1.1. Policy statement
Red Nose Limited ABN 81 462 345 159 (”Red Nose”) takes its privacy obligations seriously. The organisation handles all Personal Information and Sensitive Information in accordance with the Australian Privacy Principles contained in the Privacy Act 1988 (”the Act”).
This Privacy Policy (“Policy”) explains how Red Nose collects, handles and uses Personal Information and Sensitive Information. It provides information for any person who has questions about how the organisation handles their Personal Information and Sensitive Information.
By providing your Personal Information or Sensitive Information to Red Nose, you confirm that you agree to Red Nose collecting, using and disclosing your Personal Information and Sensitive Information in accordance with this Policy and otherwise pursuant to the Act.
If you have any questions about the Policy, or the application of the Policy to you, please contact the Red Nose Privacy Officer, whose details are set out in section 5.
1.2. Scope
The Policy applies to all Personal Information and Sensitive Information collected by Red Nose (including its employees; both permanent and casual, contract workers and volunteers
responsible for the collection of Personal Information and Sensitive Information in the course of their engagement) howsoever collected and to all activities undertaken in the name of Red Nose.
1.3. Definitions
For the purposes of the Policy:
“Personal Information”
means information or an opinion about an identified individual, or an individual who is
reasonably identifiable. It includes information or opinion:
a) whether the information or opinion is true; and
b) whether the information or opinion is recorded in a material form or not.
“Sensitive Information”
means a type of personal information about an individual including their health,
demographics, criminal record, sexual orientation, which has been requested by
Red Nose or is given to Red Nose, which it has not requested.
This definition includes both sensitive information that is provided to Red Nose:
(1) in response to a specific request for such information by Red Nose; and
(2) without a specific request for the disclosure of such information (i.e. sensitive information that is voluntarily disclosed to Red Nose).
1.4. Principles
The following principles form the basis of, and are addressed in further detail in, this Policy:
a) the right to privacy of people bereaved by the death of a baby or child, their families and all people who receive a service from Red Nose or provide information to Red Nose, shall be ensured;
b) Personal Information in any form shall be managed with diligence, and, where relevant, confidentiality issues will be explained in detail; and
c) Red Nose shall be open and accountable about how Personal Information is handled.
2. PRINCIPLE A: THE RIGHT TO PRIVACY OF PEOPLE BEREAVED BY THE DEATH OF A BABY OR CHILD, THEIR FAMILIES AND ALL PEOPLE WHO RECEIVE A SERVICE FROM RED NOSE OR PROVIDE INFORMATION TO RED NOSE, SHALL BE ENSURED
2.1. Individual Consent and Details of Red Nose
Where Personal Information or Sensitive Information is collected from you, Red Nose will ensure that:
a) your consent to collect your information is obtained;
b) you are provided with details about Red Nose;
c) you are provided with details of who may have access to your Personal Information or Sensitive Information;
d) only information necessary for the activities of Red Nose will be collected and recorded; and
e) information given in confidence will remain confidential.
2.2. Use and disclosure of information
In general, Red Nose will only use or disclose your Personal Information and Sensitive
Information for the primary purpose for which the information was collected.
If Personal Information or Secondary Information is proposed to be used for a purpose other than the primary purpose
(”secondary purpose”) then:
a) in the case of Personal Information, where practical Red Nose will obtain your prior consent to use that Personal Information for a secondary purpose, and will de-identify that Personal Information wherever possible;
b) in the case of Sensitive Information, the secondary purpose must be directly connected to the primary purpose. Red Nose will obtain your prior consent to use that Sensitive information for the secondary purpose and will de-identify that Sensitive information upon receiving your consent,
in any event, the use or disclosure of Personal Information and/or Sensitive Information for a secondary purpose may only occur where there is a strong public interest in doing so (e.g. where there is a serious threat to life, where disclosure is required by law or for research which is in the public interest and complies with guidelines).
Red Nose may also use and disclose your Personal Information as requested or
directed by you.
3. PRINCIPLE B: PERSONAL INFORMATION IN ANY FORM SHALL BE MANAGED WITH DILIGENCE, AND, WHERE RELEVANT, CONFIDENTIALITY ISSUES WILL BE EXPLAINED IN DETAIL
3.1. Data Quality
Red Nose will take reasonable steps to ensure that the information it collects, uses, retains or discloses is accurate, complete, up to date and relevant to its functions or activities.
3.2. Data security and data retention
Red Nose will take all reasonable steps to protect the information it holds from misuse and loss and from unauthorised access, modification or disclosure.
Where information is provided to Red Nose, subject to any authorisation or requirement at law, it will:
a) be held in accordance with this Policy for seven years; and
b) not be deleted, prior to the expiration of the seven-year retention period, during which time it may be accessed by you or Red Nose in accordance with this Policy. Information will be de-identified or destroyed when it is no longer required or no longer required to be held by Red Nose.
4. PRINCIPLE C: RED NOSE SHALL BE OPEN AND ACCOUNTABLE ABOUT HOW PERSONAL INFORMATION IS HANDLED
4.1. Openness
Red Nose will document clearly the policies and
procedures on the management of information and will make this information available
to you on request.
Upon receipt of your request, Red Nose will:
a) tell you whether Red Nose holds your Personal Information;
b) provide you with details of how to obtain access to that Personal Information; and
c) subject to compliance with law and this Policy, provide you with access to your Personal Information.
4.2. Identifiers
Red Nose shall only use details which identify your Personal Information where it is necessary to carry out its functions.
4.3. Anonymity and Withholding Personal Information
When providing Red Nose with Personal Information, you will have the option of remaining anonymous or providing a pseudonym. However, if you choose not to
provide the Personal Information requested, Red Nose may be unable to provide you with:
a) Red Nose bereavement support;
b) Red Nose advice or training services;
c) responses to your queries or requests; or
d) in the case of donations, issue a tax-deductible receipt.
4.4. Transfer or closure of the Organisation
In the event that Red Nose is sold, transferred, closed down or amalgamated, if Red Nose continues to hold your Personal Information or Sensitive Information, it will take reasonable steps to inform you of how that information will be held and dealt with.
4.5. Transfer to another health provider
In the event that you wish to transfer to another health care provider, upon receipt of a written request from you, Red Nose will provide the new provider with a copy or written summary
of your health care information.
The written request must contain:
a) sufficient information concerning your identity to enable Red Nose to determine the relevant information to be provided;
b) details of the new provider; and
c) details of the privacy officer of the new provider.
Red Nose will provide you with a confirmation once this summary has been provided.
4.6. Kinds of Personal Information
The kinds of Personal Information that Red Nose may collect and hold in accordance with this Policy includes:
a) identifying information, e.g. name and date of birth;
b) details of the products and/or services accessed or provided to an individual;
c) information about how products and services provided by Red Nose are used by individuals;
d) records of Red Nose’s interactions with individuals;
e) contact information, e.g. address, email and telephone number(s);
f) financial information, e.g. credit card, bank account or other payment details;
g) details of products or services provided to Red Nose;
h) individuals’ IP addresses, locations or activities; and
i) social media handles and other social media profile information made available to Red Nose or to the public.
4.7. Collection of Personal Information
Red Nose will collect Personal Information from:
a) employees;
b) job applicants;
c) the general public (such as visitors to Red Nose website and social media channels);
d) third parties, including Red Nose professional Marketing and fundraising contractors;
e) publicly available sources or information; and
f) individuals when they:
i) seek and/or accept assistance from Red Nose;
ii) receive Red Nose products or services;
iii) donate or fundraise for Red Nose;
iv) become a peer supporter or volunteer;
v) provide Red Nose with products or services;
vi) provide products or services on behalf of Red Nose;
vii) submit a query or request to Red Nose;
viii) participate in programs or events run or supported by Red Nose;
ix) access the Red Nose website, social media or mobile applications; or
x) respond to a Red Nose survey or fill in a Red Nose form.
4.8. Collection of Sensitive Information
Red Nose may also collect Sensitive Information about you, such as health information. Red Nose will seek your consent to the collection, use and disclosure of that information at the time of collection.
The kinds of Sensitive Information that Red Nose may collect and hold in accordance with this Policy include information about individuals’ health, wellbeing and support needs, and those of their family members relevant to the provision of services by Red Nose.
4.9. Purposes for collection and use of information
Red Nose will provide you with details about the reason for the collection of Personal Information or Sensitive Information at the time of collection, as well as any other specific matters that are relevant to the collection of that information.
Depending on your particular circumstances at the time that information is collected, Red Nose will, with your consent, collect and use Personal Information in accordance with this Policy for the purposes of enabling Red Nose to:
a) determine the suitability of Red Nose bereavement services for you and your family;
b) provide counselling and bereavement support services to you and your family;
c) complete an assessment of the bereavement services while the services are being provided to ensure that they are effective and safe;
d) provide safe sleeping and safe pregnancy advice;
e) manage Red Nose’s continuing relationship with you, which includes confirming your identity, responding to any queries or requests you may have and contacting you for follow-up purposes;
f) raise funds (e.g. through direct fundraising, administering monthly donation programs, and bequests);
g) analyse the use of products and services provided by Red Nose;
h) complete quality assurance activities, including through working with third parties;
i) provide education and training, both internally and externally (e.g. to Red Nose staff and other organisations);
j) provide you with details of Red Nose activities, which includes newsletters and electronic communications;
k) manage and develop Red Nose business and operational processes and systems;
l) manage and resolve any legal or commercial complaints or issues;
m) comply with any legal obligations of Red Nose;
n) understand the use and personalise user experience of the Red Nose website and social media channels;
o) monitor the Red Nose website and social media channels statistics; and
p) perform any other functions and activities relating to the Red Nose business.
4.10. Direct Marketing
Red Nose may use Personal Information to send individuals marketing materials about products or services that may be of interest to them.
Individuals can opt-out of receiving these marketing communications at any time by contacting the Red Nose Supporter Team on 1300 998 698 or emailing mail@rednose.org.au.
4.11. People to whom Red Nose discloses Personal Information
Red Nose will be authorised to share your Personal Information with another person upon receiving a written request or written consent from you to share your Personal Information. Red Nose will only share your Personal Information in accordance with that written request or consent.
In addition to specific consents or requests, Red Nose will ask for your permission to share your Personal Information at the time of collection and will provide you with Red Nose’s reasons for sharing your Personal Information.
Red Nose may, in accordance with this Policy and your request or consent, share your information with:
a) Red Nose staff, contractors and volunteers, each on a ‘need-to-know’ basis;
b) other persons authorised by or responsible for you, e.g. your employer when participating in a Red Nose training program;
c) Red Nose’s business partners, agents, professional advisors and service providers (including health service providers, translators, interpreters and other third parties Red Nose works with or engage, to provide the services);
d) your representatives and advisers;
e) government agencies (e.g. such as those from whom Red Nose receives funding);
f) universities and research organisations;
g) payment system operators and financial institutions; and
h) other parties as authorised or required by law.
From time to time, Red Nose may need to disclose your Personal Information to a third party located overseas for a purpose set out in the Policy. If such disclosure is required, Red Nose will disclose that Personal Information only to the extent necessary and otherwise in accordance with this Policy.
Red Nose will take reasonable steps to ensure that the third party handles Personal Information in accordance with Australian privacy laws.
4.12. Storage and security of information
Red Nose stores collected Personal Information and Sensitive Information:
a) in electronic databases (which may be held on behalf of Red Nose by third party data storage providers); and
b) in hard copy records (which may be in physical storage facilities operated by third parties on behalf of Red Nose).
Red Nose uses physical and technological security measures to protect the confidentiality and security of that information held, which are regularly updated to address new and emerging security threats, for example, upon collection of Sensitive Information such as health information:
a) it is stored securely (both physically and electronically); and
b) access is provided only to Red Nose personnel who need to use this information.
Red Nose will only keep your Personal Information and Sensitive Information for as long as required and for the purposes described in this Policy and in privacy and health records legislation.
4.13. Notifiable Data Breaches
As an agency regulated under the Act, Red Nose is required to notify affected individuals and the Office of the Australian Information Commissioner (”OAIC”) when a data breach is
likely to result in serious harm to individuals whose Personal Information or Sensitive Information is involved in the breach.
Red Nose will comply with all requirements and processes under the Act and as outlined on the OAIC website to fulfil its obligations if such circumstances occur.
If you are concerned that your Personal Information or Sensitive Information may have been involved in a data breach you can also access relevant information on the OAIC
website or contact Red Nose’s Privacy Officer, whose details are set out in section 5.
4.14. Access and correction
You may wish to access, correct or update some or all of your Personal Information held by Red Nose. If so, you will need to contact the Red Nose Privacy Officer, whose details are set out in section 5.
If you wish to have your personal information deleted, please contact us and we will take reasonable steps to delete it unless we need to keep it for legal, auditing or internal risk management reasons.
To ensure that only your information is accessible, Red Nose will require you to provide information to allow Red Nose to confirm your identity.
In some cases, Red Nose may not be able to provide you with information in response to a request – this could happen if, for example, it would place you at risk of harm, interfere with the privacy of others or result in a breach of confidentiality. In these cases, Red Nose will provide you with the reasons why it cannot comply with your request.
4.15. Queries and complaints
Red Nose aims to always meet the highest standards to safeguard your privacy.
If you are concerned about the way in which Red Nose manages their Personal Information or Sensitive Information, or want to discuss this Policy, please contact Red Nose’s Privacy Officer using the contact details set out in section 5.
Red Nose will keep records of all complaints or queries and aim to deal with all matters as soon as possible.
In addition to contacting Red Nose’s Privacy Officer, you are also entitled under the Act to make a complaint to the OAIC, especially if Red Nose has not responded to you within a reasonable time or if you feel that your complaint has not been satisfactorily resolved. Details of the OAIC contact person may be found here: https://www.oaic.gov.au/about-us/contact-us.
4.16. Changes to the Privacy Policy
Red Nose may make changes to this Policy from time to time to account for changes to standard practices and procedures or changes in law.
The latest version of this Policy will always be available on the Red Nose website.
5. RED NOSE PRIVACY OFFICER
Privacy Officer
Red Nose Australia
Suite 4, 670 Canterbury Road, SURREY HILLS VIC 3127
Tel: 1300 998 698
Email: info@rednose.org.au
Date of last review: 26 September 2019