Privacy Policy

PURPOSE

Aged Care and Housing Group Inc (we or us) is a not-for-profit incorporated association that provides aged care services and accommodation for the purpose of supporting good lives for older people.

We are required by the Privacy Act 1988 (Cth) (Privacy Act) to comply with the Australian Privacy Principles (APPs). The APPs set out the manner in which organisations may collect, store, use, and disclose Personal Information and how a person can access and/or correct records containing their Personal Information.

As a registered provider under the Aged Care Act 2024 (Cth) (Aged Care Act), we are also required to comply with the relevant requirements dealing with the handling of Personal and Protected Information. We are required to uphold an individual’s right to have their privacy respected and their Personal Information protected.

The purpose of this policy is to provide information on:

• what Personal Information we may collect;
• how we handle Personal Information we collect; and
• how you can access your Personal Information or make a complaint about our handling of your Personal Information.

SCOPE

This policy applies to:

• our Customers, including their relatives or authorised representatives;
• job applicants and their referees;
• Workforce (where information is collected for non-employment purposes);
• contractors and prospective contractors, including health service providers;
• donors; and
• any other individuals who interact with or come into contact with us.

When we collect Personal Information from you, we will provide a privacy collection notice as required by APP5.

EXCLUSIONS

Under the Privacy Act, our handling of employee records of current and former employees is exempt from the APPs and therefore is excluded from the scope of this Privacy Policy.

DEFINITION

For this policy, the following definitions apply:

Workforce

ACH Group board members, employees, volunteers, and students.

Customer

ACH Group Customers (residents, care recipients and other individuals), including prospective Customers, and their families, who live in or receive care, treatment, or services in the following settings:

• residential care homes;
• respite care;
• home care services;
• health studios;
• social and wellness programs; or
• retirement villages.

Personal Information

Information or an opinion (including written and verbal information or an opinion forming part of a data base), whether true or not, and whether recorded in a material form or not, about an identified individual or an individual who is reasonably identifiable.

It may include, for example, basic identifying information such as name and address, health information, financial information, or employment information such as job title or work schedule.

Sensitive Information

Personal information which includes details of an individual’s racial or ethnic origin, religious or philosophical beliefs, employment record, criminal record or health/mental health information and/or other personal information that is ‘sensitive information’ as defined in the Privacy Act.

Protected Information

For the purposes of this Privacy Policy, under the Aged Care Act, Protected Information is defined as information that is personal information which is obtained or generated for the purpose of providing aged care or information which is derived from such information.

POLICY

We are committed to recognising and valuing the importance of privacy. Handling information appropriately supports us in building and maintaining the trust of our Customers, Workforce, and partners in the provision of aged care services.

As part of this commitment, we:

are transparent about the Personal Information we collect;

• only collect Personal Information that is necessary for the services we provide;
• ensure Personal Information is handled in accordance with the law;
• take reasonable steps to keep all Personal Information secure;
• provide privacy training to our Workforce;
• build privacy considerations into our contractual and other arrangements, including where other organisations or contractors are used to deliver services on our behalf;
• monitor activities to ensure compliance and identify areas for improvement; and
• notify affected individuals and the Australian Information Commissioner in the event of a data breach, when required to comply with our regulatory obligations.

DEALING WITH US ANONYMOUSLY OR USING A PSEUDONYM

We collect Personal Information from you to provide services and to operate our business. We may also collect Sensitive Information from you.

If we are unable to collect Personal Information, we may be unable to provide the services required or continue our relationship with you.

Where possible, individuals may choose to remain anonymous or use a different name when dealing with us. However, this may not be possible if:

• it is impracticable to proceed without identification; or
• identification is required by law, a court, or tribunal.

WHAT TYPES OF PERSONAL INFORMATION WE COLLECT

The type of Personal Information we collect and why we collect it depends on your relationship with us.

We collect Personal Information from Customers, Workforce, job applicants, students on work placement, donors, and other individuals when they choose to engage with us.

The type of Personal Information and Sensitive Information collected depends on your relationship with us, may include, but is not limited to:

• Customers: name, address, date of birth, details of next of kin, emergency contacts, financial information and sensitive information such as health and medical information, racial or ethnic origin, religious beliefs or affiliations, and;
• Workforce: name, address, date of birth, emergency contact information, criminal history records;
• job applicants: employment history and qualifications, information provided in resumes and cover letters, information from interviews, reference checks, criminal history records, and health information such as medical assessments;
• students on work placement: academic history, placement agreements, contact details, and emergency information;
• donors: donation records, contact details, and preferences for communication;
• other individuals: any information provided in the course of interacting with us, such as through feedback forms, surveys, or event participation.

More information about the type of Personal Information and Sensitive Information can be in the table attached to this Policy.

HOW WE COLLECT PERSONAL INFORMATION

We will generally collect Personal Information directly from you, using forms and documents (including in electronic form) you submit to us, such as when you are applying for services, when we undertake health assessments or care planning, or when you enter into a contract with us.

We also collect Personal Information through:

• publicly available sources, including social media;
• correspondence, telephone calls, or meetings;
• online interactions through our website;
• closed circuit television (CCTV) or other monitoring systems at our premises; and
• photography or videography in the course of providing services, such as during consultations or provision of medical services.

Information from third parties

We also collect Personal Information from third parties depending on your relationship with us, including:

• Customers: from relatives or other authorised representatives, health service providers, or relevant government agencies;
• job applicants and contractors: we may collect details of any existing criminal record from police agencies or agencies completing police checks on our behalf, information from your references and previous employers; and
• students: we may collect details of any existing criminal record from police agencies or agencies completing police checks, as well as information about the student from educational institutions.

If we collect Personal Information from a third-party, we will, where appropriate and practicable, request that the third-party inform you that we are holding the information, how we will use and disclose it, and that we can be contacted to gain access to and correct or update the information.

Unsolicited information

If we receive unsolicited information (e.g., an email sent to us by mistake), we will check if we could have lawfully collected it. If not, we will destroy or anonymise the information as soon as possible, unless it’s reasonable and lawful to keep it. If we do keep it, we will handle it according to this Policy.

Handling of government identifiers

Tax file numbers and other government identifiers will only be handled in accordance with relevant legislation, if applicable.

PURPOSES FOR WHICH WE COLLECT, USE AND DISCLOSE PERSONAL INFORMATION

We collect, use and disclose your Personal Information to:

• assess eligibility for services, tailor services or provide the appropriate care or support to Customers;
• manage and conduct our business for the provision of aged care services and accommodation;
• comply with legal and regulatory obligations, resolve any disputes and enforce our agreements and rights with third parties;
• to offer or promote our products and services;
• to obtain feedback;
• to help us manage, develop and enhance our services, including our websites and applications;
• assess suitability and eligibility for employment, or work placement roles;
• manage donations and communicate with donors; and
• improve our services, programs, and communication with stakeholders.

DISCLOSURE OF PERSONAL INFORMATION

In certain circumstances including those contemplated by the Aged Care Act, we disclose your Personal Information to third parties, including the following types of individuals or entities:

• medical or healthcare professionals, health funds and those providing services to our Customers;
• relatives or authorised representatives;
• contractors, consultants, advisors, associates, volunteers, students, and related entities who are subject to confidentiality obligations;
• industry bodies, tribunals, courts, or others, in connection with any complaints made;
• government departments or funding agencies, police agencies and agencies who complete criminal history checks, such as CrimTrac;
• a purchaser of our business, or part of our business, as a going concern; and
• other entities with the required consent or as permitted or required by law.

We may disclose the Personal Information of members of our Workforce, if required to:

• health services providers;
• other employees in the course of conducting referee checks;
• the Australian Tax Office;
• workplace regulators, including for workplace health and safety, and workers compensation purposes;
• superannuation and insurance bodies; or
• external auditors or regulators.

We may aggregate or de-identify statistical information so that individuals cannot be identified, for use in our internal purposes or for sharing with government agencies or research organisations.

Overseas disclosure

We do not generally disclose Personal Information to overseas recipients, except when our third-party service providers use cloud-based systems located offshore. This means Personal Information may be stored on overseas servers.

KEEPING YOUR PERSONAL INFORMATION SAFE

How we store Personal Information

We store Personal Information in both paper form and electronically.

Electronic records may be stored on local and/or cloud-based platforms. Our cloud storage providers are contractually required to handle Personal Information securely and in accordance with privacy laws.

How we protect Personal Information

We have strict security measures in place to protect Personal Information from misuse, interference, loss, and unauthorised access, modification, or disclosure. These measures include:

• policies and procedures: clear security protocols for our Workforce and contractors to follow;
• secure storage: physical files are stored in secured facilities both on our premises and at offsite locations;
• restricted access: only authorised members of our Workforce and contractors, who need access for their role, can view certain Personal or Sensitive Information;
• secure transmission: electronic information is transmitted using secure networks or encryption. However, despite our best endeavours, it is important to note that no internet transmission is completely secure; and
• device and network protection: security tools such as authentication controls, firewalls, virus scanning and intrusion detection help safeguard our systems

How we handle data breaches

We take data breaches seriously. If a data breach that is defined as an eligible data breach under the Privacy Act occurs, we will notify the affected individuals and the Australian Information Commissioner if required in accordance with our regulatory obligations.

How long we retain Personal Information

We retain Personal Information only as long as necessary for the primary purpose of collection or a lawful secondary purpose.

Generally, records are kept for at least seven years from the date of the last record.

When no longer needed, Personal Information is securely destroyed or de-identified.

How we destroy Personal Information

When Personal Information is no longer required for our functions, activities, or legal obligations, we securely destroy or permanently de-identified it to protect privacy and prevent unauthorised access.

We follow all legal and regulatory requirements when destroying information, ensuring compliance with the Privacy Act and other relevant laws.

Personal Information on private devices

We are not responsible for Personal Information Customers store on personal devices or within residences in our housing services. However, we can assist with security measures upon request.

COOKIES AND THIRD-PARTY WEBSITES

Cookies are small data files stored on a person’s computer, mobile phone or other device when visiting a website. They help track pages visited and improve website functionality, and remember your preferences.

Our website uses cookies. Browser settings can be adjusted to block cookies; however, this may limit website functionality.

Whilst we do not use browsing information to identify you personally, we can record certain information about your use of our website, such as which pages you visit, the time and date of your visit, search engine referrals and the internet protocol address assigned to your computer.

Our web pages can contain electronic images, known as web beacons. These electronic images enable us to count users who have visited certain pages on our website. Web beacons are not used by us to access your personal information, they are simply a tool we use to analyse which web pages are viewed, in an aggregate number.

We are not responsible for third-party websites, platforms, or applications linked to, or associated with our services. Their privacy policies should be reviewed before use. Some third-party platforms may offer tools to manage privacy settings and opt out of personalised ads.

CLOSED CIRCUIT TELEVISION (CCTV)

We may use CCTV systems at our sites. We may collect your Personal Information via CCTV for the purpose of:

• monitoring the safety and security of our Customers, Workforce and suppliers, and completing incident investigations;
• detecting and deterring unauthorised access to, or unwelcome or criminal behaviour at, our venues; and
• implementing and enforcing our policies and procedures.

CCTV footage may be disclosed to third parties, such as:

• law enforcement agencies;
• third party service providers; or
• our third party claims management provider in connection with incidents. The claims manager may provide CCTV footage to its related entities as part of its ordinary claims management practices.

ACCESSING AND CORRECTING PERSONAL INFORMATION

You can request access to or correction of the Personal Information we hold about you, by contacting us using our details in the “contact us” section below, or by completing a Request for Information Form, and providing it to a member of our Workforce.

We will address such requests as soon as practicable, and usually within 28 days.

We may require you to verify your identity or the authority you have to request information if the information relates to someone other than yourself, before the access to Personal Information is granted.

Access may be denied in certain circumstances, such as where releasing the information would impact another person’s privacy or where legal restrictions apply. If we decide to refuse your request, we will tell you why in writing and how to complain.

MAKING A COMPLAINT

If there are concerns about a possible breach of the Privacy Act, APPs, or any related privacy code, a complaint can be made:

• verbally;
• through a feedback form; or
• in writing to the Privacy Officer using the contact details below.

Upon receiving a complaint, we will confirm how we intend to address the issue as soon as reasonably practicable.

If the response is unsatisfactory, complaints can be escalated to the Office of the Australian Information Commissioner (OAIC). More information on lodging a complaint is available at www.oaic.gov.au/privacy/privacy-complaints.

CONTACT US

For privacy-related enquiries or complaints, please contact:

Privacy Officer
Executive Manager, Legal and Risk
PO Box 646, Torrensville Plaza, SA 5031
Email: [email protected]

VARIATION OF THIS POLICY

We may update this Privacy Policy, from time to time, to take account of changes to law or regulations and changes to our services or business operations.

Attachment 1: Types of Personal Information We Collect [.pdf]