Privacy Policies

California Consumer Privacy Act Notice

Effective Date: January 1, 2020

This Notice reflects our good faith understanding of the California Consumer Privacy Act (CCPA) and our data practices as of January 1, 2020. Please note that the CCPA does not apply to (1) Protected Health Information (PHI) as defined under the Health Insurance Portability and Accountability Act (HIPAA); or (2) covered entities subject to HIPAA, insofar as such entities maintain personal information in accordance with HIPAA. As such, the CCPA does not apply to BCBS Global Solutions, nor does it apply to most of the personal information BCBS Global Solutions may collect, use, and disclose. BCBS Global Solutions complies with the CCPA as it applies to the limited personal information we may process that does not fall under a CCPA exemption; this Notice addresses our practices with respect to that data.

Please also note the CCPA’s implementing regulations are not yet final, and there remain differing interpretations of the law. Accordingly, we may update information regarding our data practices and your rights, modify our methods for responding to your requests, and/or supplement our response to your requests, as we continue to develop our compliance program to reflect the evolution of the law and our understanding of how it relates to our data practices.

This California Privacy Notice (“Notice”) applies to “Consumers” as defined by the California Consumer Privacy Act (“CCPA”), and supplements Worldwide Insurance Services, LLC (Worldwide Services Insurance Agency, LLC in California and New York) trading as Blue Cross Blue Shield Global Solutions (“BCBS Global Solutions”) other privacy policies and notices. In the event of a conflict between any other BCBS Global Solutions policy, statement, or notice and this Notice, this Notice will prevail as to California Consumers and their rights under the CCPA.

In accordance with the CCPA’s requirements, this Notice covers the calendar year 2019 and describes our collection, use, disclosure, and sale of California Consumers’ “Personal Information” (“PI”), as well as rights California Consumers have under the CCPA. Terms defined in the CCPA that are used in this Notice have the same meanings as in the CCPA.

Consistent with the CCPA, job applicants, current and former employees, contractors, and subjects of certain business-to-business communications action in their capacity as representatives of another business are not considered Consumers for the purposes of this Notice or the rights described herein. This Notice also does not apply to HIPAA-covered protected health information BCBS Global Solutions collects and other patient information that BCBS Global Solutions maintains in the same manner as protected health information.

Collection and Use of Personal Information

We collect PI about California Consumers as described in the table below.

In addition, we may collect, use, and disclose your PI as required or permitted by applicable law. We do not treat de-identified data or aggregate consumer information as PI, and we reserve the right to convert, or permit others to convert, your PI into de-identified data or aggregate consumer information.

We may share your PI with our affiliates, service providers, vendors (including those that facilitate interest-based advertising and other advertising and marketing), and other parties as described in the table above. These parties may use your PI for some or all of the above-listed business purposes, subject to the CCPA’s restrictions and obligations.

BCBS Global Solutions does not “sell” (as the term “sale” is defined by the CCPA) Consumer PI.

California Privacy Rights

Under the CCPA, California Consumers have certain rights which they may exercise independently or through an authorized agent. CCPA rights requests are subject to an identification and verification process. We will not fulfill a CCPA request unless we have been provided sufficient information for us to reasonably verify the identity of the requestor and the validity of the request.

Some PI we maintain about Consumers (e.g., clickstream data) is not sufficiently associated with enough PI about the Consumer for us to be able to verify that it is a particular Consumer’s PI. Accordingly, we will not include such information in response to Consumer requests. If we cannot comply with a request, we will explain the reasons in our response. We will use PI provided in your request to verify your identity or authority to make the request and to track and document request responses, unless you also provided the PI to us for another purpose.

We will make commercially reasonable efforts to identify Consumer PI that we collect, use, store, disclose, or otherwise process, and to respond to your California Consumer privacy rights requests. In some cases, particularly with voluminous and/or typically irrelevant data, we may provide you with a summary of your PI and give you the opportunity to elect whether you want us to provide the entire data set. Alternatively, we may direct you on how to access and copy responsive PI yourself. We may charge a reasonable fee or refuse to act upon a request if the request is excessive, repetitive, unfounded, or overly burdensome. If we determine that the request warrants a fee, or that we may decline to comply with the request, we will give you notice explaining why we made that decision. In the case of a fee, we will provide a cost estimate and the opportunity to accept such fees before charging you for responding to your request.

Your California Consumer privacy rights are described below. To make a request, please email us at privacy@bcbsglobalsolutions.com  or call us at 855 682 7965. We will take appropriate steps to confirm the identity of a Consumer making a request for purposes of verifying the authenticity of the request. You may be required to provide certain PI to allow us to verify that you are the Consumer about whom the request is being made. If you request that we provide you with specific pieces of information about you, we will apply the heightened verification standards. An authorized agent may submit a request on behalf of a Consumer if the Consumer has provided the authorized agent with power of attorney in accordance with California law. Alternatively, the agent must (1) present verifiable written authorization from the Consumer that the agent has the Consumer’s permission to submit the request; and (2) independently verify the agent’s own identity with BCBS Global Solutions.

We may collect, use, and disclose your PI as required or permitted by applicable law. Please note we are not obligated to comply with consumer requests to the extent that doing so would infringe on our, or any other person’s or party’s, rights or conflict with applicable law.

Disclosure Rights

You have the right to request that we disclose the following information:

• The categories of PI we have collected about you.
• The categories of sources from which we collected your PI.
• The business or commercial purposes for collecting or Selling your PI.
• The categories of third parties to whom we have shared your PI.
• The specific pieces of PI we have collected about you.
• A list of the categories of PI disclosed for a business purpose in the prior 12 months, or a statement that no such disclosure occurred.
• A list of the categories of PI Sold about you in the prior 12 months, or that no Sale occurred. If we Sold your PI, we will explain (1) the categories of your PI we have Sold, and (2) the categories of third parties to which we Sold PI.

You have the right to make or obtain a portable copy of your PI that we (1) have collected in the 12 months prior to the request date and (2) currently are maintaining. Please note that we retain PI for various time periods in accordance with applicable law and our internal recordkeeping policies and procedures.

Consumer requests of this nature may be made no more than 2 times in a 12-month period.

“Do Not Sell” Rights

We do not sell California Consumer PI as defined under the CCPA and, until such time as we change our practices by updating this Privacy Notice, will treat PI collected under this Notice as subject to a “do not sell” request.

Some browsers include features that may be characterized as “do not track” signals. As is the case with many websites, currently the transmission of a “Do Not Track” signal from a visitor’s browser will not alter our practices with respect to data collection on our websites. Further, we do not interpret “do not track” signals to represent a “do not sell” request for CCPA purposes. We understand that various parties are developing “do not sell” signals, and we may recognize certain such signals if we conclude such a program is appropriate.

Deletion Rights 

Except to the extent we have a basis for retention under the CCPA, you may request that we delete your PI that we have collected directly from you and are maintaining. Our retention rights include, without limitation, retaining PI to complete transactions and provide services you have requested or that are reasonably anticipated, for security purposes, for legitimate internal business purposes such as maintaining business records, to comply with law or otherwise cooperate with law enforcement, and to exercise or defend legal claims. Note also that we are not required to delete your PI that we did not collect directly from you.

Non-Discrimination Rights

We will not discriminate against you in a manner prohibited by the CCPA because you exercise your CCPA rights.

California’s “Shine the Light” Law

California’s “Shine the Light” law permits customers in California to request certain details about how certain types of their information are shared with third parties and, in some cases, affiliates, for those third parties’ and affiliates’ own direct marketing purposes. Under this law, a business must either provide California customers certain information upon request or permit California customers to opt in to, or opt out of, this type of sharing.

We do not share Personal Information with third parties or affiliates for those third parties’ or affiliates’ own direct marketing purposes. If you are a California resident, you may request information about our compliance with this law by contacting us at privacy@bcbsglobalsolutions.com or by sending a letter to BCBS Global Solutions, 933 First Avenue, King of Prussia, PA 19406. Requests must include “California Privacy Rights Request” in the first line of the description and include your name, street address, city, state, and ZIP code. Please note that we are only required to respond to one request per customer annually.

Please note that “Shine the Light” rights and CCPA rights are established under different legal regimes and must be exercised separately.

Contact Us

For more information regarding your California privacy rights, you may contact us at 855 682 7965 or email us at privacy@bcbsglobalsolutions.com. You may also write to us at BCBS Global Solutions, 933 First Avenue, King of Prussia, PA 19406.

European Union/General Data Protection Regulation (EU/GDPR) Privacy Notice

Effective Date: September 8, 2025

This European Union (EU) Privacy Notice explains how Worldwide Insurance Services, LLC (Worldwide Services Insurance Agency, LLC in California and New York) trading as Blue Cross Blue Shield Global Solutions^SM (“BCBS Global Solutions”) processes personal data that may be subject to the EU’s General Data Protection Regulation (“GDPR”). With respect to the personal data processing activities described in this Notice, BCBS Global Solutions (“we” “our” “us”) acts as the data controller (the entity that determines the purposes and means of the data processing). This Notice also describes your rights and choices relevant to our processing of your personal data.

You may contact us for additional information about our data practices using the contact information at the bottom of this Notice.

Personal Data Collection

Data You Provide to Us. BCBS Global Solutions may collect personal data directly from you. For example, when you create an account, file a claim, use our contact form, or otherwise communicate directly with us. This personal data might include your personal contact details, date of birth, personal identification number, health data, health insurance information or medical records, and your BCBS Global Solutions account authentication information and member identification number. If you apply for employment with BCBS Global Solutions, we may collect your contact details, curriculum vitae, and other information to help us assess your qualifications for employment.

Automatically Collected Data. BCBS Global Solutions uses various tools and technologies, such as cookies, web beacons, and web server logs, to collect data automatically when you visit our websites or use our online services. This data may include IP addresses, device identifiers, referring URLs, time and length of visits, and pages viewed. For additional information regarding our use of these online tools and technologies, including your ability to opt out, please review BCBS Global Solutions’ Online Privacy Policy on our website.

Information We Obtain from Third Parties. BCBS Global Solutions obtains certain personal data from third parties. For example, your employer might provide your employee identification number, work contact details, and job title, or your healthcare provider might provide health data or medical records to help us determine your benefits eligibility or to process your claims.

Some of the data we process may include special categories of personal data as defined in the GDPR.

Personal Data Processing

We may process your personal data to:

• Communicate with you, transact with you, service your account, process your claims, and provide customer service
• Evaluate job applications received through our Careers page
• Facilitate, monitor, manage, analyze, and improve our services
• Provide you with information regarding our products and services
• Conduct research and analysis
• Prevent and address fraud or other unlawful activity, breaches of our policies or terms, and threats or harm
• Ensure the security and integrity of the personal data we process
• Comply with applicable legal requirements

These personal data processing activities are carried out pursuant to the following legal bases:

• The processing is necessary for us to provide you with the services and products you request, including pursuant to a contract we have with you or to respond to your inquiries regarding those services and products.
• We have a legitimate interest in processing your personal data. For example, we have a legitimate interest in processing personal data for the following purposes:
  • Analyzing and improving safety and security, including by implementing and enhancing security measures
  • Maintaining and improving BCBS Global Solutions’ products and services
  • Providing you with certain tailored communications, including developing and promoting our business
• We have a legal obligation to process your personal data, such as to comply with applicable laws and other government regulations or to comply with a court order, binding law enforcement request, or other legal processes.
• We have obtained your consent with respect to the processing of your personal data. When you consent to such processing, you can withdraw your consent at any time by contacting us by email at privacy@bcbsglobalsolutions.com or by phone at 855 682 7965 or +1 610 897 2123.

Disclosure of Personal Data

We may share personal data in the following ways:

• In order to provide services to you or upon your request, personal data you provide to BCBS Global Solutions, including health information and medical records, may be shared with our designated healthcare provider. This information may be shared whether or not you ultimately are seen by that healthcare provider. 
• Certain personal data may be shared under confidentiality agreements with our business partners, vendors and other service providers who perform necessary functions to assist our operations. For example, we may use third parties for cloud hosting services and document storage and to help us provide customer support. 
• We may share your personal data with members of BCBS Global Solutions’ corporate family when it is reasonably necessary or useful, such as to improve or support our member services. 
• In some circumstances, we must share your personal data due to a legal obligation. For example, we may disclose your personal data to comply with the law, to establish or exercise our legal rights, to protect and defend our or others’ rights or property, or to prevent fraud or abuse. 
• In the event of a business transaction, including negotiations of such a transaction, (for example, the sale, reorganization, liquidation, assignment, merger, or other transfer of all or a portion of BCBS Global Solutions’ business to another business entity) we may share your personal data. 

International Data Transfer

Under certain circumstances, personal data may be transferred to BCBS Global Solutions in the United States or another country outside of the EU for processing. Examples of when this might happen include when medical records are required for claims processing, when health information is required to assess benefits eligibility, or when you contact us to request assistance with finding a healthcare provider. Please be aware that the data protection laws and regulations that apply to your personal data in other countries may differ from the laws in the EU.

Appropriate legal mechanisms and safeguards are applied to personal data transfers. For further information about how your data is transferred out of the EU, please contact us by email at privacy@bcbsglobalsolutions.com or by phone at 855 682 7965 or +1 610 897 2123.

Security

BCBS Global Solutions takes reasonable measures to protect personal data from loss, theft, misuse, unauthorized access, disclosure, alteration, and destruction. For example, when registering as a BCBS Global Solutions member or when requesting, accepting, or reviewing medical appointments, you will use the BCBS Global Solutions secure server. Through encryption, the personal data that users enter, including credit card numbers and personal identification numbers, cannot be read easily as the personal data travels over the Internet. Nevertheless, transmission via the Internet and online digital storage are not completely secure, so we cannot guarantee the security of your personal data.

You are responsible for maintaining the confidentiality of your BCBS Global Solutions account password. Never share your BCBS Global Solutions password with anyone you do not want to access your account, and inform BCBS Global Solutions of any need to deactivate an account or password. If you have a security concern about your account, contact BCBS Global Solutions by email at privacy@bcbsglobalsolutions.com or by phone at 855 682 7965 or +1 610 897 2123.

Data Retention

We will store your personal data for no longer than is necessary for the performance of our obligations or to achieve the purposes for which the information was collected, or as may be permitted under applicable law. To determine the appropriate retention period, we will consider the amount, nature, and sensitivity of the data; the potential risk of harm from unauthorized use or disclosure of the data; the purposes for which we process the data and whether we can achieve those purposes through other means; and the applicable legal requirements. Unless otherwise required by applicable law, at the end of the retention period we will remove personal data from our systems and records or take appropriate steps to anonymize it properly.

Your Rights and Choices

Under the GDPR, EU data subjects have certain rights with respect to their personal data. Subject to certain conditions, you may make the following types of requests:

• Access. You may request that we provide you with information about our processing of your personal data and give you access to your personal data.
• Correct. You may request that we update or correct personal data about you that is inaccurate or incomplete.
• Delete. You may request that we delete your personal data.
• Object. You may object to our reliance on our legitimate interests as the basis for processing of your personal data.
• Restrict. You may request that we restrict the processing of your personal data.
• Transfer. You may request that we transfer a machine-readable copy of personal data you have given us to you or to a third party of your choice.

You also may request at any time that we stop sending you direct marketing communications. We may continue to send you communications related to your BCBS Global Solutions membership and other non- marketing communications.

You can submit these requests by email at privacy@bcbsglobalsolutions.com or by phone at 855 682 7965 or +1 610 897 2123. We will respond to your request within a reasonable timeframe. We may request specific information from you to help us confirm your identity prior to processing your request. Applicable law may require or permit us to decline your request. If we decline your request, we will tell you why, subject to legal restrictions.

You also have the right to lodge a complaint with a supervisory authority. You can find information about your data protection regulator here.

Updates to this Notice

This EU Privacy Notice may be revised from time to time as we add new features and services, as laws change, and as industry privacy and security best practices evolve. We display an effective date on the policy in the upper right corner of this Notice so that it will be easier for you to know when there have been material changes. Your continued interaction with BCBS Global Solutions following the posting of changes to the Notice will mean that you accept those changes.

Questions?

If you have questions about this Notice or about exercising your data protection rights under the GDPR, please contact us by email at privacy@bcbsglobalsolutions.com or by phone at 855 682 7965 or +1 610 897 2123.