Privacy and Security Trust Centre

At Bupa, protecting the security and privacy of our customers, patients, people and systems is a priority.

We welcome reports from security researchers who identify potential vulnerabilities in Bupa websites, applications or digital services. Your reports help us strengthen our security posture and continue to protect the people who trust us with their information.

To ensure reports are reviewed and managed appropriately, all vulnerability submissions must be made through Bupa’s Vulnerability Disclosure Program hosted by Bugcrowd.

To Submit a report via Bugcrowd and to see the terms of the Bupa Vulnerability Disclosure Program visit: Bupa Australia Vulnerability Disclosure Engagement - Bugcrowd

Our Commitment

Bupa will review valid reports submitted through Bugcrowd and work to resolve confirmed vulnerabilities based on severity, impact and business risk.

Unless stated otherwise on the Bugcrowd program page, this program does not offer monetary rewards.

Responsible Disclosure Expectations

When testing and reporting vulnerabilities, please:

• Always work within the scope and rules of the Vulnerability Disclosure Program
• Submit all findings through the official Bugcrowd program.
• Avoid actions that may disrupt Bupa systems, services or users.
• Provide sufficient detail to allow us to understand and reproduce the issue.
• Always keep vulnerability details confidential including after Bupa has reviewed and addressed the matter.

Bupa reserves the right to take appropriate action where testing is conducted outside the authorised scope, did not follow the program rules or any malicious or illegal behaviour involved.