http://www.ombudsman.gov.au/making-a-complaint/complaints-overview

14.2 OAIC contact details

Email: enquiries@oaic.gov.au
Address:
The Office of the Australian Information Commissioner
GPO Box 5218
Sydney NSW 2001

Additional information
https://www.oaic.gov.au/privacy/privacy-complaints

14.3 Information regulated by GDPR

If Your complaint is based on Information regulated by the GDPR (see section 1.3 (When rights under the GDPR apply) above), You may make a complaint directly to the Supervisory Authority in the relevant EU Country or make the complaint to Our Privacy Officer whose contact details are set out in section 15.1 (Privacy Officer’s contact details) below.

15 Contacting us about this policy

You may contact CBHS Corporate for any reason, including to:

Obtain a copy of this Policy or seek further Information about the Policy.
Request access to Your Information.
Request correction, destruction or de-identification of Your Information.
Request Us to associate a statement with Your Information if We refuse to Correct the Information.
Request Us to inform a Person We previously disclosed Your Information that We have corrected the Information;
Request Us not to send You direct marketing material in the future or change Your preferred means of being sent such material including, by regular mail, email or SMS.
Make a complaint about a breach of Your privacy or how this Policy was applied to You.
Withdraw Your consent to Collecting Your Information generally or in any respect.
Exercise any right You have under the GDPR: see section 1.3 (When rights under the GDPR apply) above.

15.1 Privacy Officer’s contact details

Email: privacy@cbhscorp.com.au

Address:
Privacy Officer
CBHS International Health
Locked Bag 5098
Parramatta NSW 2124

15.2 Other contact details

Telephone: 1300 586 462
Fax: (02) 8604 3576
General enquiries Email - help@cbhscorp.com.au
Complaints Email - complaints@cbhscorp.com.au

16.1 Consent required

Whenever practicable, We will obtain Your express consent for Your Information to be collected in accordance with the requirements of this Policy.

You may withdraw Your consent to the collection of Your information at any time after giving it in the following circumstances:

If your information is regulated by the APPs and the Privacy Act, and you wish to remain Our member, You may only withdraw Your consent for the Information to be used for direct marketing.
If your Information is regulated by the GDPR, You may withdraw Your consent for Us to continue to Collect the Information in accordance with all the requirements of this Policy or for the Information to be only collected in a respect You specify.

16.3 Consequences if you withdraw consent

In some cases, We may not be able to provide You or continue to provide You Our products or services after You have withdrawn Your consent.

Also, if we are required by law or an internal policy to retain Your Information for a period (see section 12.1 (Information we no longer need) above), we will retain the Information for that period after You have withdrawn Your Consent.

16.4 If we refuse your request to withdraw consent

If We refuse to allow You to withdraw Your consent in accordance with section 16.2 (Withdrawal of consent) above, We will provide You our written reasons for the refusal and include information on Your right to make a complaint about Our refusal and any matter We are required by law to inform You about.

17 Changing and notifying changes to this Policy

CBHS International Health may review this Policy at any time and publish a revised version on its website at: https://www.cbhsinternationalhealth.com.au/policies/privacy-policy.

You can request a copy of this Policy free of charge by contacting Us: see section 15.1 (Privacy Officer’s contact details); or section 15.2 ( Other contact details) above. If it is practicable to do so, We will provide a copy of the Policy in the form You have requested it.

Public document - Last updated September 2019

CBHS International Health Privacy Policy