Privacy & Legal
WPA takes the privacy and security of your data very seriously. It is important that you take the time to read this page, as it describes the data we collect and explains how we use the information you have provided.
Revised: September 2025
Western Provident Association Limited (WPA) is authorised by the Prudential Regulation Authority and regulated by the Financial Conduct Authority and Prudential Regulation Authority. We are authorised to arrange and underwrite general insurance contracts. Our Financial Conduct Authority registration number is 202608. Our authorisation may be checked against the Financial Services Register at:
fca.org.uk/register
Within the WPA Group:
- WPA Protocol Plc is a wholly owned subsidiary of WPA.
- WPA Healthcare Practice Plc (HCP) is a wholly owned subsidiary of WPA. HCP is authorised and regulated by the Financial Conduct Authority. Its Financial Conduct Authority registration number is 757721.
Western Provident Association Limited (WPA) is a company registered in England and Wales under company number 00475557. Our registered office is Rivergate House, Blackbrook Park, Taunton, Somerset, TA1 2PE. WPA is a company limited by guarantee with no shareholders.
Within the WPA Group the following companies are registered in England and Wales at the same registered office as WPA:
- WPA Protocol Plc under company number 2755175;
- WPA Healthcare Practice Plc under company number 7320330;
- Delos IT Solutions Limited under company number 10458139;
- WPA Insurance Services Limited under company number 2593389;
- WPA Investments Limited under company number 2591944;
- WPA Investments (Development) Limited under company number 2593390;
- Self-Pay Limited under company number 4174987;
- WPA Health Trustee Limited under company number 4562414;
- WPA Pension Trustees Limited under company number 4710981;
- XS Health Limited under company number 3926481;
- XS Insurance Services Limited under company number 3783854; and
- Stoploss Insurance Services Limited under company number 3831968.
In addition, WPA World Class Services (India) Private Limited is a wholly owned subsidiary registered in India under corporate identity number U72400KA2007PTC041954.
WPA and the WPA logo are registered trade marks of WPA.
WPA owns copyright and all other intellectual property rights in the material appearing on the WPA website (unless stated otherwise). You are granted a limited permission to access and browse the contents of the WPA website on any device, and to make reasonable private copies of those contents for your own records. You must not modify or communicate to the public the information available on the WPA website in any way.
You grant us a perpetual permission to copy, communicate and adapt any information or material supplied by you to WPA for the purpose of operating or improving the WPA website and WPA's policies, products or services, supplying policies, products or services to you, and related purposes. This licence is irrevocable and survives the termination of this agreement.
This is an agreement between Western Provident Association Limited (WPA), and you. This agreement governs all of your dealings with WPA, including your use of WPA's website at www.wpa.org.uk (WPA website) and any policies, products or services which you may acquire from WPA or a subsidiary within the WPA Group by means of the WPA website.
This agreement is intended to be legally binding between you and WPA, and comprises the following terms:
- these terms of use;
- the WPA Privacy Policy;
- any terms set out on specific pages of the WPA website; and
- any other terms referenced in those documents.
Acceptance of this agreement
By using the WPA website or acquiring any policies, products or services from WPA or a subsidiary within the WPA Group, you agree to be bound by this agreement and give your consent to our privacy policy. You also warrant that you have read and understood the terms of this agreement.
If you do not agree to this agreement, you should not access or use the WPA website or any of its related services.
If you register for or login to a user account on the WPA website, you must:
- agree to this agreement;
- provide us with the information which is necessary to create or access your user account, including your email address, chosen password, registration type, customer number, and details of your policies or services with WPA;
- choose a secure password;
- keep your username and password secure, and in particular must not reuse your password on other websites or for services supplied by third parties; and
- use your user account in good faith and in accordance with this agreement.
If you believe that your username and password may have been accessed by an unauthorised person, or that unauthorised use has been made of your user account, you must tell us immediately. You must also change your password as soon as possible.
We reserve the right to cancel your user account at any time should you (or anyone having access to it) use it to breach this agreement, act unlawfully, create a risk of disruption to the WPA website or of otherwise interfering in the business or services of WPA.
You may access and make use of the WPA website in accordance with this agreement.
You must not:
- copy, communicate to the public, adapt or otherwise use any part of the WPA website or its source code, except as permitted by this agreement or by law;
- use any automated means to copy or 'scrape' content from the WPA website, other than the normal use of RSS and other syndication tools;
- impersonate any other person while using or accessing the WPA website, unless acting as that person's authorised agent within the scope of your authority;
- use or attempt to use any other person's username, password or personal data;
- offer or expose for sale, sell, transfer (whether for payment of a fee or otherwise) any person's user account on the WPA website;
- circumvent or attempt to circumvent any technical protection measures, security, or access controls on or utilised by the WPA website;
- access any of WPA's web servers, databases or other systems, or probe or test their security, when you do not have authorisation to do so;
- interfere or attempt to interfere with the normal operation of the WPA website by any means (including by denial of service or similar attacks, spam, the use of trojans or backdoors, injection or other malicious attacks); or
- access or use the WPA website in a manner, or for a purpose, contrary to the law of England and Wales.
If we consider (in our sole discretion) that your use of the WPA website breaches this agreement, we may terminate, suspend or restrict your access to the WPA website, your user account (if any), and your ability to communicate with WPA by electronic means. We may also take such further action as we consider appropriate in the circumstances to protect the legitimate interests of WPA and our customers, including legal proceedings, working with law enforcement authorities, and communicating details of any actual or suspected wrongdoing.
Nothing in this agreement grants you unfettered access to the WPA website and we may at any time restrict access to you, your internet service provider or a device within any geographical area.
To the maximum extent permitted by law, WPA is not liable to you for any loss or damage (including without limitation, loss of business, loss of profit or consequential loss) arising from your use of or inability to use the WPA website, and disclaims all liability for such loss or damage. For example, WPA will not be liable to you for:
- errors in the materials on the WPA website or any fault in its operation or availability;
- loss or damage arising from the transfer of data to or by you using the WPA website or any electronic facility provided by WPA;
- loss or damage to your computer equipment or software;
- loss of profits, loss of business or goodwill or similar losses;
- data corruption or loss;
- changes made to the WPA website or any part of it;
- pure economic loss; or
- special, indirect or consequential loss;
- unauthorised access to your user account which results from the reuse of your username or password with other websites, or the use of an insecure password; or
- security breaches involving the WPA website, your stored or transmitted data, or similar events.
In each case whether or not the loss or damage is caused by our negligence. However, nothing in this agreement will exclude, limit or restrict any liability which cannot be exclude, limited or restricted as a matter of law.
The content of the WPA website is not a substitute for professional medical advice or treatment and you should not rely upon it for that purpose. Practitioners and hospitals named on this website meet WPA's recognition criteria but you should make your own full enquiries as to expertise and WPA makes no representation to the suitability, quality, reputation, experience or other attributes of those third parties' services.
WPA assumes no responsibility for the services supplied by third parties and, to the maximum extent permitted by law, excludes all liability to you for any loss or damage caused by third parties whom you identify from the WPA website. This exclusion of liability shall also apply to third parties who have acted negligently.
WPA excludes, to the maximum extent permitted by law, any liability for indirect, consequential or special loss, loss of profits, loss of goodwill, emotional distress, inconvenience, disappointment, loss of opportunities, or any similar head of loss.
To the maximum extent permitted by law, all risks associated with your access to and use of the WPA website, and any policies, products or services acquired by means of that website, are allocated to you. You agree that the aggregate liability of WPA in connection with this agreement, or in respect of your use of or access to the WPA website, will not exceed the sum representing the amount that you have paid to WPA during the 12 month period preceding the event giving rise to any such liability or, if no such amounts have been paid by you, then the sum of £100.
The WPA website contains links to other websites over which WPA has no control. It is the responsibility of third parties to ensure that all such material and websites comply with applicable laws and regulation. WPA does not assume any responsibility for such websites and excludes all liability to you for any loss or damage caused by your reliance upon material contained on those third parties' websites.
Material posted on or any comment or bulletin boards, blogs, social media platforms or other electronic channels maintained by WPA or a subsidiary within the WPA Group represents the views of its author and not of WPA. WPA assumes no responsibility for that material and excludes all liability arising from its publication or dissemination.
All warranties and terms (whether express, implied, statutory or otherwise) are, to the fullest extent permitted by law, excluded, save that nothing in this agreement is intended to exclude WPA's liability for death or personal injury caused by its negligence or for fraud or fraudulent misrepresentation, or to exclude any terms which are non-excludable by reason of the Consumer Rights Act 2015 or any other applicable legislation.
WPA may terminate this agreement at any time without cause, and may at its sole discretion modify or cease the operation of any part of the WPA website or any policies, products or services offered on it (subject to any specific terms and conditions applicable to policies, products or services you may have acquired).
You agree that WPA's privacy policy (as amended from time to time) will apply to the collection, processing and disclosure of your personal data by WPA and any of its nominated data processors. You warrant that you have read and understood the terms and conditions of that policy, product or service, and you give your consent to it.
Privacy Policy For the purposes of this section, the term 'Policy' shall include, and be interchangeable with, the terms 'Scheme,' 'Cash Plan' and 'Plan.'
How we collect information about you
We primarily collect your personal information from you or from someone on your behalf. For details of other sources of information please refer to our Privacy Policy.
What information we collect
The personal information about you or your family member(s) that we may process includes basic personal information such as name, address, date of birth and contact details, communication information, information about your employment, your banking or payment details and device identifiers including IP addresses.
We also process health data and criminal offence/fraud related data.
Please refer to our Privacy Policy for more information.
How we use information about you
We process your personal information for the purposes detailed in our Privacy Policy. This is primarily to identify you and provide our services and to communicate with you. This includes activities involved in administering your Policy. We also use data for statistical analysis and to improve our products and services.
We may use your personal information to provide advice and information about our services, to produce quotes for our services to you, to manage complaints, to protect our rights and to comply with our legal, taxation and regulatory obligations.
Before we provide services to you, we undertake checks for the purposes of preventing financial crime, fraud, money laundering and to verify your identity. These checks require us to process your personal data.
We can only process your personal data where we have a lawful basis to do so. Our lawful bases are set out in our Privacy Policy. Our primary lawful basis for processing your personal data is because it is necessary in relation to a contract for us to provide our services to you. Other lawful bases which may apply are where we have a legitimate interest or where our processing is necessary to comply with law. For health data we may seek your consent to our processing, or our processing may be necessary for an insurance purpose. Where we process criminal conviction and offence data we do so on the basis that this is necessary to prevent or detect fraud or another crime.
Sharing information
Companies within the WPA Group (including Western Provident Association Limited, WPA Protocol Plc, WPA Healthcare Practice Plc, WPA World Class Services (India) Private Limited) may share personal data as needed with each other.
In providing our services to you we need to share your personal data with third parties.
The people we may share your personal data with include:
- Our data processors, including our trusted third party service providers;
- People who you have authorised us to share data with;
- Your treatment providers;
- The Policyholder, or person who arranged your Policy including your employer;
- Our regulators or taxation agencies or otherwise as required by law.
We may also share your personal data as needed where it is in your vital interests such as in an emergency.
We never share customer data for the purpose of a third party marketing their services.
Please refer to our Privacy Policy for full details of our data sharing.
Transferring data to other countries
We may share your personal data (including medical information and other special category personal data), in strict confidence with our service providers, other companies within the WPA Group or other entities that are located outside of the UK. If we do transfer your personal data outside of the UK, we will ensure that it is protected to the same extent as it is protected in the UK by using one of the safeguards listed in our Privacy Policy.
Automated processing
We use automated processes to assist with efficiency and accuracy. We may make some decisions in relation to your Policy including using automated means. We may also use automated processing/profiling to assist us in setting our prices for our Policies. If we make any significant decision by solely automated decision, you have the right to ask us to review the decision.
Your data protection rights
You have rights under data protection law. This includes the right to access your data, to ask us to delete or correct your data, to restrict our processing of your data or to transfer it to a third party. You may also object to our processing of your data. There are exemptions and limitations to these rights.
You must notify us of any changes to your personal information such as a change to your name, address or email to ensure your personal information is correct and up to date.
For more information or to exercise your data protection rights please refer to our Privacy Policy.
Communications
Subject to your chosen communication method, we use email as our primary method of communication when we need to communicate with you on claims, medical or administrative matters. For security, all of our emails containing special category data are either hosted in a secure online account and you will be notified by email when you have a message, or are sent with an additional security feature in place. Please remember that the email address you give us must be secure and not accessible by anyone else. By providing your email address you are consenting to its use for services we provide to you which may include the provision and/or receipt of claim and medical information as well as the administration of your Policy. In the event of any unforeseen circumstance, such as a pandemic, we may need to default to email communication on a time-limited basis.
How long we retain your personal data
We will hold and process your personal data whilst you are insured under a Policy with WPA so that we may administer your Policy. Following termination of your Policy we will retain your data for up to seven years, or longer where needed in a limited number of specific circumstances as permitted by law. More information can be found in our Privacy Policy.
Data protection contacts
You can contact us in writing or email: dataprotection@wpa.org.uk. You also have a right to complain to the Information Commissioner's Office which regulates the processing of personal data. For more information please visit: https://ico.org.uk
Financial Crime and Fraud
To detect and prevent fraud, financial crime or improper claims we check details with fraud prevention agencies. Additionally, we work with other organisations including other insurers to pool information about applications or claims. When we and fraud prevention agencies process your personal data, we do so on the basis that we have a legitimate interest in preventing financial crime, fraud, money laundering and to verify identity, in order to protect our business and to comply with laws that apply to us. Such processing is a contractual requirement of the services you have requested. We, and fraud prevention agencies, may also enable law enforcement agencies to access and use your personal data to detect, investigate and prevent crime. Fraud prevention agencies can hold your personal data for different periods of time, and if you are considered to pose a financial crime, fraud or money laundering risk, your data can be held for up to six years.
Where any potential financial crime, fraud or improper claim is suspected by us, notified to us, or identified by us, we will investigate. If we, or a fraud prevention agency, determine that you pose a financial crime, fraud or money laundering risk, we may refuse to provide the services you have requested, or we may stop providing existing services to you. A record of any financial crime, fraud or money laundering risk will be retained by fraud prevention agencies and may result in others refusing to provide services, financing or employment to you. If we conclude you have, or any family member has, committed fraud, financial crime or submitted an improper claim (or attempted to do so) then we reserve the right to notify the person who pays the premium which may include an employer or family member. If we obtain evidence of fraud, financial crime or reckless or deliberate misrepresentation in relation to your Policy we will avoid the contract and refuse all claims and will not refund any premiums paid. Further, we will take legal action to recover all losses to us including any claims we have paid, the interest on these sums and all associated costs. Fraud prevention agencies may allow the transfer of personal data outside of the UK. This may be to a country where the UK Government has decided that your data will be protected to UK standards, but if the transfer is to another type of country, then the fraud prevention agencies will ensure your data continues to be protected by ensuring appropriate safeguards are in place.
Unless otherwise indicated, content of the WPA website is directed solely at people accessing the site from the United Kingdom, the Channel Islands and the Isle of Man. If you choose to access the WPA website from another location, you are responsible for compliance with any applicable local laws.
If you consider that any content on the WPA website consists of unlawful activity or information, please tell us by contacting our authorised representative using the following contact information:
Please include your WPA customer number with any correspondence.
Group Legal
Western Provident Association
Rivergate House
Blackbrook Park
Taunton, Somerset
TA1 2PE
United Kingdom
Tel: 01823 625000
Email: grouplegal@wpa.org.uk
Any report of content on the WPA website (whether or not related to copyright) must:
- relate to contact hosted on https://www.wpa.org.uk;
- identify the full URL of the content said to be unlawful;
- identify the copyright owner or other person whose rights are said to be infringed;
- if you are an agent, identify on behalf of whom you act and state that you are their authorised representative;
- include a description of any copyright works or other rights which you allege are being infringed, and explain why they are being infringed;
- include your contact details (including your name, address, email address, telephone number, username (if any), and address for service);
- include a statement that you have a good faith belief that the disputed use of the material is not authorised by the right-owner, his or her agent or the law; and
- include a statement that the information in your notification is accurate.
Upon receipt of a valid notification, we will take such action as we consider (in our sole discretion) appropriate in the circumstances, including removal of the identified content within an expeditious period. However, we reserve the right to take no action until a notification containing all of the details set out above is received.
WPA may at any time assign any or all of its rights and obligations under this agreement without notice to you, whether as part of an acquisition of WPA or otherwise.
You may not assign this agreement or any rights or obligations under it to any third party without WPA's prior written consent.
If any part of this agreement is held to be unenforceable, that part shall be severed (or construed or read down) to the minimum extent necessary and the remaining parts of this agreement will be enforceable.
This agreement is governed by the laws of England and Wales. You agree to submit to the exclusive jurisdiction of the courts of England and Wales for resolution of any dispute arising under or in relation to this agreement.
This agreement is not intended to confer rights upon any third party except you and WPA and the Contracts (Rights of Third Parties) Act 1999 does not apply.
This agreement is in addition to any terms and conditions which apply to particular policies, products or services which you may acquire from WPA.
To the extent of any inconsistency between this agreement and the specific terms and conditions applicable to a particular policy, product or service supplied by WPA, or the specific terms and conditions applicable to a part of the WPA website, those specific terms and conditions shall prevail.
This agreement (together with any specific terms and conditions applicable to a particular policy, product or service supplied by WPA) constitutes the entire agreement between you and WPA in relation to the subject matter of this agreement, and supersedes any previous agreement or representation between you and WPA.
WPA may amend this agreement or any part of it at any time. Such amendments shall be binding on you and will take immediate effect. If you continue to access or use the WPA website after amendments to this agreement come into effect, such access and use will be subject to the terms of this agreement.
We are a member of FSCS. FSCS is the UK's compensation fund of last resort for customers of authorised financial services firms including insurers. FSCS may pay compensation if an insurer is unable, or is not likely to be able, to pay claims.
For more information please visit:
www.fscs.org.uk Find out more about our annual reports, policies and statements including information on our leaders, values, culture and governance.
Corporate governance Information for current members of The Western Provident Association Pension Scheme.
Please visit:
The Western Provident Association Pension Scheme