Privacy Policy

In this Privacy Policy when we refer to “ROYAL FAR WEST”, “RFW”, “we”, “our” or “us”, we mean ROYAL FAR WEST ABN 37 821 970 819.

RFW is a non-government organisation and registered charity that provides health, disability and accommodation services to children and families from regional, rural and remote Australia. Our services are delivered on site in Manly, via technology into schools and other private settings, and direct into communities through our outreach programs.

This Privacy Policy (‘Policy”) outlines how we manage your personal information, in line with our Privacy Protocol and relevant legislation. It describes generally the type of personal information held and for what purposes, and how that information is collected, held, used, disclosed and destroyed or de-identified.

The management of personal information outlined in this policy and adhered to in our operations is regulated by various laws, standards and policies, some of which are outlined in Appendix 1 (see at bottom).

When you sign or submit paper or electronic documents, you are consenting to the collection of any personal information you provide to us.

When you acquire or use our services, products or facilities, you consent to the reasonable collection, use and disclosure of personal information in accordance with this Privacy Policy.

This Policy and associated Privacy Protocol will be reviewed at least bi-annually, to ensure it remains up to date. It may be amended from time to time by posting the amended version on our website.

Personal information is information or an opinion about an identified individual or an individual who is reasonably identifiable, whether or not that information or opinion is true or recorded in material form.

Health information is a special category of personal information and includes information collected to provide or in providing a health service and personal information about the health or disability of an individual, an individuals expressed wishes about the future provisions of health services to the individual and a health service provided or to be provided to the individual.

Sensitive information includes health information about an individual, and personal information about an individual’s racial or ethnic origin, religious, philosophical or political beliefs, membership of a union or a political, professional or trade association, sexual orientation or practices and criminal record.

Royal Far West regularly collects, holds, uses and discloses health information and is committed to protecting the privacy of this type of information to a higher degree than that of other personal information.

Royal Far West (RFW) collects personal information from and on behalf of clients, supporters and donors, business partners, volunteers, suppliers, employers and third-party service providers. In most cases, RFW will, if it is reasonable or practicable to do so, collect personal information directly from you. This may occur in person, over the phone, via email or mail, a website or portal, or through one of our partners, fundraisers or volunteers. We may also collect information by other means and will take reasonable steps to inform you when we do.

Client and Family Information

We also collect personal information when you make enquiries, fill out application or referral forms, attend an assessment or participate in a service or evaluation.

In certain cases, we collect your personal information from third parties. For example, we may need to collect personal information from other sources (such as a legal guardian, your child’s school or pre-school), or any of the other organisations referred to below under “Use, transfer and sharing of your personal information” and identified in Appendix 2 (see below).

Job Applicants

If you apply for a job at Royal Far West, we may collect personal information from you or from recruitment agencies for the purpose of assessing and processing your application. This information may include your name and contact details and other information included in your CV or cover letter, such as employment history, qualifications, personal interests and other information relating to your suitability for employment. In some circumstances, Royal Far West may collect sensitive information about you, such as information about your health, vaccination status, membership of a professional or trade association, or criminal record, where appropriate. Please note that when you provide referee details, we assume that you have gained their consent prior to providing us with their personal information.

Examples of purposes for which your personal information may be used include:

• determining your qualifications for employment;
• evaluating your suitability for other employment vacancies;
• verifying the information you submit and carrying out reference checks and/or conducting background checks (where applicable);
• informing you about the progress of your application for employment with Royal Far West;
• protecting our rights and fulfilling our legal obligations; and
• informing you about other vacancies at Royal Far West that may be suitable.

If the event that Royal Far West does not employ you, we may (unless you opt for us not to) continue to retain and use your personal information collected during the recruitment process for the purpose of considering you for future positions.

Only relevant employees of Royal Far West, such as management team members, potential line managers or HR staff, and selected third parties who support us with the recruitment process, have access to your personal information. Except as set out in this policy or as required by law, your personal information will not be supplied to any third party without your consent.

If your application for employment is successful, the personal information submitted for recruitment purposes will be included in your employment record.

Employees

Generally, employee records are exempt from the Privacy Act, unless the employee’s personal information is used for something that is not directly related to the employment relationship between the employer and the employee. We store employee personal information in a secure cloud-based system. Paper files are generally scanned, saved electronically and the paper version securely disposed of. Employee records are kept for a minimum period of 7 years. Employee files are generally destroyed by secure means if an employee is no longer employed after the minimum retention period expires.

Employees can request to view their personal records at any time (refer to the Access to Personnel File Policy). If information requires updating or correcting, please let us know as soon as possible.

Volunteers

RFW may collect the personal information of volunteers such as contact other personal information, work history and relevant records checks to assess their suitability and so that we can encourage, record and acknowledge their support and communicate with them about their contribution to our services and activities. When you agree to undergo any type of worker screening check, such as a criminal record or working with children check, we take that as you consenting to us collecting, using and storing that personal information.

Donors

In the case of donors, we collect personal information including the donor’s name, contact details and credit card or other payment details. Sometimes, we may receive or purchase donor personal information from other charities, fundraising organisations we have engaged, or third parties that have provided us with lists to identify prospective donors. In this case, we presume that the donor has provided consent to those parties for their information to be used or disclosed in that way.

We hold, use and disclose donor personal information to enable us to process and receipt donations, and to communicate with donors about our work and how their donations are used.

Unless a donor asks us not to, we may publicly acknowledge any donation. We may also disclose donor personal information to third parties who assist in obtaining and processing our donations, other third parties where required by law and to anyone else to whom a donor has authorised such disclosure.

Your health information (including your gender, age range, presenting issue, history of presenting issues, psycho-social background, family history, medical history and lifestyle information), is generally required to arrange assessment of your needs so we are able to provide you with the appropriate level of support and intervention.

Where we receive health information from a third party (e.g. medical practitioner, or family member) as part of the support process, we rely on you having provided them with your consent to pass this information to us.

We will only collect personal information where it is necessary for us to perform one or more of our functions or activities. We collect the personal information we need to provide the services described in section 1 above. In addition, we also collect your personal information to enable the provision of confidential and de-identified reporting in relation to organisational trends relating to the health and wellbeing services we provide.

The type of information Royal Far West collects and holds varies depending on the type of service we provide to you. For example, Royal Far West will hold different information about you if you are being provided Telecare services than if you are receiving assessment and Diagnosis services through the Paediatric Developmental Program or are a supporter providing a donation. This information may include information about a disability or medical condition that you have or health information in general.

If you contact us by telephone, these calls may be recorded for training, quality and business purposes.

For the type of personal and sensitive information Royal Far West generally holds please refer to Appendix 2 (see at bottom of page).

In the event we receive unsolicited personal information, we will determine whether or not we should retain this information. This will depend on whether it is reasonably necessary for one or more of our functions or activities. If we determine that the personal information is not necessary for one or more of our functions or activities and that we should not retain it, then we will, as soon as practicable, either return it to you or whomever sent it to us, destroy it or otherwise ensure it is de-identified, provided that it is lawful to do so.

Otherwise, we will hold, use and disclose the personal information in accordance with this Privacy Policy.

Royal Far West takes reasonable steps to ensure that the personal information collected, used or disclosed is accurate, relevant, complete and up to date.

If you believe your personal information is not accurate, complete or up to date, please contact the Royal Far West team on 02 8966 8500.

We take reasonable steps to securely store your personal information so that it is protected from unauthorised use, access, modification or disclosure.

Overseas service providers

The nature of our service means that, from time to time, your personal information may be disclosed to service providers overseas. Where we use the services of a third-party providers, we endeavour to ensure that the handling of any personal information by third-party service providers is consistent with our privacy requirements to protect the confidentiality, availability, and integrity of your personal information. In this regard, we will use our best endeavours to ensure that any overseas recipients comply with the Privacy Act or similar privacy standards to those applicable to us here in Australia, however, RFW will not be responsible for the actions or omissions of those overseas recipients, and you will not be able to seek redress under the Privacy Act.  Knowing this, when you provide us with your personal information, we assume you are happy to consent to your personal information being shared with overseas service providers where required for or related to the provision of services to you under the terms of this Policy.

We store personal information in:

• Paper form on Royal Far West premises
• Electronic form, on both Royal Far West premises and Royal Far West datacentres, which are managed by our outsourced IT service providers
• Secure offsite archives (access restricted)

We maintain administrative, technical, and physical safeguards for the protection of personal information. Our security measures include, but are not limited to:

Administrative safeguards:

• Access to your personal information is limited to authorised personnel who have a legitimate need to know based on their job. In the case of third-party contractors or volunteers who process personal information on our behalf, similar requirements are imposed.
• Only allowing access where the individual seeking access has satisfied our identification requirements, such as a security and identification check on the commencement of a phone call.
• Confidentiality and privacy requirements for our employees, contractors, agents and suppliers.
• Secure Document storage.
• Training and education are provided to all staff in the handling of personal information.

Technical safeguards:

• Security measures for systems access.
• Antivirus and anti-malware software, and regularly updated virus definitions.
• Third parties who we hire to provide services and have access to personal information agree to implement privacy and security practices that we deem adequate.
• Personal information provided on computer servers is secured in a restricted and controlled network environment.
• Employing firewalls and intrusion detection systems.
• Two-factor authentication where available and reasonably practical.
• Encryption of personal information transmitted by electronic means where possible.

Physical safeguards:

• Third-party contractors who process personal information on our behalf agree to provide reasonable physical safeguards.
• Effectively and securely destroying information no longer needed, for example, by shredding or pulping in the case of paper records.
• Our security procedures and policies are audited on a regular basis to ensure they are updated in accordance with current legal requirements, best practice and up-to-date levels of security technology.

While Royal Far West has security measures in place to protect personal information, no data transmission over the internet can be guaranteed to be 100% secure. As a result, while we strive to protect your personal information, Royal Far West cannot warrant or ensure the security of any information you transmit to us or we transmit on your behalf, or to you, in the course of providing services over the internet.

Royal Far West must adopt government identifiers when delivering specific services including the use of Statistical Linkage Keys (SLK). Further information about the SLK is available via Government websites including the Australian Bureau of Statistics.

If we are communicating with you or you are receiving assistance from us and you or someone else is at possible risk of harm, Royal Far West has an obligation to intervene and provide the appropriate level of escalation. This may take the form of liaising with a third party (eg. medical practitioner, family member, third party organisation) or in certain situations contacting emergency services or external agencies for mandatory reporting.

We use your personal information to provide you with the support or services you have requested. Unless a person consents otherwise, sensitive or health information will only be used and disclosed to those individuals or entities (and their support staff) who are involved in their treatment or care of the person, or for specific training and educational purposes.  Such individuals and entities include those external to Royal Far West and commonly include local health service professionals such as GPs, paediatricians, speech pathologists and entities like the RFW School.

We may also use or disclose your personal information for another purpose for which you may reasonably expect it to be used or disclosed by us as long as that secondary purpose is related or (if sensitive information) directly related to the purpose for which it was collected. Otherwise, we will only use your information for a secondary purpose if you have consented to this use or disclosure, the use of disclosure is required by law or an enforcement body or to provide assistance in an emergency.

For a list of the types of uses of your personal information by Royal Far West please refer to Appendix 3.

If at any time, you don’t want us to share, or change your mind about sharing your personal information with a particular person or organisation, please let us know in writing.

We may contact you for fundraising or marketing purposes, unless you have explicitly opted out, except in the case of client and family information, where personal information will not be used to contact you for this purpose unless we have your consent to do so.

You can change your mind about receiving information about our services at any time, by contacting us or using the opt-out process on our offers or promotional communications.

If you do not wish to receive this information, or if you have any questions about the information you receive, please contact the Royal Far West team on 02 8966 8500.

We will only share (disclose) your personal information with third parties if it is required to fulfil our service obligations to you, or if it is required under law. Royal Far West will not disclose any personal information that we have collected from you (other than to the parties involved in providing our services to you), except in the situations set out below:

• In accordance with Section 11 above;
• If you, your parent or guardian, power of attorney or executor (as relevant) have provided informed consent; or
• In de-identified reporting as described in Section 6 above.

For a list of the types of entities Royal Far West generally discloses your personal information to please refer to Appendix 3 (see below).

Royal Far West may also collect non-personally identifiable information such as the type of browser, or operating system you use, your domain name, IP address, access times, referring website addresses and page views. Our Internet Service Provider (“ISP”) automatically identifies your computer by its IP address. When you visit pages on our website, our ISP may log your IP address.

We do not link IP addresses to any personally identifiable information. Your IP address is used to gather broad demographic information only. A User Transaction ID is created each time you enter our website. This ID is used to keep track of your dealings with us, and other requests.

Royal Far West does not use cookies to collect information which can personally identify you. A cookie is a small, text-based file used frequently on some websites and portals. They are designed to assist and streamline the exchange of information between your computer’s browser and our computer systems. Cookies used by Royal Far West collect information about the use of our websites. The information collected includes where visitors connect from, what version of browser they use and their path through the site. It helps us to provide personalised features and keep our content fresh and relevant. If you do not want information collected through the use of cookies, you can configure your cookie preferences and options through your browser.

Our web pages may contain electronic images, known as web beacons or spotlight tags. These enable us to count users who have visited certain pages of our website. Web beacons and spotlight tags are not used by us to access your personal information, they are simply a tool we use to analyse which web pages customers view, in an aggregate number.

Please contact us if you have concerns about the way in which we have handled your personal information or if would like to discuss any issues about our Privacy Policy. You are always welcome to speak directly to our staff and they will do their best to resolve your issue or refer to the Contacting Us section below.

It’s important that the information we hold about you is as up to date and accurate as possible.  This helps us to understand your needs and provide you with the right services and support.

At any time, you can request access to your personal information. If charges are applicable for providing access, we will disclose these charges to you prior to providing you with the information. In limited circumstances, a request for access may be denied, or restricted access given. We will provide reasons in writing for the denial of or limitation on access.

To arrange access please contact our privacy team. In some cases, we may be able to deal with your request over the telephone. We will correct personal information if we discover, or you are able to show that the information is incorrect. If you seek correction and Royal Far West disagrees that the information is incorrect, we will provide you with our reasons for taking that view and advise you on the further steps you may take.

You can deal with us anonymously or you may use a pseudonym where it is lawful and practicable to do so. For example, you may enquire about our services or receive generic information about how we may be able to provide support services to you. The nature of the services we provide generally means that it is not possible for us to provide services to a person in an anonymous way or using a pseudonym. Anonymous donations can be accepted, but we may not be able to provide you with a tax-deductible receipt.

For further information on privacy in Australia, please visit the website of the Office of the Australian Information Commissioner.

• Privacy Act 1988 (Commonwealth)
• Health Records and Information Privacy Act 2002 (NSW)
• Privacy and Personal Information Protection Act 1998 (NSW)
• Children and Young Persons (Care and Protection) Act 1998 (NSW)
• State Records Act 1998 (NSW)
• Guardianship Act 1987 (NSW)
• Australian Charter of Health Care Rights
• National Safety and Quality Healthcare Standards
• RFW policies, including the Privacy Protocol and Code of Conduct
• Individual Confidentiality Agreements
• Other laws in place from time to time including those applicable within other States and Territories in which we may operate.

• Names and photographs (and, with appropriate consent, video recordings) of the child, family members, carers and/or authorised representative/(s)
• Addresses, including email addresses and IP addresses
• Telephone and fax numbers
• Dates of birth
• Occupation/job title
• Details of any services you have received from us
• Health and family history
• Names of treating doctors, diagnoses, treatments, and disabilities
• Medicare details
• Ethnic background
• Lifestyle details, including dietary needs
• Immunisation records
• Current medications.

Below are the types of entities ROYAL FAR WEST may collect your personal information from and may disclose your personal information to. This is not an exhaustive list.

• Medical practitioners and specialists
• Medical providers such as hospitals
• Emergency assistance providers
• Schools, including the RFW School
• Family members
• Record management and storage businesses
• Companies who we engage to collect data, perform statistical analysis, and generate health and wellbeing related reporting to support the services we provide to
• Accreditation or certification organisations
• Organisations and entities that fund our services, so they can understand how their money is used (where possible, we won’t identify you personally)
• Our professional advisors including lawyers, accountants, tax advisors and auditors
• Debt collection agencies and other parties that assist with debt-recovery functions
• Police and law enforcement bodies to assist in their functions
• Courts of Law or as otherwise required or authorised by law
• Regulatory or government bodies for the purposes of resolving customer complaints or disputes both internally and externally or to comply with any investigation by one of those bodies
• Credit providers or credit reporting agencies (if you are our supplier)
• Printing, mail and distribution companies
• Third-party service providers engaged as our agent to provide specialised health and wellbeing services (including flu vaccinations and executive health checks)
• Other third-party service providers who assist us in supporting the services we provide.

We use, and in some instances disclose, your personal information when we, or third parties appointed by us, provide the following services:

• to provide products and services, including programs, requested, prescribed, or ordered on a person’s behalf by their health care provider for their ongoing treatment and care, or the ongoing service to the person;
• to provide information to another person or organisation involved in the ongoing treatment and care of the person, or the ongoing service to the person;
• to provide information or advice about existing and new products or services, including programs;
• to undertake RFW’s business processing functions*, including risk management, financial, auditing, reporting to funding bodies, safety, security and other such activities;
• for RFW administrative, marketing (including direct marketing, but only with  consent in  respect  of sensitive and health information), planning*, product or service development and improvement*;
• for quality assurance or monitoring activities, training and education (staff and student)*;
• to obtain opinions or comments about our products or services;
• for research purposes, or the compilation or analysis of statistics, in the public interest*;
• for provision to accreditation and certification agencies for registration, accreditation or quality control;
• to assess the performance of our website and improve its operation;
• to maintain our relationship with you, including for the purpose of updating our records and keeping contact and/or consent details up to date;
• to process and respond to complaints; and
• to comply with legal requirements (including responding to a legal claim), directions or governmental requirements
• For any other purposes that would be reasonably expected.

*Where possible and in all circumstances required by law, RFW will take reasonable steps to de-identify health information before using or disclosing the information and any use or disclosure must be reasonably necessary for the purpose. Where required by law, identified information will only be used or disclosed with consent of the person to whom the information relates.

Version as at October 2021