1. Who we are
MontCove Ltd ("MontCove", "we", "us") is the controller of your personal information. We are an AI Native InsurTech MGA, authorised and regulated by the UK Financial Conduct Authority (FCA), FRN 1057139. We are registered in England and Wales, company number 17179801, with our registered office at Grove House, 55 Lowlands Road, Harrow, HA1 3AW, United Kingdom. We are registered with the Information Commissioner's Office under registration number ZC235373.
For anything to do with your personal information, contact our data protection lead at info@montcove.com or write to us at the address above.
Our products are distributed through partners and underwritten by Underwriters and reinsurers. Where a partner or Underwriter makes its own decisions about your information, it is a separate controller and its own privacy notice applies alongside this one.
2. Information we collect
- Identity and contact details — name, date of birth, address, email, telephone, and identity documents where we must verify who you are.
- Policy and payment details — the cover you ask for, quotes, policy documents, premiums, bank or card details (processed by our payment provider) and correspondence with us.
- Health information — answers to health questions, medical reports relevant to a claim and, if you choose to use it, the output of the AVA facial health check (see section 4). This is special category data and is treated with additional care.
- Biometric information — if you choose face-match identity verification, a facial template used only to confirm that you are the person on your identity document.
- Claims information — details of the incident, supporting evidence, medical and travel records, and payments made.
- Technical and usage information — device type, IP address, pages visited and how you use our app and website (see section 10).
- Information from others — from the partner you bought through, Underwriters, medical assistance providers, fraud prevention agencies, claims databases and publicly available sources.
3. How we use your information and our lawful bases
| Purpose | Lawful basis under UK GDPR |
|---|
| Providing quotes, arranging and administering your policy, collecting premiums and sending policy documents | Performance of a contract with you, or steps you ask us to take before entering one |
| Using health information to assess risk, price your cover and handle claims | Your explicit consent; and, where applicable, the insurance condition in the Data Protection Act 2018 (Schedule 1, paragraph 20) |
| The AVA facial health check and health score | Your explicit consent, which you can withdraw at any time |
| Face-match identity verification | Your explicit consent |
| Handling and paying claims, and managing complaints | Performance of a contract; legal obligation; legitimate interests in managing claims fairly |
| Preventing and detecting fraud and financial crime, and sanctions screening | Legal obligation; legitimate interests in protecting members and Underwriters; substantial public interest conditions in the Data Protection Act 2018 |
| Meeting our obligations to the UK Financial Conduct Authority and other regulators, including record-keeping, reporting and monitoring customer outcomes | Legal obligation |
| Improving our products, training our teams and testing our systems, using anonymised or pseudonymised information wherever possible | Legitimate interests in running a safe and effective business |
| Telling you about MontCove products and services that may interest you | Your consent, or our legitimate interests where the law allows, always with an easy way to opt out |
Where we rely on legitimate interests, we have checked that our interests are not outweighed by your rights. You can ask us for details of these assessments.
4. AVA, health data and automated decisions
AVA, the Artificial Virtual Assistant at the centre of our platform, carries out a 60-second facial health check on your device to produce a health score. The check is optional. AVA is the fastest route to cover: a 60-second check on your phone, no forms, no medical examination, a result in minutes and, where your indicators support it, access to an optimum premium route. You can choose not to use AVA and still apply. We then assess your application manually, on our standard terms, by email or telephone; because a person gathers and checks the information, this route takes a minimum of 72 hours. Members who complete the scan may qualify for better pricing and benefits; members who don't are offered our standard terms.
- We ask for your explicit consent before the check starts, and explain at that point what is measured and how the score is used.
- The score may be used, together with your other answers, to assess risk and price your cover. Where a decision about you would be made solely by automated means and would significantly affect you, you have the right to ask for a person to review it, to express your point of view, to contest the decision and to receive an explanation of how it was reached.
- We do not decline cover or a claim on the basis of the AVA score alone without a person reviewing the decision.
- Images captured during the check are used only to generate the score. The AVA consent screen tells you how long, if at all, images are kept, and they are never used for any other purpose.
- You can withdraw your consent to the use of your health score at any time by contacting us; this will not affect processing that has already taken place.
5. Who we share your information with
We share personal information only where it is needed to provide our products and services, to meet our legal obligations, or where you have agreed. Recipients include:
- the Underwriters and reinsurers that underwrite MontCove products;
- the distribution partner, employer or affinity group through which you obtained your cover;
- claims administrators, medical assistance and repatriation providers, loss adjusters and medical experts;
- technology, hosting, communications, payment and identity-verification providers acting on our instructions as processors;
- fraud prevention agencies and claims and underwriting databases used across the insurance industry;
- the UK Financial Conduct Authority, the Financial Ombudsman Service, the Information Commissioner's Office, law enforcement and courts where required;
- our professional advisers, auditors and, in the event of a reorganisation or sale, a prospective purchaser under confidentiality obligations.
We do not sell personal information.
6. International transfers
MontCove operates from the United Kingdom. Some of our partners and service providers are located outside the UK. Where personal information is transferred outside the UK, we make sure it is protected by UK adequacy regulations, the UK International Data Transfer Agreement or Addendum, or another safeguard recognised under UK law. You can ask us for a copy of the relevant safeguard.
7. How long we keep your information
- Quotes that do not become policies — 12 months from the quote date.
- Policy and claims records — for the life of the policy and for 6 years after it ends or the claim is settled, whichever is later, in line with FCA record-keeping expectations and the limitation period for legal claims. Some records may be kept longer where a claim could still arise, for example for long-term personal accident or critical illness cover.
- Health information and AVA outputs — no longer than needed for the purpose for which you gave consent and the retention periods above; images as set out in section 4.
- Marketing preferences — until you opt out, after which we keep only enough to respect your choice.
- Website visits — our website sets only strictly necessary cookies; see section 10.
8. How we protect your information
We use encryption in transit and at rest, access controls, logging and monitoring, staff training and tested business continuity arrangements. Our providers are assessed before we use them and are bound by written contracts. If a breach is likely to put your rights at risk we will tell you and the Information Commissioner's Office as the law requires.
9. Your rights
Under UK data protection law you have the right to:
- access the personal information we hold about you;
- have inaccurate information corrected and incomplete information completed;
- have your information erased in certain circumstances;
- restrict how we use your information in certain circumstances;
- receive the information you gave us in a portable format;
- object to processing based on legitimate interests, and to direct marketing at any time;
- not be subject to a solely automated decision with legal or similarly significant effects, and to the safeguards described in section 4;
- withdraw consent at any time where consent is our lawful basis.
To exercise any right, email info@montcove.com. We will respond within one month and will not charge a fee unless the law allows it. We may need to confirm your identity first. If you need this notice in another format or language, or need support to exercise your rights, please tell us; our Customer Care page explains the help available.
10. Cookies
Our website uses only strictly necessary cookies, for example to keep approved partners signed in to the partner area. We do not currently use analytics or advertising cookies. If we introduce analytics cookies in future we will ask for your consent first and update this notice.
11. Complaints
If you are unhappy with how we have handled your personal information, please contact us first at info@montcove.com so that we can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or by calling 0303 123 1113.
12. Changes to this notice
We review this notice at least annually and whenever our processing changes. The version and effective date are shown at the top of the page. Where a change is significant we will tell you directly.