Privacy Policy of MDA National Group and company details

This policy applies to the MDA National Group, which is made up of MDA National Limited ABN 67 055 801 771 (MDA National) and all of MDA National’s subsidiaries including MDA National Insurance Pty Ltd ABN 56 058 271 417, AFS Licence No. 238073 (MDA National Insurance).

Within this policy, ‘we’, ‘our’ and ‘us’ means the MDA National Group.

 

Commitment

Your privacy is important to us. We are committed to protecting the privacy, confidentiality, integrity and security of the personal information we collect, hold, use and disclose. We recognise privacy as an important part of good governance, information security and risk management and are committed to handling personal information in a lawful, transparent, and responsible manner.

This Privacy Policy explains how we manage personal information in accordance with the Privacy Act 1988 (Cth) (Privacy Act), including the Australian Privacy Principles (APPs), the Notifiable Data Breaches (NDB) Scheme and other applicable privacy and regulatory obligations, including APRA Prudential Standards where applicable.

This Privacy Policy is current as of August 2026.

 

Our Privacy Principles

Our approach to privacy is guided by the following principles:

• personal information is handled lawfully, fairly and transparently;
• we only collect, use and disclose personal information that is reasonably necessary for legitimate business purposes;
• we take reasonable steps to ensure personal information is accurate, secure and up to date;
• access to personal information is restricted to authorised persons with a legitimate business need;
• personal information is retained only for as long as necessary and securely destroyed or de-identified when no longer required; and
• individuals are supported to exercise their privacy rights, including rights of access and correction.

 

What Personal Information We Collect

Personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable

The types of personal information we may collect include:

• your name, residential and email address, date of birth, gender, telephone number and other contact details;
• identity verification information, including publicly available information from public registers, professional directories or social media where appropriate;
• details relating to claims, complaints, incidents, investigations or proceedings involving individuals covered under a policy issued by us;
• insurance history, claims history and health information;
• billing information, payment details and direct debit or credit card information;
• qualifications, education and professional practice details;
• signatures and records relating to transactions or communications with us; and
• information relating to suppliers, contractors, service providers and employees of the MDA National Group.

In some circumstances, we may collect sensitive information, including information relating to your health or criminal history where reasonably necessary for our functions or activities and permitted by law.

Where practical and required by law, we will seek your consent before collecting sensitive information

 

How We Collect Personal Information

We collect personal information directly from you through:

• our websites, digital platforms and online forms;
• email, telephone and written correspondence;
• applications, claims, membership forms and service requests;
• meetings, events and training activities; and
• social media interactions where relevant.

 

We may also collect personal information from third parties, including:

• persons authorised to act on your behalf;
• brokers, authorised representatives and related entities;
• service providers engaged to administer products or services on our behalf;
• medical practitioners or health providers where authorised or permitted by law;
• applications, claims, membership forms and service requests;
• government agencies, regulators and industry bodies; and
• publicly available sources.

 

Where reasonable and practicable, we will collect personal information directly from you.

If you provide personal information about another person, you should ensure you are authorised to do so and that the individual is aware of this Privacy Policy.

At or before the time of collection, we take reasonable steps to notify individuals why the information is being collected, how it will be used and disclosed, and how privacy rights may be exercised.

We store personal information in both electronic and physical formats. Electronic records may be stored on systems managed by us or by trusted third-party service providers.

 

Why We Collect, Use and Disclose Personal Information

We collect, use and disclose personal information to:

• provide insurance, assistance, membership and related services;
• assess and administer applications, claims and complaints;
• manage investigations, disputes and legal proceedings;
• administer and improve our products, services and operations;
• communicate with you regarding products, services and regulatory obligations;
• provide educational material, training and professional resources;
• obtain and maintain reinsurance arrangements;
• comply with legal, regulatory and reporting obligations;
• administer government schemes and industry programs;
• conduct analytics, research andservice improvement activities; and
• market products and services where permitted by law.

We seek to collect only the minimum amount of personal information reasonably necessary to carry out our functions and activities.

We may also use or disclose personal information for any other purpose notified to you at the time of collection or otherwise permitted by law.

 

Opting Out of Non-Compulsory Communications

You may opt out of receiving marketing and other non-compulsory communications from us at any time. This includes educational, training, and professional resource emails, events, corporate initiatives, and information about our products and services. You can opt out by using the unsubscribe link in our electronic communications or by contacting us using the details provided on our website.

If you opt out of marketing communications, we may still send important service-related communications. These may include notices relating to your membership, insurance cover, payments, claims, policy updates, security matters or other communications we are legally required to provide.

 

Who We Disclose Personal Information To

We may disclose personal information to:

We collect, use and disclose personal information to:

• reinsurers, brokers and underwriting partners;
• medical practitioners and health consultants;
• legal advisers, auditors, accountants and actuaries;
• IT providers, cloud hosting providers and cybersecurity consultants;
• claims managers and other service providers;
• regulatory authorities, government agencies, tribunals and courts;
• related entities within the MDA National Group; and
• any other party where you have consented or where disclosure is authorised or required by law.

 

We take reasonable steps to ensure third parties handling personal information on our behalf are subject to appropriate privacy, confidentiality and information security obligations.

 

Automated Decision-Making

We do not use solely automated decision making to make decisions that significantly affect you.

We do use automated processing to support certain business activities, including the assessment of low risk insurance applications and the calculation of insurance premiums. These processes are based on defined business rules and are subject to meaningful human oversight and review. Automated processing is used to support, rather than replace, human decision-making.

 

Overseas Disclosure of Personal Information

Personal information is primarily stored in Australia. Where necessary to support business operations, authorised access, transfer or disclosure may occur to approved overseas jurisdictions, currently limited to the Asia-Pacific (APAC) region, the United States, the United Kingdom, and Canada.

Overseas access or disclosure is limited to approved personnel and service providers, including reinsurers, brokers, technology providers and administrative service providers, and must be authorised and for a legitimate business purpose.

We implement appropriate technical, contractual and organisational controls to protect personal information during cross-border handling. Personal information must not be downloaded, stored or transferred to unauthorised devices or repositories.

We maintain record of overseas disclosures and conduct appropriate due diligence and ongoing oversight of overseas recipients to ensure compliance with Australian privacy laws and APRA regulations.

 

Cookies and Website Technologies

We use cookies, analytics tools and similar technologies to operate, secure and improve our websites and digital services.

These technologies help us understand website usage, improve user experience, maintain security and support website functionality.

You may manage or disable cookies through your browser settings; however, some website features may not function correctly if cookies are disabled.

 

Privacy Risk Management

We assess privacy risks associated with new or materially changed business activities, systems, products, services and third-party arrangements.

Where appropriate, Privacy Impact Assessments (PIAs) are conducted to identify and manage privacy risks before implementation.

We may also use automated systems and technologies to support operational, risk assessment or administrative processes. Appropriate oversight and controls are maintained over these activities.

 

Data Security and Retention

We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure

Our safeguards include physical, technical and organisational security measures such as:

• secure premises and access controls;
• encryption and multi-factor authentication;
• system monitoring and cybersecurity protections;
• role-based access controls and audit logging
• staff training and confidentiality obligations; and
• regular review and testing of security controls.

Where appropriate, personal information may be de-identified or anonymised for analytics, benchmarking, research or reporting purposes.

We retain personal information only for as long as reasonably necessary to fulfil our business, legal and regulatory obligations. When no longer required, personal information will be securely destroyed or de-identified in accordance with our Records Retention and Destruction Policy

 

Data Breaches

We maintain processes and procedures to identify, investigate, respond to and manage suspected privacy incidents and data breaches.

Where required under the Notifiable Data Breaches (NDB) Scheme, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) of eligible data breaches.

 

Access and Correction

You may request access to the personal information we hold about you and request correction of information that is inaccurate, incomplete, out-of-date, irrelevant or misleading.

Requests may be made using the contact details below. We may need to verify your identity before processing your request.

We will respond within a reasonable timeframe and, where practicable, within 30 days of receiving your request.

In some circumstances, we may refuse access or correction where permitted by law. If this occurs, we will provide written reasons and information about available complaint avenues.

A reasonable administrative fee may apply where permitted by law.

 

Freedom of Information

Where applicable, you may request access to documents containing your personal information under the Freedom of Information Act 1982 (Cth) (FOI).

FOI requests must be submitted in writing and include sufficient detail to identify the documents requested. Applicable fees, statutory timeframes and exemptions may apply.

If access is refused or limited, we will provide written reasons and information regarding available review rights.

 

Complaints

If you believe your privacy rights have been breached, you may lodge a complaint with us using the contact details below

We aim to acknowledge complaints promptly and respond within 30 days where practicable.

If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC).

 

Office of the Australian Information Commissioner

OAIC Website
Director of Compliance
Office of the Australian Information Commissioner
GPO Box 5218
Sydney NSW 2001

 

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in legal requirements, technology, business practices or services.

The most current version will always be available on our website.

 

How to contact us

Privacy Officer
The Privacy Officer
MDA National
Level 9, 412 St Kilda Road
Melbourne VIC 3004

Email: privacy@mdanational.com.au
Phone: (03) 9915 1700