HCF
Health & Wellness
Minimal child-specific protections with only retention period specified for under-18 health service users. No age verification, parental consent mechanisms, or proactive child protection measures beyond general policyholder consent. Overall: Good with minor gaps.
10 dimensions · 76 claims · assessed 14 May 2026 · methodology · source policy ↗
Score Breakdown
Transparency
Good with minor gaps
7.83/107.83/10
Transparency
Good with minor gaps
Transparency & Clarity
8/10Comprehensive scope coverage across HCF group entities with clear contact information, definitions, and data principles section. Strong policy availability and currency information with specific privacy officer contact details.
Purpose Limitation & Use
8/10Clear primary and secondary purposes with explicit consent requirements for marketing. Comprehensive opt-out mechanisms provided with multiple contact methods and detailed member program development purposes.
Policy Maintenance & Accountability
7/10Clear change notification process via website posting with specific privacy officer contact details and governance framework. Regular security monitoring and testing mentioned, though review frequency could be more specific than 'from time to time'.
Data Protection
Good with minor gaps
7.89/107.89/10
Data Protection
Good with minor gaps
Data Collection Disclosure
9/10Exceptionally detailed enumeration of personal and sensitive information types including biometric data, with comprehensive collection methods disclosed. Clear legal basis, consent mechanisms, and consequences of non-provision specified.
Third-Party Sharing & Disclosure
8/10Detailed categories and named third-party providers with specific purposes and contractual obligations. Clear overseas disclosure locations with safeguards, though some sharing purposes could be more granular.
Data Security
6/10Strong security commitment statements with 24/7 monitoring and regular testing, but lacks specific technical measures like encryption details or certifications. Governance processes mentioned but not detailed.
Cross-Border Data Flows
8/10Specific countries and regions named with clear safeguard commitments including APP compliance and EEA standard contractual clauses. Strong contractual restrictions for third parties and named payment provider disclosures.
Your Rights
Room for improvement
6/106/10
Your Rights
Room for improvement
Consumer Rights & Control
9/10Comprehensive rights framework with specific access and correction mechanisms, clear timeframes (2 and 5 business days), multiple contact methods, and detailed OAIC complaint process. Additional rights for OVHC members enhance coverage.
Automated Decision-Making
4/10Limited disclosure of automated processing for marketing segmentation and targeted advertising, but lacks comprehensive ADM transparency, human review rights, or detailed logic explanation required under APP 1.4.
Children's Data
4/10Minimal child-specific protections with only retention period specified for under-18 health service users. No age verification, parental consent mechanisms, or proactive child protection measures beyond general policyholder consent.
Sector Comparison
Health & Wellness comparison