Who Are We and What Is the Purpose of This Privacy Policy

ESIS, Inc. (“we”, “us”, “our”), a subsidiary of Chubb Limited, with its registered office at 436 Walnut Street, Philadelphia, PA 19106, United States of America, administers the COVID-19 Vaccine Facility No-Fault Compensation Scheme (the “Scheme”), in accordance with the terms of the Scheme’s Protocol (the “Protocol”).

This Privacy Policy explains how and why we use Personal Data in the context of the Scheme, and explains certain rights in relation to your Personal Data (for example, access to or erasure of your Personal Data).

ESIS uses the Personal Data it collects in order to consider whether a Claim is eligible for payment under the Scheme, to communicate with the Patient or their representative, and to process any payment made on a Claim (if eligible). Where necessary, and subject to the terms of this Privacy Policy, such Personal Data may be shared with third parties including ESIS’s service providers, reinsurers, and government health and law enforcement agencies.

You may have certain rights in respect of the Personal Data processed by ESIS. More information about these rights, as well as other conditions that apply to ESIS’s use of your Personal Data, are set out below.

Who Does This Policy Apply To?

  1. This Privacy Policy applies to Patients who submit a Claim for compensation under the Scheme and, if relevant, to any person who makes an authorised Claim on behalf of a Patient, as well as to any Registered Healthcare Professional who submits their Personal Data in connection with a Claim, either as part of a Supporting Evidence Form or at a later date (“you”, “your”).
  2. If a Claimant is claiming a birth defect, we will also collect Personal Data about the Patient’s mother. Where this is the case, we recommend you take steps to ascertain that the Patient’s mother has consented to our use of this Personal Data and that they have read and fully understood this Privacy Policy. Our use of this Personal Data in particular is limited strictly to the purpose for which it has been obtained, and we have appropriate restrictions in place on our systems to ensure that only authorised individuals have access to this type of Personal Data.
  3. To submit a Claim under the Scheme, you must submit a Claim form in the specified format (the “Claim Form”), accompanied by Supporting Evidence in the specified format (the “Supporting Evidence Form”). Claims can be submitted through the web portal at www.c19vaccinenfc.com (the “Web Portal”), by email at [email protected], or by post. This Privacy Policy should be read alongside the Scheme’s Protocol and other forms. Please read this Privacy Policy carefully before submitting a Claim for compensation under the Scheme.
  4. As set out in the Claim Form, by submitting your Claim, you consent (on your own behalf and, where applicable – for example if the Patient is a child – on behalf of the Patient) to our collection, use and processing of your Personal Data as set out in this Privacy Policy for the purposes of our administration of the Scheme. On occasion, where consent is not an appropriate legal basis we may need, to our ability to, rely on alternative bases for processing Personal Data, to the extent required or permitted by Applicable Law (see Section 4 below).
  5. Where the Patient is a child, we will be relying on consent given by the Patient’s duly authorised representative, as per Sections 10 and 11 of the Claim Form.

Contact Us

If you have any questions, please do not hesitate to contact us by email at [email protected], or by regular mail to one of the Scheme’s Regional Centres. We will be happy to answer them.

You can also contact us by calling the Scheme’s Global Telephone Hotline or any of the direct telephone numbers for the Scheme’s Regional Centres, available under the “Contact Us” page of the Scheme’s website at www.c19vaccinenfc.com.

Why Do We Collect and Use Your Personal Data?

  1. The information collected through the submission of your Claim enables us to administer and manage the Scheme, which includes the following activities:
    1. Reception and registration of Claims for compensation under the Scheme.
    2. Verification of your identity, including conducting sanctions checks.
    3. Distribution and acknowledgement of receipt and registration of Claim Forms, including the Supporting Evidence Form.
    4. Review of Claims, including the Claim Form and the Supporting Evidence Form.
    5. Assessment of Receivable Claims.
    6. Approval or denial, as the case may be, of payment for compensation.
    7. Processing of appeals or other proceedings arising from or in connection with the Claim for compensation under the Scheme.
    8. Response to questions and provision of information.
    9. For any purpose required by Applicable Laws.
  2. Except as set out in Section 4.3, our processing of Personal Data for the purposes of administration of the Scheme is based on the consent you or your authorised representative provide when making the Claim. You can withdraw your consent at any time but please note that such withdrawal:
    1. Does not call into question the lawfulness of any processing carried out prior to such withdrawal and based on your consent.
    2. May result in you no longer being able to benefit from the Scheme.
  3. To the extent permitted or required by Applicable Law, we may need to base our processing of Personal Data on alternative grounds to consent in the event that consent is not the appropriate legal basis, such as establishing or defending legal claims, enforcing the terms of the Protocol, or complying with legal requirements.

How Do We Obtain Your Personal Data?

  1. In most cases, we will collect your Personal Data when you (or your authorised representative) submit a Claim for compensation. The Supporting Evidence Form will be completed by one or more Registered Healthcare Professionals, and we may need to seek additional information from such Registered Healthcare Professionals. Unless expressly indicated, the provision of all Personal Data in connection with the Claim or appeals under the Scheme is necessary in order to consider your Claim under the Scheme.
  2. We may also collect Personal Data through the use of cookies and similar technologies when you navigate the Web Portal. Please see our Cookie Policy for further details.
  3. We may also use third party databases to obtain additional Personal Data about you where this is relevant to assessing your claim. In particular, we carry out sanction screening by using a third party database to check your identity against published sanctions lists. We may also run checks designed to identify potentially fraudulent claims by using third party fraud databases.

What Types of Personal Data Do We Collect?

  1. We collect various categories of Personal Data about the Patient, as listed on the Claim Form. This includes basic identity and contact information, as well as national identifiers. It also includes detailed information about the Patient’s history with the Vaccine and the injury which they are claiming to have suffered.
  2. As set out on the Claim Form, we also need contact and identity information about any representative authorised to represent a Patient (if applicable), as well as the identity of and professional information about any Registered Healthcare Professionals submitting information in or with a Supporting Evidence Form.
  3. As part of verifying your identity, we will conduct appropriate checks, including sanction screening against lists published by government, regional or other bodies. Those checks may reveal additional data if you are included on a relevant list. After receiving the Claim Form, we may need to request supplementary medical information from you or from Registered Healthcare Professionals that have completed the Supporting Evidence Form and/or have treated you, in order to fully analyse your Claim. Finally, if we decide to make a payment for compensation under the Scheme, we may need to request further information (such as bank account information) in order to process that payment.

Who Do We Disclose Your Personal Data To?

  1. For the purposes described in Section 1 of this Privacy Policy, we may share your Personal Data with service providers who will process your Personal Data on our behalf to assist us in the management and administration of the Scheme. All such service providers will be bound by contractual obligations to protect your Personal Data.

These service providers include (but may not be limited to):

  1. Crawford & Company International Inc., who will facilitate:
    1. on-the-ground assistance in administrating the Scheme;
    2. assessment of Receivable Claims;
    3. payment of claims if awarded and securing release of the funds;
    4. issuance of compensation denial letters; and
    5. further claims adjusting activities for the Scheme.
  2. NAVEX Global, who help us to provide a global telephone hotline
  3. Soteria, who help to host the website c19vaccinenfc.com and, Soteria’s sub-processors who will provide translation services of the Claims into English of a Claimant’s answers to the Claim Form, but only where: (a) ESIS, following an instruction by UNICEF, notifies Soteria that additional languages are being accepted by the Scheme; (b) the Claimant completes and submits the Claim directly on the Scheme’s Website; and (c) the Claimant’s answers to the online Claim Form are provided in such additional languages notified to Soteria by ESIS.
  4. We may also share your Personal Data with third parties other than our service providers, such as:
    1. The members of the Review Panel, the members of the Appeals Panel and/or any other persons representing and/or advising any of them.
    2. Members of the Chubb group of companies, of which ESIS forms part, strictly to the extent necessary for the purposes listed in Section 4.1.
    3. If applicable, any companies reinsuring risk under the Scheme.
    4. Any local health services, government agencies and intergovernmental organisations as may be required from time to time for the purposes of the risk profiling of vaccines or public health measures or interventions or any other reasonably proportionate activity which may from time to time be required in connection with the Claim or any appeals or other proceedings arising from or relating thereto, or by Applicable Law.
    5. Any law enforcement or governmental organisations as may be required from time to time for the purposes of detecting, preventing or prosecuting criminal activity.
    6. Courts, other governmental organisations, legal advisers or other parties to a dispute where necessary to enforce the Protocol or to otherwise establish, exercise or defend our legal rights.
    7. Any third party insurance company to whom administration of the Scheme is transferred.
  5. We do not sell your Personal Data to third parties. We do not share or otherwise make available your Personal Data to third parties, except as otherwise provided in this Privacy Policy, or required by Applicable Laws.
  6. Please note that when using the Web Portal, this Privacy Policy does not cover how your Personal Data is processed by third parties when we link to their websites. We encourage you to read the privacy policies of other websites you visit.

Where Will Your Personal Data Be Processed?

  1. Your Personal Data is collected from you in your place of origin or residence and transferred to us, in the United States of America, for processing. Where it is necessary for us to transfer your Personal Data to other members of our group of companies (as anticipated by Section 7.4(c) of this Privacy Policy), that transfer will be governed by our intra-group data transfer agreement, which imposes common contractual standards (including, where required by Privacy Laws, standard contractual clauses or equivalent) to protect your data, wherever it is processed.
  2. The service providers listed in Section 7 are based in the United States of America and the United Kingdom. Our contracts with these service providers impose obligations on them to protect your Personal Data to the same standard regardless of where it is processed, and also impose any specific safeguards required by Privacy Laws (such as standard contractual clauses or equivalent). You should be aware that, although we impose contractual obligations that require your Personal Data to be protected to the same standard wherever it is processed, data protection laws in countries where your Personal Data may be processed may not be equivalent to those in your home jurisdiction. The transfer of your Personal Data to these countries is necessary in order for us to assess your Claim under the Scheme.
  3. Where required by Privacy Laws, we will put in place additional safeguards to protect your Personal Data as it is transferred internationally. You may have the right to see a copy of these safeguards by contacting us using the information set out in Section 3 above.

How Do We Secure Your Personal Data?

  1. We attach great importance to the security of your Personal Data and we undertake to use commercially reasonable means to prevent any exposure or disclosure of your Personal Data. In particular, we implement and maintain appropriate measures (including administrative, physical, technical and organisational measures) to deal with unauthorised disclosure or exposure of your Personal Data.

Your Rights With Regards to Your Personal Data

  1. You may have certain rights in respect of your Personal Data such as access to your Personal Data, as set out in Section 10.2 below, depending on Applicable Law. You can exercise these rights by submitting a request as explained in Section 3 above. If you contact us, we will handle your request in accordance with any Applicable Laws. In any case where we do not have a legal requirement to address your request, we will still endeavour to honour your request but this will be on a reasonable and voluntary basis.
  2. You may have in particular the following rights in respect of your Personal Data, depending on Applicable Law:
    • Right to access, update and delete your Personal Data.
    • Right of rectification if your Persona Data is inaccurate or incomplete.
    • Right to object to the processing of your Personal Data.
    • Right to limit the processing of your Personal Data.
    • Right to portability of your Personal Data, i.e. the right obtain a copy of your Personal Data in a structured, commonly used and machine-readable format.
    • Right to withdraw your consent at any time when the processing of your Personal Data is based on consent.
    • Right to complain to any competent data protection authority about the collection and use of your Personal Data, it being specified that we ask that you attempt to address any complaints with us in the first instance.
  3. We may ask you to prove your identity before responding to a request based on the above rights or otherwise related to your Personal Data. We may also rely on certain exemptions from the above rights, but will explain to you where we have done so. If your request is manifestly unfounded or excessive, we may refuse to comply with it.

Retention of Your Personal Data

  1. Subject to Section 11.2 and 11.13, we will retain your Personal Data for no longer than is reasonably necessary for the purposes listed in Section 4 of this Policy.
  2. In some circumstances we may retain your Personal Data for longer periods of time (up to a maximum of seven (7) years from the date a Claim is closed), for instance where we are required to do so in accordance with legal, regulator, tax or accounting requirements.
  3. In specific circumstances we may also retain your Personal Data for longer periods of time (up to a maximum of seven (7) years from the date a Claim is closed) so that we have an accurate record of your dealings with us in the event of any complaints or challenges, or if we reasonably believe there is a prospect of litigation relating to your Personal Data or dealings.
  4. We maintain a data retention policy which we apply to records in our care. Where your Personal Data is no longer required we will ensure it is securely deleted.
  5. We reserve the right to store data in an anonymised form after deletion of your Personal Data.

Changes to this Privacy Policy

  1. We may change this Privacy Policy at any time, without prior notice.
  2. If we make material changes to our Privacy Policy whilst processing your Claim, we will endeavour to inform you of those changes through our normal channels of communication with you.
  3. The new version of the Privacy Policy will be effective on the day of its publication, the date mentioned at the bottom of this Privacy Policy corresponding to the effective date.

Version: December 2021

Scheme

The Covid-19 Vaccine Facility No-Fault Compensation Scheme, established to provide fair compensation to eligible vaccine recipients who suffer a Serious Adverse Event related to a COVID-19 vaccination that has been either:

  • procured and/or delivered by UNICEF on a Participating Country’s behalf;
  • donated to a Participating Country through UNICEF; or
  • formally included into the Scheme (but otherwise procured and/or delivered but not by or through UNICEF),

as detailed in the Scheme Protocol and its Schedules.

Personal Data

Any data that contains one or more identifiers from which the identity of the person can be determined or accessed directly or indirectly such as (but not limited to) their full name, national identification number, social insurance or social security number, passport number, driver’s license, or other government-issued identification number, credit card, debit card or financial account information, date of birth, mother’s maiden name, medical information or health insurance information, biometric records, digital signature files, account login information (such as a combination of user ID or email address when combined with password or other information that would give access to an account), and any other data that is protected by Privacy Laws.

Claim

A written claim for compensation completed by a Claimant, using the Claim Form approved by and provided by the Administrator, as set forth in Schedule 2 of the Scheme’s Protocol, which must be accompanied by all Supporting Evidence.

Patient

A beneficiary of a Vaccine (i) procured and/or delivered by UNICEF on a Participating Country’s behalf; (ii) donated to a Participating Country through UNICEF; or (iii) formally included into the Scheme (but otherwise procured and/or delivered but not by or through UNICEF) who claims or in respect of whom it is claimed that he or she has suffered or sustained a Serious Adverse Event which is associated with a Vaccine or its administration, and which, in turn, has resulted in an Injury.

Registered Healthcare Professional

Any healthcare professional, including physicians, surgeons, nurses, midwives, nurse practitioners, physicians’ assistants, psychiatrists, psychiatrists, physical therapists, occupational therapists, dentists, and pharmacists, who is duly licensed or legally authorised to practice the profession in the country in which the Patient resides and received the Vaccine, or in the case of birth defects, where the Patient’s mother resides and received the Vaccine.

Supporting Evidence

The supporting evidence, using the form in Schedule 3 of the Scheme’s Protocol, required to evaluate a Claim and that shall include:

  1. detailed medical documentation from a Registered Healthcare Professional describing the Injury and medical treatment required as a result of the Injury, together with details of any Hospitalisation or prolonged Hospitalisation, including but not limited to admission and discharge records;
  2. a description of the nature, extent, functional impact and prognosis of the Injury, as assessed by the Registered Healthcare Professional.
  3. a statement from the Registered Healthcare Professional that the Injury was, in the Registered Healthcare Professional’s opinion, the result of the Vaccine or its administration;
  4. certification from a Registered Healthcare Professional of when, where and which Vaccine was administered;
  5. in the case of death, a death certificate and any other documentation available from a Registered Healthcare Professional of the cause and manner of death; and
  6. any further evidence that the Administrator may deem necessary to adjudicate the Claim and/or Receivable Claim, as applicable, guided, as appropriate, by the Scientific Advisory Committee, the Review Panel, and/or the Appeals Panel.
Claimant

Any individual, who meets all of the following requirements:

  1. is a Patient who was administered a Vaccine (or in the event the Patient has died, is a child, or is disabled or otherwise lacks the legal capacity to submit a Claim for himself or herself, is an individual who is a duly authorised heir (in the case of death), parent, legal guardian or other legal representative of the Patient); and
  2. is, or is duly authorised to represent, a Patient who has sustained an Injury which, in the opinion of a Registered Healthcare Professional, is deemed to have resulted from a Vaccine or its administration; and
  3. the Vaccine was administered before its Scope of Coverage Endpoint (as indicated in Schedule 1 of the Scheme’s Protocol); and
  4. has submitted a Claim for compensation, using the prescribed form in Schedule 2 of the Scheme’s Protocol, together with all Supporting Evidence, using the prescribed form in Schedule 3 of the Scheme’s Protocol to the Administrator, following the procedures described in the Scheme’s Protocol, and provided that this Claim is submitted: (a) in full observance of the waiting period of 30 days referred to in Section 1(c) and in Schedules 2 and 3 of the Scheme’s Protocol; (b) before the end of the Reporting Period; and (c) otherwise within the time limits set forth in Section 4 of the Scheme’s Protocol; and
  5.  has not received any prior payment from any other public source, including from any governmental or publically funded no-fault compensation scheme, as compensation for the Injury; and
  6. is not eligible to receive compensation from any other source for the Injury, or if eligible for such compensation, discloses the nature and full extent of such eligibility; and
  7. has no pending lawsuits or claims for compensation for the Injury; and
  8. agrees not to seek or make any claims for compensation from any other public source, including from any governmental or publically funded no-fault compensation scheme, for the Injury for as long as the Claim, and/or Receivable Claim, as applicable, is pending with the Scheme; and
  9. is not and does not represent a Patient in respect of whom the Administrator is by any applicable sanctions regime, including any UN Security Council sanctions regime, precluded from accepting a Claim and/or paying compensation under the Scheme.
Applicable Law

All civil codes, statutes, legislation, regulations, rules, by-laws, instruments, rules of common law, judgments, decrees or orders of any governmental, administrative, supervisory, regulatory or determinative authority, agency, court or other organisation of any jurisdiction, in each case adopted, enacted, implemented, promulgated, issued, entered or deemed applicable by or under the authority of any governmental body having jurisdiction over a specified person or any of such person’s properties or assets from time to time.

Receivable Claim

Any duly completed Claim for compensation (i) that is accompanied by all Supporting Evidence, (ii) that is filed/submitted by a Claimant prior to the end of the Reporting Period with the Administrator, and (iii) that is found by the Administrator, and/or by the Administrator’s Vice President of Risk Consulting to be receivable as provided in Section 4 or Section 7 of the Scheme's Protocol.

Vaccine

A COVID-19 vaccine received in any Participating Country that is either: (i) procured and/or delivered by UNICEF on a Participating Country's behalf; (ii) donated to a Participating Country through UNICEF; or (iii) formally included into the Scheme (but otherwise procured and/or delivered but not by or through UNICEF), that:

  1. either (A) has licensure or authorisation from a stringent (“functional”) regulatory authority or (B) has received WHO prequalification, following licensure or authorisation from a stringent (“functional”) regulatory authority, or (C) has been issued authorisation for emergency use based on licensure or authorisation by a stringent (“functional”) regulatory authority; and
  2. is included in Schedule 1 of the Scheme’s Protocol, as updated from time to time; and
  3. has received all required approvals and authorisations for importation, distribution and use in the relevant country; and
  4. has not reached its Scope of Coverage Endpoint.
UNICEF

An international inter-governmental organisation established by the General Assembly of the United Nations by resolution No. 57(1) of 11 December 1946 as a subsidiary organ of the United Nations.

Review Panel

A panel appointed by the Administrator comprised of 5 duly licensed nurses, selected from a roster of 11 such nurses, who will review all Receivable Claims submitted by Claimants and determine – in accordance with the terms of the Scheme’s Protocol – whether Payment for compensation should be approved or denied.

Appeals Panel

A three-member panel that:

  • Is comprised of 2 duly licensed physicians and 1 duly licensed nurse, who shall be appointed by the Administrator from a roster of 6 such physicians and nurses and
  • Will review all Notices of Appeal of Denied Receivable Claims filed by Claimants and determine – in accordance with the terms of the Program's Protocol — whether the Review Panel’s denial of the relevant Receivable Claim should be upheld or reversed.
Privacy Laws

Any and all applicable international, federal, state, provincial or other local laws, rules, regulations, or regulatory guidance and codes (to the extent binding) relating to data privacy, information security, personally identifiable information, identity theft, data breach notification, trans-border data flow or data protection, as amended from time to time.