Privacy Policy

Policy
We will use all reasonable efforts to protect the privacy of individuals’ personal information and to comply with the obligations imposed by the Privacy Act 1988 (Cth) (Privacy Act), the Australian Privacy Principles (apps), the Aged Care Act and the Aged Care Principles.

We will only collect personal information by lawful and fair means and will only collect personal information that is necessary for one or more of our organisation’s functions or activities.

If it is reasonable and practicable to do so, we will collect personal information about an individual only from that individual.

In meeting our obligations with respect to the privacy of our clients we acknowledge that people with vision or hearing impairments and those of culturally and linguistically diverse people may require special consideration.

1.1. Purpose of policy
The purpose of this policy and procedure is to:
a) Ensure personal information is managed in an open and transparent way;
b) Protect the privacy of personal information including Health Information of clients, residents and Workers;
c) Provide for the fair collection and handling of personal information;
d) Ensure that personal information we collect is used and disclosed for relevant purposes only;
e) Regulate the access to and correction of personal information; and
f) Ensure the confidentiality of personal information through appropriate storage and security.

1.2. Scope
This policy applies to employees, contractors or subcontractors, employees of a labour hire company assigned to work in our business, outworkers, apprentices or trainees, work experience students and volunteers (Workers).

Privacy Procedure
What is “Personal Information”?
Personal Information is information or an opinion, whether true or not, and whether recorded in a material form or not, about an individual whose identity is apparent, or can reasonably be ascertained, from the information or opinion.

What is “Sensitive Information”?
Sensitive Information includes information or an opinion about an individual’s racial or ethnic origin, political opinions, membership of a political association, religious beliefs or affiliations, philosophical beliefs, membership of a professional or trade association, membership of a trade union, sexual preferences or practices, criminal record, biometric information, biometric templates, health information about an individual and genetic information.

What is “Health Information”?
Health Information is:
a) Information or an opinion about:
a. The health or a disability (at any time) of an individual;
b. An individual’s expressed wishes about the future provision of health services to him or her; or
c. A health service provided, or to be provided, to an individual that is also personal information; or
b) Other personal information collected to provide, or in providing, a health service;
c) Other personal information about an individual collected in connection with the donation, or intended
donation, by the individual of his or her body parts, organs or body substances; or
d) Genetic information about an individual in a form that is, or could be, predictive of the health of the
individual or a genetic relative of the individual.

What is “Unsolicited Information”?
Unsolicited Information is all personal information received from an individual that we did not actively seek to collect.

What is an “Employee Record”?
An Employee Record is a record of personal information relating to the employment of the employee. Examples of personal information relating to the employment of the employee are Health Information about the employee and personal information about all or any of the following:
a) The engagement, training, disciplining or resignation of the employee;
b) The termination of the employment of the employee;
c) The terms and conditions of employment of the employee;
d) The employee’s personal and emergency contact details;
e) The employee’s performance or conduct;
f) The employee’s hours of employment;
g) The employee’s salary or wages;
h) The employee’s membership of a professional or trade association;
i) The employee’s trade union membership;
j) The employee’s recreation, long service, sick, personal, maternity, paternity or other leave; and
k) The employee’s taxation, banking or superannuation affairs.

2.1. Collection, use and disclosure
We will collect and use information about you during the course of your relationship with us. We explain below when and how we may collect, use and disclose this information. It is important that the information we hold about you is up to date. You must let us know when the information
you have provided has changed.

2.1.1. Collection of personal information
Purpose of collection of Personal Information
We will only collect Personal Information about an individual by fair and lawful means and only if the information is necessary for one or more of our functions as an aged care provider and collection of the Personal Information is necessary to:
a) Comply with the provisions of state or commonwealth law;
b) Provide data to government agencies in compliance with state or commonwealth law;
c) Determine eligibility to entitlements provided under any state or commonwealth law;
d) Provide appropriate services and care;
e) Enable contact with a nominated person regarding a client’s health status; and
f) Lawfully liaise with a nominated representative and to contact family if requested or needed.

Some individuals may not want to provide information to us. The information we request is relevant to providing them with the care and services they need. If the individual chooses not to provide us with some or all of the information we request, we may not be able to provide them with the care and services they require.

We will not collect your Sensitive Information (including Health Information) unless the collection of the information is reasonably necessary for or directly related to one or more of our functions and:
a) You have consented to the collection of this information; or
b) The collection of the information is required or authorised by or under an Australian law or a court/tribunal
order; or
c) A permitted general situation exists to the collection of the information; or
d) A permitted health situation exists in relation to the collection of the information.
2.1.2. Methods of collection
Overview
Personal Information and Sensitive Information (including Health Information), may be collected:
a) From a client or resident;
b) From any person or organisation that assesses health status or care requirements, for example the Aged
Care Assessment Team;
c) From the health practitioner of a client or resident;
d) From other health providers or facilities;
e) From family members or significant persons of a client or resident; and
f) From a legal advisor of a client or resident.

We will collect Personal Information from the client or resident unless:
a) We have the consent of the client or resident to collect the information from someone else; or
b) We are required or authorised by law to collect the information from someone else; or
c) It is unreasonable or impractical to do so.

At admission, a client or resident should identify any parties from whom they do not wish Personal Information accessed or to whom they do not wish Personal Information provided. This should be recorded in the file of the client or resident and complied with to the extent permitted by law.

2.1.3. Unsolicited Information
If we receive Personal Information from an individual that we have not solicited and we could not have obtained the information by lawful means, we will destroy or de-identify the information as soon as practicable and in accordance with the law.

2.1.4. Worker records
We must keep a record in respect of Workers about:
a) Basic employment details such as the name of the employer and the employee and the nature of their
employment (eg part-time, full-time, permanent, temporary or casual);
b) Pay;
c) Overtime hours;
d) Averaging arrangements;
e) Leave entitlements;
f) Superannuation contributions;
g) Termination of employment (where applicable); and
h) Individual flexibility arrangements and guarantees of annual earnings.
We may also collect Personal Information about a Worker relating to their employment being Employee Records (as
defined above).

2.1.5. Notification
We will at or before the time or as soon as practicable after we collect Personal Information from an individual take
all reasonable steps to ensure that the individual is notified or made aware of:
a) Our identity and contact details;
b) The purpose for which we are collecting Personal Information;
c) The identity of other entities or persons to whom we usually disclose Personal Information to;
d) That our privacy policy contains information about how the individual may complain about a breach of the
apps and how we will deal with a complaint;
e) Whether we are likely to disclose Personal Information to overseas recipients and if so, the countries in
which such recipients are likely to be located and if practicable, to specify those countries.

2.2. Use and disclosure of information
2.2.1. Permitted disclosure
We may not use or disclose Personal Information for a purpose other than the primary purpose of collection, unless:
a) The secondary purpose is related to the primary purpose (and if Sensitive Information directly related) and
the individual would reasonably expect disclosure of the information for the secondary purpose;
b) The individual has consented;
c) The information is Health Information and the collection, use or disclosure is necessary for research, the
compilation or analysis of statistics, relevant to public health or public safety, it is impractical to obtain
consent, the use or disclosure is conducted within the privacy principles and guidelines and we reasonably
believe that the recipient will not disclose the Health Information;
d) We believe on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and
imminent threat to an individual’s life, health or safety or a serious threat to public health or public safety;
e) We have reason to suspect unlawful activity and use or disclose the Personal Information as part of our
investigation of the matter or in reporting our concerns to relevant persons or authorities;
f) We reasonably believe that the use or disclosure is reasonably necessary to allow an enforcement body to
enforce laws, protect the public revenue, prevent seriously improper conduct or prepare or conduct legal
proceedings; or
g) The use or disclosure is otherwise required or authorised by law.

If we receive Personal Information from an individual that we have not solicited, we will, if it is lawful and reasonable to do so, destroy or de-identify the information as soon as practicable.

2.2.2. Cross border disclosure
We will not disclose an individual’s Personal Information to an overseas recipient. If we do, we will take all steps
that are reasonable in the circumstances to ensure that the overseas recipient does not breach the Australian
Privacy Principles, unless:
a) The overseas recipient is subject to laws similar to the Australian Privacy Principles and the individual has
mechanisms to take action against the overseas recipient;
b) We reasonably believe the disclosure is necessary or authorised by Australian Law; or
c) The individual has provided express consent to the disclosure.

2.2.3. Disclosure of Health Information
We may disclose Health Information about an individual to a person who is responsible for the individual if:
a) The individual is incapable of giving consent or communicating consent;
b) The service manager is satisfied that either the disclosure is necessary to provide appropriate care or
treatment or is made for compassionate reasons or is necessary for the purposes of undertaking a quality
review of our services (and the disclosure is limited to the extent reasonable and necessary for this purpose);
and
c) The disclosure is not contrary to any wish previously expressed by the individual of which the service
manager is aware, or of which the service manager could reasonably be expected to be aware and the
disclosure is limited to the extent reasonable and necessary for providing care or treatment.
d) A person responsible is a parent, a child or sibling, a spouse, a relative, a member of the individual’s
household, a guardian, an enduring power of attorney, a person who has an intimate personal relationship
with the individual, or a person nominated by the individual to be contacted in case of emergency, provided
they are at least 18 years of age.

2.3. Access
2.3.1. Requesting access
You have a right to request that we provide you access to the Personal Information we hold about you (and we shall make all reasonable attempts to grant that access) unless providing access:
a) Is frivolous or vexatious;
b) Poses a serious threat to the life or health of any individual;
c) Unreasonably impacts upon the privacy of other individuals;
d) Jeopardises existing or anticipated legal proceedings;
e) Prejudices negotiations between the individual and us;
f) Be unlawful or would be likely to prejudice an investigation of possible unlawful activity;
g) An enforcement body performing a lawful security function asks us not to provide access to the information;
or
h) Giving access would reveal information we hold about a commercially sensitive decision making process.
2.3.2. Process for requesting access
Requests for access to information can be made orally or in writing and addressed to the service manager of the relevant service. We will respond to each request within a reasonable time.

2.3.3. Declining access
An individual’s identity should be established prior to allowing access to the requested information. If unsatisfied with the individual’s identity or access is requested from an unauthorised party, we can decline access to the information.

We can also decline access to information if:
a) There is a serious threat to life or health of any individual;
b) The privacy of others may be affected;
c) The request is frivolous or vexatious;
d) The information relates to existing or anticipated legal proceedings; or
e) The access would be unlawful.

We will provide in writing the reasons for declining access to the requested information.

2.3.4. Granting access
On request (and after determining an individual’s right to access the information) we should provide access to Personal Information.

2.3.5. Charges
If we charge for providing access to Personal Information, those charges will not be excessive.

2.4. Personal information quality
We aim to ensure that the Personal Information we hold is accurate, complete and up-to-date. Please contact us if any of the Personal Information you have provided to us has changed. Please also contact us if you believe that the information we have about you is not accurate, complete or up-to-date.

2.5. Correction
If an individual establishes the Personal Information held about them is inaccurate, incomplete, out-of-date, irrelevant or misleading we must take reasonable steps to correct the information. If we refuse to correct the Personal Information as requested by the individual, we will give the individual written notice that sets out:
a) The reasons for the refusal, except to the extent that it would be unreasonable to refuse;
b) The mechanisms available to complain about the refusal; and
c) Any other matter prescribed by the regulations.
If we disagree with an individual about whether information is accurate, complete and up-to-date, and the individual
asks us to associate with the information a statement claiming that the information is inaccurate, incomplete, outof-date, irrelevant or misleading we must take reasonable steps to do so.

2.6. Direct marketing
2.6.1. Personal Information
We will not use or disclose Personal Information about an individual for the purposes of direct marketing, unless the information is collected directly from you and:
a) You would reasonably expect us to use or disclose your Personal Information for the purpose of direct
marketing; and
b) We have provided you a means to ‘opt-out’ and you have not opted out.

2.6.2. Sensitive Information
We will not use or disclose Sensitive Information about an individual for the purposes of direct marketing, unless the individual has consented to the information being used for direct marketing.
2.6.3. An individual’s rights in relation to direct marketing activities
If we use information for the purposes of direct marketing the individual may:
a) Ask us not to provide direct marketing communications to them;
b) Ask us not to disclose or use the information;
c) Ask us to provide the source of the information.