Privacy Policy

In this Privacy Policy when we refer to “ROYAL FAR WEST,” “RFW,” “we,” “our” or “us,” we mean ROYAL FAR WEST ABN 378 219 708 19.

Royal Far West is a non-government organisation and registered charity that provides health, disability and accommodation services to children and families from regional, rural, and remote Australia. Our services are delivered onsite in Manly, via technology into schools and other private settings, and direct into communities through our in-community programs.

Royal Far West will respect the privacy of our clients, supporters, staff, and others with whom we work.

This Privacy Policy (‘Policy”) outlines how we manage your personal information, in line with our Privacy Protocol and relevant laws. It describes generally the type of personal information held and for what purposes, and how that information is collected, held, used, disclosed and destroyed or
de-identified.

The management of personal information outlined in this Policy and adhered to in our operations is regulated by various laws, standards, and policies, some of which are outlined in Appendix 1 (see below).

When you sign or submit paper or electronic documents, you consent to the collection of any personal information (including any sensitive information) you provide to us.

When you acquire or use our services, products, or facilities, you consent to the reasonable collection, use and disclosure of personal information in accordance with this Privacy Policy.

This Policy and associated Privacy Protocol are reviewed at least annually, to ensure they remain up to date. The Policy may be amended from time to time by posting the amended version on our website.

Personal information is information or an opinion about an identified individual or an individual who is reasonably identifiable, whether or not that information or opinion is true or recorded in material form.

Health information is a special category of personal information and includes information collected to provide or in providing a health service (like RFW!) and personal information about the health or disability of an individual, an individuals expressed wishes about the future provisions of health services to the individual and a health service provided or to be provided to the individual.

Sensitive information includes health information about an individual, and personal information about an individual’s racial or ethnic origin, religious, philosophical, or political beliefs, membership of a union or a political, professional or trade association, sexual orientation or practices and
criminal record.

RFW regularly collects, holds, uses and discloses sensitive and health information and is committed to protecting the privacy of this type of information to a higher degree than that of other personal information.

Royal Far West collects personal information from and on behalf of clients, supporters and donors, business partners, volunteers, suppliers, employers and third-party service providers.

In most cases, RFW will, if it is reasonable or practicable to do so, collect personal information directly from you. This may occur in person, over the phone, via email or mail, a website or portal, or through one of our partners, fundraisers or volunteers. We may also collect information by other means and will take reasonable steps to inform you when we do. You may see this notification in the form of a Privacy Collection Notice.

Client and Family Information

We also collect personal information when you make enquiries, fill out application or referral forms, book accommodation with us, attend an assessment or participate in a service or evaluation.

In certain cases, we collect your personal information from third parties. For example, we may need to collect personal information from other sources (such as a legal guardian, your child’s school or pre-school), or any of the other people or organisations referred to below under “Use, transfer and sharing of your personal information” and identified in Appendix 3 (see below).

Our Supporters

In the case of donors, we collect personal information including the donor’s name, contact details and credit card or other payment details. Sometimes, we may receive or purchase donor personal information from other charities, fundraising organisations we have engaged, or third parties that have provided us with lists to identify prospective donors. In this case, we presume that the donor has provided consent to those parties for their information to be used or disclosed in that way.

We hold, use and disclose donor personal information to enable us to process and receipt donations, and to communicate with donors about our work and how their donations are used.

Unless a donor asks us not to, we may publicly acknowledge any donation. We may also disclose donor personal information to third parties who assist in obtaining and processing our donations, other third parties where required by law and to anyone else to whom a donor has authorised such disclosure.

Job Applicants

If you apply for a job at RFW, we may collect personal information from you or from recruitment agencies for the purpose of assessing and processing your application. This information may include your name and contact details and other information included in your CV or cover letter, such as employment history, qualifications, personal interests and other information relating to your suitability for employment. In some circumstances, Royal Far West may collect sensitive information about you, such as information about your health, vaccination status, membership of a professional or trade association, or criminal record, where appropriate. Please note that when you provide referee details, we assume that you have gained their consent prior to providing us with their personal information.

Examples of purposes for which your personal information may be used include:

• determining your qualifications for employment;
• evaluating your suitability for other employment vacancies;
• verifying the information you submit and carrying out reference checks and/or conducting background checks (where applicable);
• informing you about the progress of your application for employment with Royal Far West;
• protecting our rights and fulfilling our legal obligations; and
• informing you about other vacancies at Royal Far West that may be suitable.

If the event that Royal Far West does not employ you, we may (unless you opt for us not to) continue to retain and use your personal information collected during the recruitment process for the purpose of considering you for future positions.

Only relevant employees of Royal Far West, such as management team members, potential line managers or HR staff, and selected third parties who support us with the recruitment process, have access to your personal information. Except as set out in this policy or as required by law, your personal information will not be supplied to any third party without your consent.

If your application for employment is successful, the personal information submitted for recruitment purposes will be included in your employment record.

Employees

Generally, employee records are exempt from the Privacy Act, unless the employee’s personal information is used for something that is not directly related to the employment relationship between the employer and the employee. We store employee personal information in a secure cloud-based system. Paper files are generally scanned, saved electronically and the paper version securely disposed of. Employee records are kept for a minimum period of 7 years. Employee files are generally destroyed by secure means if an employee is no longer employed after the minimum retention period expires.

Employees can request to view their personal records at any time (refer to the Access to Personnel File Policy). If information requires updating or correcting, please let us know as soon as possible.

Volunteers

RFW may collect the personal information of volunteers such as contact other personal information, work history and relevant records checks to assess their suitability and so that we can encourage, record and acknowledge their support and communicate with them about their contribution to our services and activities. When you agree to undergo any type of worker screening check, such as a criminal record or working with children check, we take that as you consenting to us collecting, using and storing that personal information.

Your health information (including your gender, age range, presenting issue, history of presenting issues, psychosocial background, family history, medical history and lifestyle information), is generally required by us to arrange assessment of your needs. That way, we can offer you appropriate support and intervention.

Where you provide health information to a third party (e.g., medical practitioner, or family member) to share with us as part of the support process, we rely on you having provided them with your consent to pass this information to us.

We will only collect personal information where it is necessary for us to perform one or more of our functions or activities.

The types of information RFW collects and holds varies depending on the type of service we provide to you. For example, Royal Far West will hold different information about you if you are being provided Telecare services than if you are receiving Assessment and Diagnosis services through the Paediatric Developmental Program, or are a supporter providing a donation.

We also collect personal information to enable the provision of confidential and de-identified reporting in relation to organisational trends relating to the health and wellbeing services we provide.

If you contact us by telephone, these calls may be recorded for training, quality, and business purposes.

For others who come into contact with us, RFW will collect the personal information necessary for the purpose of your contact with us or your relationship with us.

For the types of personal and sensitive information Royal Far West generally holds see Appendix 2

If you choose not to share personal information with us when we ask for it, it may:

• Impact our ability to provide the requested services to you, either to the same standard or at all
• Make it difficult to give you information about the services that you are seeking
• Mean we are not able to engage you as an employee, volunteer, or service provider
• Mean we are not able to maintain our relationship with you
• Impact our ability to improve our service to meet clients’ needs
• Impact our the effectiveness or ou ability to respond to your complaint or enquiry
• Mean we can’t appropriate tailor the content of our websites to your preferences and you may find our websites may not be as enjoyable or useful.

In the event we receive personal information that we didn’t ask for, we will determine whether or not we should retain the information. This will depend on whether it is reasonably necessary for one or more of our functions or activities.

If we determine that this personal information is not necessary for one or more of our functions or activities and that we should not retain it, then we will, as soon as practicable, either return it to you or to whomever sent it to us, destroy it or otherwise ensure it is de-identified, provided that it is lawful to do so.

Otherwise, the personal information will be held, used, and disclosed in accordance with this Policy.

At Royal Far West, we do our best to ensure that the personal information we hold is accurate, relevant, complete and up-to-date. This helps us to provide quality services and maintain safety and security of personal information and the people impacted by it.

If you believe your personal information is not accurate, complete, or up to date, please contact the Royal Far West team on 02 8966 8500.

We take reasonable steps to securely store your personal information so that it is protected from unauthorised use, access, modification, or disclosure. We store personal information in:

• Paper form on Royal Far West premises
• Electronic form, in our secure client portal and on both Royal Far West premises and in Royal Far West data centres, managed by our outsourced IT service providers.

We maintain administrative, technical, and physical safeguards for the protection of personal information.
Our security measures include, but are not limited to:

Administrative safeguards:

• Access to your personal information is limited to authorised personnel who have a legitimate need to know based on their job. In the case of third-party contractors or volunteers who process personal information on our behalf, similar requirements are imposed.
• Only allowing access where the individual seeking access has satisfied our identification requirements, such as a security and identification check on the commencement of a phone call.
• Confidentiality requirements for our employees, contractors, agents, and suppliers.
• Secure Document storage.
• Training and education provided to all staff in the handling of personal information.
• Privacy protection measures are embedded into RFW into systems including undertaking Privacy Impact Assessments when a significant change to systems or services is being considered.

Technical safeguards:

• Security measures for systems access.
• Antivirus and anti-malware software, and regularly updated virus definitions.
• Third parties who we hire to provide services and have access to personal information agree to implement privacy and security practices that we deem adequate.
• Personal information provided on computer servers is secured in a restricted and controlled network environment.
• Employing firewalls and intrusion detection systems.

Physical safeguards:

• Third-party contractors who process personal data on our behalf agree to provide reasonable physical safeguards.
• Taking reasonable steps to securely destroy or de-identify personal or sensitive information, subject to legal requirements.
• Effectively and securely destroying data no longer needed, for example, by shredding or pulping in the case of paper records.
• Our security procedures and policies are audited on a regular basis to ensure they are updated in accordance with current legal requirements and current levels of security technology.

While Royal Far West has security measures in place to protect your data, no data transmission over the internet can be guaranteed to be 100% secure. As a result, while we strive to protect your personal information, Royal Far West cannot warrant or ensure the security of any information you transmit to us or we transmit to others on your behalf, or to you, in the course of providing services over the internet.

Royal Far West must adopt government identifiers when delivering specific services including the use of Statistical Linkage Keys (SLK). Further information about the SLK is available via Government websites including the Australian Bureau of Statistics.

If you are contacting us or receiving assistance from us and you or someone else is at possible risk of harm, Royal Far West has an obligation to intervene and provide the appropriate level of escalation. This may take the form of liaising with a third party (e.g. medical practitioner, family
member, third party organisation) or in certain situations contacting emergency services or external
agencies for mandatory reporting.

We use your personal information to provide you with the support or services you have requested. Unless a person consents otherwise, sensitive or health information will only be used and disclosed to those individuals or organisations (and their support staff) who are involved in their treatment or care, or for specific training and educational purposes.

This may include individuals, practices, and organisations external to Royal Far West such as local health service professionals like GPs, paediatricians, speech pathologists and entities like the RFW School.

We may also use or disclose your personal information for another purpose for which you may reasonably expect it to be used or disclosed by us. We will only do that if the other purpose is related (or in the case of sensitive information, directly related) to the purpose for which it was collected. The only other time we can use your information for a secondary purpose is if you have consented to this use or disclosure, the use of disclosure is required by law or an enforcement body or if it is needed to provide assistance in an emergency.

For a list of the types of uses of your personal information by Royal Far West see Appendix 4.

If at any time, you don’t want us to share or change your mind about sharing your personal information with a particular person or organisation, please let us know in writing.

We may contact you for fundraising or marketing purposes unless you have explicitly opted out.

You can change your mind about receiving information about our services at any time, by contacting us or using the opt-out process on our offers or promotional communication.

If you do not wish to receive this information, or wish to know the source of the information, please contact the Royal Far West team on 02 8966 8500.

We will only share (disclose) your personal information with third parties if it is required to fulfil our service obligations to you, or if it is required under law. Royal Far West will not disclose any personal information that we have collected from you (other than to the parties involved in providing our services to you), except in the situations set out below:

• In accordance with Section 12 above;
• If you, a personal with parental responsibility, guardian, power of attorney or executor (as relevant) have provided informed consent and complied with our identification procedures; or
• In de-identified reporting as described in this Policy.

For a list of the types of entities to which Royal Far West generally discloses your personal information please refer to Appendix 3.

Unless it is part of providing a service to you, we will not disclose your personal information overseas. We may also disclose your personal information overseas with your consent.

We may provide links to other websites belonging to third parties. We also use Facebook, LinkedIn, and other social media platforms to highlight our work and post information about our services, opportunities to work with us and other relevant information about upcoming events and activities. If you choose to follow website links or interact with us through these platforms, it is up to you to review and accept the privacy policy of that platform to understand your rights and we make no assurances in relation to the privacy practices or content of third-party websites.

Royal Far West may also collect non-personally identifiable information such as the type of browser, or operating system you use, your domain name, IP address, access times, referring website addresses and page views. Our Internet Service Provider (“ISP”) automatically identifies your computer by its IP address. When you visit pages on our website, our ISP may log your IP address.

We do not link IP addresses to any personally identifiable information. Your IP address is used to gather broad demographic information only. A User Transaction ID is created each time you enter our website. This ID is used to keep track of your dealings with us, and other requests.

Royal Far West does not use cookies to collect information which can personally identify you. A cookie is a small, text-based file used frequently on some websites and portals. They are designed to assist and streamline the exchange of information between your computer’s browser and our computer systems. Cookies used by RFW collect information about the use of our websites. The information collected includes where visitors connect from, what version of browser they use and their path through the site. It helps us to provide personalised features and keep our content fresh and relevant. If you do not want information collected through the use of cookies, you can configure your cookie preferences and options through your browser.

Our web pages may contain electronic images, known as web beacons or spotlight tags. These enable us to count users who have visited certain pages of our website. Web beacons and spotlight tags are not used by us to access your personal information, they are simply a tool we use to analyse which web pages customers view, in an aggregate number

Please contact us if you have concerns or questions about the way in which we have handled your personal information or would like to discuss any issues about our Privacy Policy. You are always welcome to speak directly to our staff and they will do their best to resolve your issue.

We also have a complaints process and a nominated Privacy Officer who can be contacted as detailed in the Contacting Us section at the end of this document.

It is important that the information we hold about you is as up to date and accurate as possible. This helps us to understand your needs and provide you with the right services and support.

At any time, you can request access to your personal information. If charges are applicable for providing access, we will disclose these charges to you prior to providing you with the information. Unfortunately, there are sometimes circumstances where a request for access may be denied, or restricted access given to your personal information.

For example, we may need to refuse access where we reasonably believe that granting access would pose a serious threat to the life, health or safety of an individual or to public health and safety, where providing access will have an unreasonable impact on the privacy of another individual or if it would result in a breach of confidentiality. If that happens, we will give you written reasons for any refusal or limitation on access.

To arrange access please contact our privacy team. In some cases, we may be able to deal with your request over the telephone. We will correct personal information if we discover, or you are able to show that the information is incorrect. If you seek correction and Royal Far West disagrees that the information is incorrect, we will provide you with our reasons for taking that view and advise you on the further steps you may take.

You can deal with us anonymously or you may use a pseudonym where it is lawful and practicable to do so. For example, you may enquire about our services or receive generic information about how we may be able to provide support services to you.

The nature of the services we provide generally means that it is not possible for us to provide services to a person in an anonymous way or using a pseudonym.

Anonymous donations can be accepted, but we may not be able to provide you with a tax-deductible receipt.

Under State-based health information laws, RFW is required to retain health information for 7 years after the last occasion on which we provided a health service to an individual, except where the information was collected while the individual was under 18. In this case, we are required to keep the keep the records until the individual has reached 25 years of age).

Subject to these specific requirements for health information, we keep personal information for as long as it is needed for any purpose for which it was collected, or in accordance with applicable legislative requirements.

Personal information which is no longer needed or required to be kept by law will be properly de-identified or destroyed.

If you have any questions or concerns about our approach to privacy at Royal Far West, or complaints about how we have handled your personal information, please contact us at:

Royal Far West
14-18 Wentworth Street, Manly, 2095

Email: privacy@royalfarwest.org.au
Phone: 02 8966 8500

For further information on privacy in Australia, please visit the website of the Office of the Australian
Information Commissioner at www.oaic.gov.au

For further information on privacy in Australia, please visit the website of the Office of the Australian Information Commissioner at www.oaic.gov.au

• Privacy Act 1988 (Commonwealth)
• Health Records and Information Privacy Act 2002 (NSW)
• Privacy and Personal Information Protection Act 1998 (NSW)
• Government Information Public Access Act 2009 (NSW)
• Children and Young Persons (Care and Protection Act 1998 (NSW)
• Working with Children legislation across all States and Territories
• Human Rights Act 2019 (Qld)
• Public Health Act 1991 (NSW)
• State Records Act 1998 (NSW)
• Guardianship Act 1987 (NSW)
• Australian Charter of Health Care Rights
• National Safety and Quality Healthcare Standards
• Relevant National Board Codes and Guidelines applicable to APHRA registered Health Practitioners
• NDIS Act 2013 (Cth), NDIS Rules and NDIS Practice Standards
• RFW policies, including the RFW Code of Conduct
• Individual Confidentiality Agreements
• Other laws and standards in place from time to time including those applicable within other States and Territories in which we may operate.

• Names of the child, family members, carers, and/or authorised representative/(s).
• Addresses, including email addresses and IP addresses
• Telephone and fax numbers
• Dates of birth
• Occupation/job title
• Details of the services you have received from us
• Health, schooling, and family history
• Names of treating doctors, diagnoses, treatments, and disabilities
• Medicare details
• Ethnic background
• Lifestyle details, including dietary needs
• Immunisation records
• Current medications
• Court documents, including orders impacting parental responsibility or child safety concerns
• Photographs, where relevant

Below are the types of entities/persons ROYAL FAR WEST may collect your personal information from and may disclose your personal information to. This is not an exhaustive list.

• Medical practitioners, specialists, and allied health providers
• Schools and other relevant care settings
• Medical providers such as hospitals
• Emergency assistance providers
• Family members
• Record management and storage businesses
• Companies engaged by us to collect data, perform evaluations, statistical analyses, and generate health and wellbeing related reporting to support the services we provide to you
• Accreditation or certification organisations
• Our professional advisors including lawyers, accountants, tax advisors and auditors
• Debt collection agencies and other parties that assist with debt-recovery functions
• Child Protection and Care Agencies where authorised or required by law
• Police and law enforcement bodies to assist in their functions or as required by law
• Courts of Law or as otherwise required or authorised by law
• Regulatory or government bodies for the purposes of resolving customer complaints or disputes both internally and externally or to comply with any investigation by one of those bodies
• Credit providers or credit reporting agencies (if you are our supplier)
• Printing, mail, and distribution companies, with your consent
• Third party service providers engaged as our agent to provide specialised health and wellbeing services (including flu vaccinations and executive health checks)

We use and in some instances disclose your personal information when we, or third parties appointed by us, provide the following services:

• to provide products and services, including assessments, programs, requested, prescribed, or ordered on a person’s behalf by their health care provider for their ongoing treatment and care, or the ongoing service to the person;
• to provide information to another person or organisation involved in the ongoing treatment and care of the person, or the ongoing service to the person;
• to provide information or advice about existing and new products or services, including programs;
• to undertake RFW’s business processing functions*, including risk management, financial, auditing, reporting to funding bodies, safety, security, and other such activities;
• advocating for the improvement of service quality and outcomes;
• RFW administrative, marketing (including direct marketing, but only with consent in respect of sensitive and health information), planning*, product or service development and improvement*;
• quality assurance or monitoring activities, training and education (staff and student)*;
• to obtain opinions or comments about our products or services;
• research purposes, or the compilation or analysis of statistics, in the public interest*;
• for provision to accreditation and certification agencies for registration, accreditation, or quality control;
• to assess the performance of our website and improve its operation;
• to maintain our relationship with you, including for the purpose of updating our records and keeping contact and/or consent details up to date;
• to process and respond to complaints;
• to comply with legal requirements (including responding to a legal claim), child safe or wellbeing reporting obligations, directions or governmental requirements; and
• any other purposes that would be reasonably expected.

*Where possible and in all circumstances required by law, RFW will take reasonable steps to deidentify health information before using or disclosing the information and any use or disclosure must be reasonably necessary for the purpose. Where required by law, identified information will only be used or disclosed with consent of the person to whom the information relates.

Version as at December 2024