Privacy Policy

CareBridge respects your privacy and is committed to protecting the personal data we collect, use, disclose and store.

This Privacy Policy explains how CareBridge collects and handles personal data when you use our website, platform, mobile application, enquiry forms, claims tools, messaging channels or other services.

CareBridge acts as a Third Party Administrator / programme administrator for insurer-backed protection programmes. We are not an insurer, broker or underwriting manager unless expressly stated. We administer enrolment, member records, payment status, claims intake, claims documentation, programme reporting and related support services on behalf of insurers, employers, agencies, institutions and other programme partners.

This Privacy Policy applies to personal data we collect about:

• workers / members enrolled in a CareBridge-administered programme;
• named dependants, beneficiaries or family members;
• employers, agencies, institutions and programme partners;
• claimants and persons assisting with claims;
• insurer, reinsurer, claims, payment, technology and servicing partners;
• users of the CareBridge website, app, forms and digital channels.

Where you provide personal data about another person, such as a named dependant, beneficiary, family member or employee, you should ensure that you are authorised to provide that information and that the person has been informed of the purposes for which their data may be used.

We collect only the information reasonably needed to administer the relevant programme, respond to enquiries, support enrolment, manage payment status, assist with claims and comply with legal, regulatory and contractual obligations.

The types of personal data we may collect include:

Worker / member information

• full name;
• date of birth or age;
• nationality;
• country of employment;
• country of origin;
• mobile number;
• email address, where provided;
• employer, agency or programme code;
• broad occupation category, where required for eligibility or pricing;
• partial or encrypted identity reference, where required.

Named dependant / beneficiary information

• full name;
• relationship to the worker / member;
• date of birth or age;
• country;
• province, city or region, where needed;
• contact details, where required for claims or servicing.

Employer, agency or programme partner information

• organisation name;
• business registration number, where applicable;
• country;
• contact person name;
• role or title;
• business email address;
• business mobile number, where provided;
• billing or programme administration details.

Programme and policy administration information

• submission ID;
• product or plan code;
• effective date;
• payment frequency;
• payment status;
• certificate or cover status;
• renewal, cancellation or lapse status;
• consent timestamp;
• terms and privacy notice version;
• programme reporting data.

Payment information

CareBridge does not intend to store full card numbers, CVV codes or unnecessary payment credentials.

Where payment is made through a payment gateway or payment provider, we may store limited payment administration information such as:

• payment provider customer ID;
• payment token or mandate ID;
• receipt ID;
• payment status;
• payment frequency;
• failed payment or retry status;
• last four digits of a card, where needed for customer support.

Claims information

Claims information is collected only where needed to notify, assess, validate, administer or support a claim.

Depending on the claim type, this may include:

• claim ID;
• member or policy reference;
• named dependant details;
• hospital, doctor or medical facility details;
• admission and discharge dates;
• diagnosis confirmation;
• medical certificates;
• death certificate;
• proof of relationship;
• claimant identity details;
• payment recipient details;
• supporting claim documents required under the programme.

We do not ask for sensitive medical documents at enrolment unless required by the insurer, law or programme rules.

Website and technical information

When you use our website, app or digital channels, we may collect:

• IP address;
• device and browser information;
• usage logs;
• form submission records;
• cookie or analytics data;
• security and fraud-prevention data;
• communication history through web forms, WhatsApp, Viber, Line or other approved digital channels.

We may collect personal data when you:

• visit our website;
• submit a web form;
• enrol in a programme;
• are enrolled by an employer, agency or programme partner;
• name a dependant or beneficiary;
• make or support a claim;
• upload documents;
• communicate with us through WhatsApp, Viber, Line or other approved channels;
• interact with our platform, app or support team;
• are included in information provided by an insurer, employer, agency, institution, claims partner or other authorised party.

CareBridge may collect, use and disclose personal data for the following purposes:

• administering insurer-backed protection programmes;
• processing enrolments;
• maintaining member, dependant and programme records;
• confirming eligibility and cover status;
• issuing or supporting certificates of cover;
• managing payment status, billing and reconciliation;
• administering claims intake and document collection;
• coordinating claims review with insurers, claims partners and verification providers;
• supporting claim payments where applicable;
• providing customer, employer, agency and programme partner support;
• preparing bordereaux, programme reporting and insurer reporting;
• managing renewals, cancellations, lapses and reinstatements;
• responding to enquiries and support requests;
• maintaining audit trails and compliance records;
• detecting, investigating and preventing fraud, misuse, errors or unauthorised activity;
• complying with applicable laws, regulations, regulator requests, court orders or contractual obligations;
• improving our services, systems, workflows and customer experience.

We may also use business contact details to communicate with employers, agencies, institutions, insurers and programme partners about CareBridge services and programme opportunities.

Marketing communications will be handled separately where required. You may opt out of marketing communications without affecting necessary programme administration communications.

We may disclose personal data where reasonably necessary to administer the relevant programme or comply with our obligations.

This may include disclosure to:

• insurers and reinsurers;
• employers, agencies, institutions or programme sponsors;
• claims handlers, loss adjusters, medical reviewers or verification partners;
• payment gateways, banks and payment service providers;
• technology providers, hosting providers, CRM providers and platform vendors;
• customer support and communication providers;
• legal, compliance, audit, accounting and professional advisers;
• regulators, authorities, courts, law enforcement bodies or government agencies;
• authorised representatives or persons assisting with a claim;
• other parties where required or permitted by law, contract or the relevant programme rules.

We do not sell personal data.

CareBridge may operate across multiple jurisdictions. Personal data may be transferred to, stored in or accessed from countries where CareBridge, our group entities, insurers, reinsurers, programme partners, claims partners, payment providers, technology providers or support teams operate.

These countries may include Singapore, Malaysia, Labuan, Hong Kong, the Philippines and other countries relevant to the programme.

Where personal data is transferred across borders, CareBridge will take reasonable steps to ensure that the recipient protects the personal data in a manner consistent with applicable data protection requirements and the purposes described in this Privacy Policy.

Claims may involve sensitive documents, including medical, hospital, death, identity, relationship or payment information.

CareBridge only collects sensitive claim documents where they are needed to notify, validate, administer, assess, process or support a claim.

Access to sensitive claim documents should be restricted to authorised personnel and relevant programme partners who need access for the claim.

Please do not send sensitive medical or identity documents through the general website contact form unless we specifically request them through the claims process.

We rely on workers, members, employers, agencies, institutions, claimants and programme partners to provide accurate and complete information.

You should inform us as soon as reasonably possible if personal data provided to CareBridge is inaccurate, incomplete or out of date.

CareBridge may take reasonable steps to verify information where required for enrolment, administration, claims, payment, compliance or fraud prevention.

CareBridge will take reasonable administrative, technical and organisational steps to protect personal data against unauthorised access, collection, use, disclosure, copying, modification, disposal or similar risks.

These steps may include:

• role-based access controls;
• restricted access to claims documents;
• secure document upload workflows;
• encryption or secure storage where appropriate;
• audit logs;
• access monitoring;
• vendor due diligence;
• staff confidentiality obligations;
• incident response processes;
• data minimisation controls.

No system is completely secure. However, we aim to apply practical safeguards appropriate to the sensitivity and volume of the personal data we handle.

CareBridge will retain personal data only for as long as reasonably necessary for the purposes for which it was collected, or as required for legal, regulatory, contractual, audit, claims, tax, accounting or legitimate business purposes.

Retention periods may differ depending on the type of record. For example, claims records, payment records, consent logs, audit trails and programme administration records may need to be retained for longer than general website enquiry records.

When personal data is no longer required, CareBridge will take reasonable steps to delete, anonymise or securely dispose of it.

Subject to applicable law and verification of your identity, you may request access to personal data that CareBridge holds about you or request correction of inaccurate personal data.

We may need to ask for additional information to verify your identity, locate the relevant record and process your request.

In some cases, we may be unable to provide access to certain information, such as where disclosure would reveal personal data about another person, breach confidentiality, affect a claims review, prejudice investigations or where an exception applies under law.

Where we rely on consent to collect, use or disclose personal data, you may withdraw your consent by contacting us.

Please note that withdrawing consent may affect our ability to administer your programme, maintain your cover record, process payment status, support a claim or provide services linked to the relevant programme.

We may continue to retain, use or disclose personal data where required or permitted by law, regulation, contract, audit, claims handling or legitimate business purposes.

CareBridge may use cookies, analytics tools and similar technologies to operate the website, understand usage, improve performance, support security and improve user experience.

You may be able to disable cookies through your browser settings. Some website features may not work properly if cookies are disabled.

Where required, we will provide additional cookie notices or consent options.

CareBridge may offer support through digital messaging channels such as WhatsApp, Viber and Line.

When you contact us through these channels, your use of the relevant messaging service may also be subject to that provider’s own terms and privacy policy.

Please avoid sending sensitive medical, identity or payment information through general messaging channels unless CareBridge specifically requests it as part of an approved claims or verification process.

Our website, app or messages may contain links to third-party websites, platforms, payment gateways or partner services.

CareBridge is not responsible for the privacy practices, security or content of third-party websites or services. You should review the privacy policies of those third parties before providing personal data to them.

CareBridge may collect limited personal data about named dependants, including children, where needed to administer a programme or process a claim.

Where a named dependant is a minor, personal data should be provided by a parent, legal guardian, worker, member, employer, agency, institution or authorised person with the appropriate authority to provide that information.

We do not knowingly collect personal data directly from children for marketing purposes.

CareBridge may update this Privacy Policy from time to time to reflect changes in our services, operations, legal obligations or data protection practices.

The updated version will be posted on our website with the “Last updated” date amended. Where required, we may notify users or programme partners of material changes.

If you have questions about this Privacy Policy or how CareBridge handles personal data, please contact us through our website contact form or approved digital channels.

Please include enough information for us to identify your enquiry, but do not include sensitive medical, identity or payment documents unless specifically requested through the claims process.