mBIL Mobile Application - Privacy Policy, 2026

Bhutan Insurance Limited (BIL) · Version 3.0 · Effective 19 October 2026

Document Controls

1. Introduction

Bhutan Insurance Limited (BIL) is committed to protecting the privacy, confidentiality, and security of its customers’ personal, financial, insurance, and loan-related information.

This Privacy Policy explains how BIL collects, uses, processes, stores, shares, and protects information through the mBIL Mobile Application (“mBIL App” or “the App”).

The App provides digital access to BIL’s insurance services, insurance premium payments, loan EMI repayments, claim reporting, and other available services.

BIL processes personal information in accordance with applicable laws, regulatory requirements, and its legitimate operational and service requirements.

2. Scope of Services

The mBIL App provides customers with access to the following services, subject to availability:

2.1 Insurance services

• Access to insurance policy information.
• Insurance premium payments.
• Policy-related service requests and information.
• Submission of documents required for insurance services.

2.2 Loan and credit services

• Access to applicable loan information.
• Loan EMI and instalment repayments.
• Viewing available payment status and transaction references.
• Other loan servicing functions supported by the App.

2.3 Claims services

• Insurance claim intimation and reporting.
• Submission of photographs and supporting documents.
• Provision of incident details required for claim assessment.
• Access to claim-related updates where available.

2.4 Digital payment services

The App facilitates eligible bank transactions through RMA Merchant Payment Services and associated participating banks or payment service providers.

3. Information We Collect

Depending on the services you use, BIL may collect and process the following categories of information.

3.1 Personal identification information

• Full name.
• Citizenship Identity Card (CID) number or other relevant identification details.
• Mobile phone number.
• Email address.
• Residential or mailing address, where required.
• Customer identification and verification information.

3.2 Insurance information

• Insurance policy numbers and policy details.
• Premium amounts and payment status.
• Claim reference numbers and claim-related information.
• Documents submitted for insurance services.

3.3 Loan and credit information

• Loan account and facility references.
• Outstanding loan amounts and instalment details.
• EMI amounts, due dates, and repayment status.
• Loan repayment history and related transaction information.

3.4 Financial and transaction information

• Payment amounts, dates, and transaction references.
• Relevant policy or loan account identifiers.
• Payment status and reconciliation records.
• Banking or payment account identifiers required to process transactions.

3.5 Documents submitted by customers

BIL may collect photographs, scanned documents, receipts, identification documents, claim evidence, forms, and other files submitted through the App for insurance, loan, claim, or related services.

3.6 Device and technical information

The App automatically collects technical information generated by the device or application, including device information, operating system and App version, diagnostic logs, session information, and security-related events.

The App also automatically captures SMS information and device location information from the customer’s device, without requiring the customer to enter or submit it. This information is used for authentication, security, fraud prevention, and claim-related functions.

This information is used only for the purposes described in this Policy.

4. Why We Collect and Use Your Information

BIL collects and processes information for the following purposes:

1. Service delivery: To identify customers and provide access to insurance, loan, claims, and other available services.
2. Payment processing: To initiate, process, verify, record, reconcile, and confirm insurance premium and loan EMI payments.
3. Claim processing: To register claims, receive supporting evidence, assess claims, and facilitate claim settlement.
4. Identity verification: To verify customer identity and protect against unauthorised access.
5. Fraud prevention: To identify suspicious transactions, potentially fraudulent claims, and unauthorised activities.
6. Customer communication: To provide service updates, transaction confirmations, and relevant notifications.
7. System security: To monitor application performance, troubleshoot technical issues, and investigate security incidents.
8. Regulatory compliance: To comply with applicable laws, RMA requirements, audits, reporting obligations, and lawful requests from competent authorities.
9. Record management: To maintain customer, policy, loan, claim, and transaction records for the required retention period.

5. Device Information and Application Functions

The mBIL App processes certain device-related information automatically to support its functions. The following sections explain what is processed and why.

5.1 Camera

The App uses the device camera when a customer captures photographs or supporting evidence for insurance claims or other services requiring photographic documents.

The camera is used only for these functions and is not used for unrelated purposes.

5.2 Storage, Photos, and Files

The App allows customers to select and upload documents and photographs stored on their devices. These include claim evidence, receipts, identification documents, and other supporting files required for BIL services.

Only the files selected by the customer for the relevant service are uploaded.

5.3 SMS and Verification Information

The App automatically captures SMS information on the customer’s device, without requiring the customer to enter or submit it. This is used to support OTP verification, authentication, and transaction-related security functions.

SMS access is subject to the permissions granted on the customer’s device. SMS information is used only for the purposes described in this Policy.

5.4 Device Information

The App automatically collects device and technical information to support authentication, application compatibility, troubleshooting, fraud prevention, and security monitoring.

5.5 Location Information

The App automatically captures the location of the customer’s device, without requiring the customer to enter it. Location information is used for security verification, fraud prevention, verifying the location of an insured incident for claims, and maintaining accurate transaction records.

Location information is used only for the purposes described in this Policy.

5.6 Permission and Access Management

SMS, location, and device information are collected automatically by the App. Camera and file access depend on the customer’s action, such as capturing or selecting a file.

Customers can manage device permissions through their device settings. Restricting a permission may affect features that depend on it, including verification, security, and claim functions.

6. Payment Processing Through RMA Merchant Payment Services

BIL uses RMA Merchant Payment Services to facilitate supported bank transactions through the mBIL App.

6.1 Processing of Payments

Eligible insurance premium and loan EMI payments are processed through the applicable RMA Merchant Payment Services integration and participating banking arrangements.

6.2 Information Required for Transactions

To process and reconcile payments, relevant transaction information may be transmitted to RMA payment services, participating banks, or other authorised payment service providers. This may include payment amounts, customer or account references, transaction identifiers, and other necessary information.

6.3 Banking Credentials

Banking authentication and payment authorisation are subject to the applicable banking and payment arrangements. Customers should never disclose their banking passwords, PINs, or OTPs to unauthorised persons.

6.4 Transaction Records

BIL may maintain transaction references, payment confirmations, payment status, and reconciliation records to allocate payments correctly, investigate discrepancies, and satisfy regulatory and record-retention requirements.

6.5 Failed or Reversed Transactions

Information relating to failed, pending, disputed, or reversed transactions may be processed to investigate the issue, reconcile the payment, and ensure appropriate accounting treatment.

7. Sharing and Disclosure of Information

BIL does not sell or rent customers’ personal information to third parties for their independent commercial use.

Information may be shared where necessary to provide services, process transactions, fulfil legitimate insurance operations, or comply with applicable legal and regulatory obligations.

7.1 RMA and Participating Banks

Relevant information may be shared with RMA Merchant Payment Services, participating banks, and authorised payment service providers for payment processing, authentication, settlement, reconciliation, and investigation.

7.2 Technology and Service Providers

BIL may engage authorised service providers for application maintenance, hosting, security, technical support, and other operational functions. Access to customer information is restricted to what is necessary for their assigned responsibilities.

7.3 Regulators and Competent Authorities

BIL may disclose information to the RMA, other competent regulators, courts, law enforcement agencies, or authorised government bodies when required or permitted by applicable law or lawful order.

7.4 Insurance and Claims-Related Parties

Where necessary, relevant information may be shared with authorised reinsurers, surveyors, loss assessors, investigators, and other parties involved in legitimate insurance and claims processes, subject to applicable requirements.

7.5 Fraud and Dispute Investigations

Relevant information may be disclosed where necessary to investigate suspected fraud, unauthorised transactions, security incidents, or disputes.

BIL will seek to limit disclosures to information relevant to the applicable purpose and apply appropriate safeguards.

8. Data Security

BIL seeks to protect customer information against unauthorised access, disclosure, alteration, loss, and misuse through appropriate technical and organisational measures.

Depending on the systems and services involved, these measures may include:

• User authentication and access controls.
• Encryption during transmission and, where implemented, at rest.
• Secure application and infrastructure configurations.
• Security monitoring and audit logging.
• Vulnerability management and software updates.
• Restricted access to customer records.
• Backup and recovery arrangements.
• Security incident detection and response procedures.

No electronic system can be guaranteed to be completely secure. Customers should protect their devices and authentication credentials and promptly report suspected unauthorised access or suspicious transactions to BIL.

9. Data Retention and Disposal

BIL retains customer information and related records in accordance with applicable RMA requirements and other applicable legal and regulatory obligations.

9.1 Ten-Year Retention Period

BIL is required to maintain customer records for a period of ten (10) years before disposal, in accordance with the applicable RMA requirements.

The retention requirement applies to the relevant customer records maintained by BIL. Other records may be subject to additional or different retention requirements under applicable laws, regulations, audits, investigations, or legal proceedings.

9.2 Records Subject to Further Retention

Where required by applicable law, regulatory direction, an ongoing investigation, an audit, litigation, or another lawful obligation, records may be retained beyond the ordinary retention period.

9.3 Secure Disposal

After the applicable retention period has expired, and where no further retention obligation applies, BIL will arrange for the secure disposal, deletion, or appropriate destruction of the relevant records in accordance with its applicable procedures.

10. Account Deactivation and Deletion Requests

10.1 In-App Account Deletion

The mBIL App currently does not provide an in-app facility for customers to submit an account-deletion request.

BIL intends to introduce in-app account deletion in a future version of the App. This Policy will be updated when that facility becomes available.

10.2 Requesting Account Deactivation

Customers who wish to discontinue using the App or request deactivation of their mBIL account must contact the BIL Help Desk through BIL’s official customer support channels.

BIL may verify the customer’s identity and account details before processing the request to prevent unauthorised deactivation.

10.3 Effect of Account Deactivation

Account deactivation may disable or restrict access to the mBIL App. It does not automatically cancel an insurance policy, discharge a loan obligation, reverse a transaction, or terminate other contractual obligations with BIL.

Customers should contact the relevant BIL department for any separate request concerning insurance policies, loan facilities, or outstanding payments.

10.4 Retention of Customer Records

Deactivation of an mBIL account does not automatically result in the deletion of the customer’s records held by BIL.

BIL must retain applicable customer records for ten (10) years before disposal in accordance with RMA requirements. Records subject to other legal or regulatory retention obligations will be retained for the applicable period.

After the applicable retention requirements have been satisfied, records may be securely disposed of in accordance with BIL’s procedures, unless another lawful basis for continued retention applies.

11. Customer Responsibilities

Customers using the mBIL App should:

• Protect their login credentials and authentication information.
• Never share banking passwords, PINs, or OTPs with unauthorised persons.
• Maintain reasonable security on their mobile devices.
• Provide accurate and relevant information when using BIL services.
• Report suspected unauthorised access or suspicious transactions promptly.
• Keep their contact information updated where necessary for service delivery and verification.

12. Children’s Privacy

Where information relating to a minor is required for an insurance policy, claim, or other legitimate service, it must be provided by an authorised parent, guardian, or other legally permitted representative, as applicable.

BIL will handle such information in accordance with applicable legal and regulatory requirements and the purposes for which it is collected.

13. Third-Party Services

The mBIL App relies on relevant banking, payment, technology, and other service providers to deliver certain functions such payment transactions.

When customers interact with third-party services, those providers may process information under their own applicable terms and privacy policies.

BIL will apply appropriate safeguards to information shared by BIL with authorised providers, subject to applicable legal and contractual requirements.

14. Customer Rights and Privacy Enquiries

Subject to applicable laws and regulatory requirements, customers may contact BIL to:

• Enquire about personal information held by BIL.
• Request correction of inaccurate or outdated information.
• Raise concerns about the collection, use, sharing, or security of personal information.
• Request deactivation of their mBIL account.
• Enquire about applicable record-retention and disposal practices.
• Report suspected misuse, unauthorised access, or a privacy-related incident.

BIL may verify the identity of the requester before responding. Requests for deletion or disposal will be considered subject to applicable legal and regulatory retention obligations.

15. Changes to This Privacy Policy

BIL may revise this Privacy Policy to reflect changes in the App, services, payment arrangements, security practices, or applicable legal and regulatory requirements.

The latest version will be made available through the mBIL App or another appropriate official BIL channel. The applicable version and effective date will be indicated.

Customers are encouraged to review the Policy periodically.

16. Official Contact Channel

For privacy enquiries, customer information requests, account deactivation, or complaints concerning the handling of personal information, please contact:

For mBIL account deactivation, customers should contact the BIL Help Desk through the official support channels provided by BIL.

Customers should not include banking passwords, PINs, OTPs, or other confidential authentication credentials in their correspondence.

Document Version History