Royal Far West Privacy Statement
The privacy of clients, supporters, staff and affiliates is a top priority for Royal Far West. This Privacy Statement sets out our information handling procedures and the rights and obligations that you and we have in relation to your personal information. In the event of any inconsistency, legislative requirements will prevail.
In this Privacy Statement when we refer to “ROYAL FAR WEST”, “RFW”, “we”, “our” or “us”, we mean the ROYAL FAR WEST ABN 378 219 708 19.
ROYAL FAR WEST RFW is a non-government organisation that provides health, disability and accommodation services to children and families living in rural and remote Australia.
The management of personal information outlined in this statement and adhered to in our operations is regulated by various laws, standards and policies as outlined in Appendix 1.
Personal information is information or an opinion about an identified individual or an individual who is reasonably identifiable, whether or not that information or opinion is true or recorded in material form.
Sensitive information includes health information about an individual, and personal information about an individual’s racial or ethnic origin, religious, philosophical or political beliefs, membership of a union or a political, professional or trade association, sexual orientation or practices and criminal record.
Health information includes personal information collected to provide or in providing a health service and personal information about the health or disability of an individual, an individual’s expressed wishes about the future provisions of health services to the individual and a health service provided or to be provided to the individual.
Royal Far West regularly collects, holds, uses and discloses health information and is committed to protecting the privacy of this type of information to a higher degree than that of other personal information.
Your personal information
Royal Far West collects personal information from and on behalf of clients, supporters, business partners, suppliers, employers and third party service providers.
Special case – Donors
In the case of donors, we collect personal information including the donor’s name, contact details and credit card or other payment details. Sometimes, we may receive or purchase donor personal information from other charities, fundraising organisations we have engaged or third parties that have provided us with lists to identify prospective donors. In this case, we presume that the donor has provided consent to those parties for their information to be used or disclosed in that way.
We hold, use and disclose donor personal information to enable us to process donations, communicate with donors about their donations and inform donors about goods, services and/or programs, including fundraising activities, in which we think donors may have an interest.
Unless a donor asks us not to, we may publicly acknowledge any donation. We may also disclose donor personal information to third parties who assist in obtaining and processing our donations, other third parties where required by law and to anyone else to whom a donor has authorised such disclosure.
We will, if it is reasonable or practicable to do so, collect your personal information directly from you. This may happen when you fill out application or referral forms, attend an assessment or participate in a service, become one of our contractors or volunteers or request assistance. This may occur over the phone, via email, a website, or through one of our partners.
In certain cases we collect your personal information from third parties. For example, we may need to collect personal information from your representative (such as a legal guardian, your child’s school or pre-school), or any of the other organisations referred to below under “Use, transfer and sharing of your personal information” and identified in Appendix 2.
We may also collect information by other means and will take reasonable steps to inform you if and when we do.
Your health information (including your gender, age range, presenting issue, history of presenting issues, psychosocial background, family history, medical history and lifestyle information), is generally required to arrange assessment of your needs so we are able to provide you with the appropriate level of support and intervention.
Where you provide health information to a third party (e.g. medical practitioner, or family member) to pass onto us as part of the support process, we rely on you having provided them with your consent to pass this information to us.
We will only collect personal information where it is necessary for us to perform one or more of our functions or activities. We collect the personal information we need to provide the services described in section 1 above. In addition, we also collect your personal information to enable the provision of confidential and de-identified reporting in relation to organisational trends relating to the health and wellbeing services we provide.
The type of information Royal Far West collects and holds varies depending on the type of service we provide to you. For example, Royal Far West will hold different information about you if you are being provided Telecare services than if you are receiving Assessment and Diagnosis services through the Paediatric Developmental Program, or are a supporter providing a donation. This information may include information about a disability or medical condition that you have or health information in general.
If you contact us by telephone, these calls may be recorded for training, quality and business purposes.
For the type of personal and sensitive information Royal Far West generally holds please refer to Appendix 2.
In the event we receive unsolicited personal information, we will determine whether or not we should retain this information. This will depend on whether it is reasonably necessary for one or more of our functions or activities. If we determine that the personal information is not necessary for one or more of our functions or activities and that we should not retain it, then we will, as soon as practicable, either return it to you or whomever sent it to us, destroy it or otherwise ensure it is de-identified, provided that it is lawful to do so.
Royal Far West takes reasonable steps to ensure that the personal information collected, used or disclosed is accurate, relevant, complete and up-to-date.
If you believe your personal information is not accurate, complete or up to date, please contact the Royal Far West team on 02 8966 8500.
We take reasonable steps to securely store your personal information so that it is protected from unauthorised use, access, modification or disclosure. We store personal information in:
- Paper form on Royal Far West premises
- Electronic form, on both Royal Far West premises and Royal Far West data-centres, which are managed by our outsourced IT service providers.
We maintain administrative, technical, and physical safeguards for the protection of personal information. Our security measures include, but are not limited to:
- Access to your personal data is limited to authorised personnel who have a legitimate need to know based on their job. In the case of third-party contractors or volunteers who process personal information on our behalf, similar requirements are imposed.
- Only allowing access where the individual seeking access has satisfied our identification requirements, such as a security and identification check on the commencement of a phone call.
- Confidentiality requirements for our employees, contractors, agents and suppliers.
- Secure Document storage.
- Training and education is provided to all staff in the handling of personal information.
- Security measures for systems access.
- Antivirus and anti-malware software, and regularly updated virus definitions.
- Third parties who we hire to provide services and have access to personal information agree to implement privacy and security practices that we deem adequate.
- Personal information provided on computer servers is secured in a restricted and controlled network environment.
- Employing firewalls and intrusion detection systems.
- Third-party contractors who process personal data on our behalf agree to provide reasonable physical safeguards.
- Effectively and securely destroying data no longer needed, for example, by shredding or pulping in the case of paper records.
- Our security procedures and policies are audited on a regular basis to ensure they are updated in accordance with current legal requirements and current levels of security technology.
While Royal Far West has security measures in place to protect your data, no data transmission over the internet can be guaranteed to be 100% secure. As a result, while we strive to protect your personal information, Royal Far West cannot warrant or ensure the security of any information you transmit to us or we transmit on your behalf, or to you, in the course of providing services over the internet.
Royal Far West must adopt government identifiers when delivering specific services including the use of Statistical Linkage Keys (SLK). Further information about the SLK is available via Government websites including the Australian Bureau of Statistics.
If you are contacting us or receiving assistance from us and you or someone else is at possible risk of harm, Royal Far West has an obligation to intervene and provide the appropriate level of escalation. This may take the form of liaising with a third party (e.g. medical practitioner, family member, third party organisation) or in certain situations contacting emergency services or external agencies for mandatory reporting.
Use, transfer and sharing of your personal information
We use your personal information to provide you with the relevant support or services you have requested. A person’s sensitive or health information will only be used and disclosed to those individuals or entities (and their support staff) who are involved in their treatment, or for specific training and educational purposes. Such individuals and entities include those external to Royal Far West and commonly include local health service professionals such as GPs, paediatricians, speech pathologists and entities like the RFW School. We may also use or disclose your personal information for another purpose for which you may reasonably expect it to be used or disclosed by us and that secondary purpose is related or (if sensitive information) directly related to the purpose for which it was collected. Otherwise we will only use your information for a secondary purpose if you have consented to this use or disclosure, the use of disclosure is required by law or an enforcement body or to provide assistance in an emergency.
For a list of the types of uses of your personal information by Royal Far West please refer to Appendix 3.
We may contact you for fundraising or marketing purposes, unless you have explicitly opted out.
You can change your mind about receiving information about our services at any time, by contacting us or using the opt-out process on our offers or promotional communication.
If you do not wish to receive this information, or wish to know the source of the information, please contact the Royal Far West team on 02 8966 8500.
We will only share (disclose) your personal information with third parties if it is required to fulfil our service obligations to you, or if it is required under law. Royal Far West will not disclose any personal information that we have collected from you (other than to the parties involved in providing our services to you), except in the situations set out below:
- In accordance with Section 11 above;
- If you, your parent or guardian, power of attorney or executor (as relevant) have provided informed consent; or
- In de-identified reporting as described in Section 6 above.
For a list of the types of entities Royal Far West generally discloses your personal information to please refer to Appendix 3.
Your privacy on the internet
Royal Far West may also collect non-personally identifiable information such as the type of browser, or operating system you use, your domain name, IP address, access times, referring website addresses and page views. Our Internet Service Provider (“ISP”) automatically identifies your computer by its IP address. When you visit pages on our website, our ISP may log your IP address. We do not link IP addresses to any personally identifiable information. Your IP address is used to gather broad demographic information only. A User Transaction ID is created each time you enter our website. This ID is used to keep track of your dealings with us, and other requests.
Our web pages may contain electronic images, known as web beacons or spotlight tags. These enable us to count users who have visited certain pages of our website. Web beacons and spotlight tags are not used by us to access your Personal Information, they are simply a tool we use to analyse which web pages customers view, in an aggregate number.
Dealing with Royal Far West
You can request access to your personal information. If charges are applicable for providing access we will disclose these charges to you prior to providing you with the information. In limited circumstances, a request for access may be denied, or restricted access given. We will provide reasons in writing for the denial of or limitation on access.
To arrange access please contact us (see the Contacting Us section). In some cases we may be able to deal with your request over the telephone.
We will correct personal information if we discover, or you are able to show that the information is incorrect. If you seek correction and Royal Far West disagrees that the information is incorrect, we will provide you with our reasons for taking that view and advise you on the further steps you may take.
You can deal with us anonymously or you may use a pseudonym where it is lawful and practicable to do so. For example, you may enquire about our services or receive generic information about how we may be able to provide support services to you. The nature of the services we provide generally means that it is not possible for us to provide services to a person in an anonymous way or using a pseudonym. Anonymous donations can be accepted, but we may not be able to provide you with a tax deductible receipt.
19. Contacting us
If you have any questions or concerns about our approach to privacy at Royal Far West, or complaints about how we have handled your personal information, please contact us at:
Royal Far West
19-21 South Steyne, Manly, 2095
Phone: 02 8966 8500
20. Further Information
For further information on privacy in Australia, please visit the website of the Office of the Australian Information Commissioner at www.oaic.gov.au
- Privacy Act 1988 (Commonwealth)
- Health Records and Information Privacy Act 2002 (NSW)
- Privacy and Personal Information Protection Act 1998 (NSW)
- Children and Young Persons (Care and Protection Act 1998 (NSW)
- Public Health Act 1991 (NSW)
- State Records Act 1998 (NSW)
- Guardianship Act 1987 (NSW)
- Australian Charter of Health Care Rights
- National Safety and Quality Healthcare Standards
- RFW policies, including the RFW Code of Conduct
- Individual Confidentiality Agreements
- Other laws in place from time to time including those applicable within other States and Territories in which we may operate.
- Names of the child, family members, carers and/or authorised representative/(s).
- Addresses, including email addresses and IP addresses
- Telephone and fax numbers
- Dates of birth
- Occupation/job title
- Details of the services you have received from us
- Health and family history
- Names of treating doctors, diagnoses, treatments and disabilities
- Medicare details
- Ethnic background
- Lifestyle details, including dietary needs
- Immunisation records
- Current medications
Below are the types of entities ROYAL FAR WEST may collect your personal information from and may disclose your personal information to. This is not an exhaustive list.
- Medical practitioners and specialists
- Medical providers such as hospitals
- Emergency assistance providers
- Family members
- Record management and storage businesses
- Companies who we engage to collect data, perform statistical analysis, and generate health and wellbeing related reporting to support the services we provide to you.
- Accreditation or certification organisations
- Our professional advisors including lawyers, accountants, tax advisors and auditors
- Debt collection agencies and other parties that assist with debt-recovery functions
- Police and law enforcement bodies to assist in their functions
- Courts of Law or as otherwise required or authorised by law
- Regulatory or government bodies for the purposes of resolving customer complaints or disputes both internally and externally or to comply with any investigation by one of those bodies
- Credit providers or credit reporting agencies (if you are our supplier)
- Printing, mail and distribution companies
- Third party service providers engaged as our agent to provide specialised health and wellbeing services (including flu vaccinations and executive health checks)
We use and in some instances disclose your personal information when we, or third parties appointed by us, provide the following services:
- to provide products and services, including programs, requested, prescribed or ordered on a person’s behalf by their health care provider for their ongoing treatment and care, or the ongoing service to the person;
- to provide information to another person or organisation involved in the ongoing treatment and care of the person, or the ongoing service to the person;
- to provide information or advice about existing and new products or services, including programs;
- to undertake RFW’s business processing functions*, including risk management, financial, auditing, reporting to funding bodies, safety, security and other such activities;
- for RFW administrative, marketing (including direct marketing, but only with consent in respect of sensitive and health information), planning*, product or service development and improvement*;
- for quality assurance or monitoring activities, training and education (staff and student)*;
- to obtain opinions or comments about our products or services;
- for research purposes, or the compilation or analysis of statistics, in the public interest*;
- for provision to accreditation and certification agencies for registration, accreditation or quality control;
- to assess the performance of our website and improve its operation;
- to maintain our relationship with you, including for the purpose of updating our records and keeping contact and/or consent details up to date;
- to process and respond to complaints; and
- to comply with legal requirements (including responding to a legal claim), directions or governmental requirements.
- For any other purposes that would be reasonably expected.
*Where possible and in all circumstances required by law, RFW will take reasonable steps to de-identify health information before using or disclosing the information and any use or disclosure must be reasonably necessary for the purpose. Where required by law, identified information will only be used or disclosed with consent of the person to whom the information relates.