‌PRIVACY POLICY


  1. ‌INTRODUCTION

    This document sets out the privacy policy of CAREVICINITY PTY LTD ACN 656 800 690 (referred to in this privacy policy as 'we', 'us', or 'our').

    We take our privacy obligations seriously and we’ve created this privacy policy to explain how we store, maintain, use and disclose personal information to ensure we comply with the Privacy Act 1988 (Cth) (Privacy Act), the 13 Australian Privacy Principles (APP), and all applicable state and territory privacy legislation.

    This Privacy Policy applies to all personal information collected by us, including sensitive information such as health information.

    By providing personal information (including sensitive information) to us, you consent to our storage, maintenance, use and disclosing of personal information in accordance with this privacy policy.

    We may change this privacy policy from time to time by posting an updated copy on our website and we encourage you to check our website regularly to ensure that you are aware of our most current privacy policy. Material changes to this Privacy Policy will be notified to affected individuals where practicable.


  2. ‌OUR PRINCIPLES

    We are committed to:

    1. collecting personal information only when reasonably necessary for our functions or activities;

    2. collecting information lawfully and fairly, without undue intrusion;

    3. providing transparency about our privacy practices;

    4. protecting personal information from misuse, loss, unauthorised access, modification, and disclosure;

    5. allowing individuals to access and correct their personal information;

    6. providing accountability for our privacy management;

    7. respecting the privacy of children and vulnerable people;

    8. treating health information with the highest level of care and confidentiality;

    9. respecting the rights of individuals to interact with us anonymously or under a pseudonym where practicable;

    10. not adopting government identifiers as our own, and only using such identifiers where authorised by law; and

    11. ‌managing unsolicited information responsibly and securely.


  3. TYPES OF PERSONAL INFORMATION WE COLLECT

    1. The personal information we collect may include the following:

      1. Identifying information: name, date of birth, contact details, gender, residential address, mailing address, email address, telephone number, and social media information;

      2. NDIS and Veterans information: NDIS participant number, plan information, NDIS goal details, VHC participant details, DVA file number, DVA health card details, and service entitlement information;

      3. Government identifiers: Medicare numbers, Australian Tax File Numbers, Centrelink reference numbers, and other government-issued identifiers are collected only where necessary to provide or administer services, or as required by law.

      4. Health information: health history, medical diagnoses, medication details, health conditions, disability information, mental health information, health service provider details, referral information, treatment plans, clinical assessments, healthcare provider reports, and allied health professional reports;

      5. Insurance and entitlements information: private health fund details, private health insurance cover, Medicare number, healthcare identifiers, concession card details, government entitlement details, and pension information;

      6. Financial information: credit card or other payment information, banking details, billing addresses, invoice history, and transaction history;

      7. Service delivery information: information about your support needs, service preferences, accessibility requirements, carer details, emergency contact information, location data (for service delivery purposes), and device information;

      8. Care and support information: family circumstances, social networks, employment status, education details, care arrangements, support requirements, behavioural information, risk assessments, and information relevant to your care and support needs;

      9. Communication and interaction information: device identity and type, internet protocol address, geolocation information, page view statistics, advertising data, standard web log information, and metadata from communications;

      10. Referral and assessment information: information provided by referrers, health professionals, family members, carers, or support coordinators;

      11. Feedback and survey information: feedback on services, survey responses, complaint information, suggestions, and testimonial information;

      12. Third-party information: information about third parties (with appropriate consent) such as nominated contacts, carers, family members, and emergency contacts;

      13. Other information: any other information provided to us via our website, online presence, service agreements, or otherwise required or provided by you in connection with our services.

    2. We collect information about individuals of all ages, including children and people with cognitive or communication difficulties. If you are providing information on behalf of a minor or person without capacity, you must have appropriate authority to do so.


  4. ‌HOW PERSONAL INFORMATION IS COLLECTED

    ‌We will collect your personal information in a lawful and fair way. We will only collect your personal information where you have consented to it, or otherwise in accordance with the law. Where information is collected for secondary purposes, we will take reasonable steps to ensure you are aware of those purposes.


    1. DIRECT COLLECTION

      We may collect personal information where you:

      1. contact us through our website;

      2. receive services from us;

      3. submit any of our online enquiry forms or service applications;

      4. communicate with us via email, telephone, SMS, social applications (such as LinkedIn or Facebook) or otherwise;

      5. interact with our website, social applications, services, content and advertising;

      6. invest in our business or enquire as to a potential purchase in our business; and

      7. provide feedback, complaints or suggestions.

    2. ‌ANONYMITY AND PSEUDONYMITY

      1. You may interact with us anonymously (without providing identifying information) or under a pseudonym in the following circumstances:

        1. making general enquiries about our services;

        2. accessing information on our website;

        3. providing feedback or suggestions;

      2. However, anonymity and pseudonymity are not practicable where:

        1. you are receiving funded services (NDIS, DVA, or other government-funded care);

        2. we need to verify your eligibility or authorisation;

        3. we must comply with regulatory or legal obligations;

        4. we need to coordinate care with other service providers;

        5. payment or billing is involved;

          in these circumstances, we will clearly explain why identifying information is required before collection.


    3. ‌COLLECTION FROM THIRD PARTIES

      1. Where practicable, we collect personal information directly from you. However, we may collect information about you from:

        1. your parent or guardian (if you are under 18 years or lack legal capacity);

        2. your nominated representative, support coordinator, or plan manager;

        3. referring healthcare providers;

        4. NDIA assessors or planners;

        5. DVA or DVA-approved assessment agencies;

        6. family members or carers (with appropriate consent); and

        7. other service providers with whom you have authorised information sharing;

      2. When collecting any information from third parties, we will:

        1. take reasonable steps to verify the accuracy of the information;

        2. confirm that the third party has authority to provide that information;

        3. notify you (or your representative) that we have collected information about you from another source; and

        4. ‌comply with the requirements outlined in section 4.5 below if information is collected without your direct knowledge.


    4. PROVIDING INFORMATION FOR SOMEONE ELSE

      1. If you are providing personal or sensitive information on behalf of someone else you must, and you represent to us that you:

        1. have the express consent of that person (or their legal representative) to provide that information;

        2. have authority to represent that person; and

        3. acknowledge that we will collect, use, and disclose that information in accordance with this Privacy Policy.

      2. This clause will apply where you are:

        1. a parent or legal guardian providing information for a child;

        2. an NDIS participant's nominee, support coordinator, or plan manager;

        3. a carer providing information on behalf of a service user; or

        4. an attorney or guardian acting under power of attorney or guardianship;

      3. We reserve the right to request evidence of your consent or authority before proceeding with service delivery.

      4. Where information is provided for a minor (under 18 years), the parent or legal guardian must provide consent. If we determine the minor has capacity to understand privacy matters, we may require direct consent from the minor as well.


    5. ‌UNSOLICITED PERSONAL INFORMATION

      1. We may receive personal information that we did not solicit (e.g., misdirected emails, over-shared documents, information sent without authorisation, incorrect referrals).

      2. When we receive unsolicited information, we will:

        1. assess whether we could have collected the information under APP 3 (Collection of solicited personal information);

        2. if we could collect it lawfully, we may retain it and treat it as solicited; and

        3. if we could not collect it lawfully, or we do not need it, we will:

          1. securely destroy or delete it without unreasonable delay;

          2. de-identify it where retention is necessary for legitimate purposes; and

          3. maintain a record of the unsolicited information and the action taken.

      3. We will not use unsolicited information for purposes beyond what we would have been authorised to collect it for.


    6. ‌WEBSITE AND COOKIES

      We may also collect personal information from you when you use or access our website or our social media pages. This may be done through use of web analytics tools, ‘cookies’ or other similar tracking technologies that allow us to track and analyse your website usage. Cookies are small files that store information on your computer, mobile phone or other device and enable and allow the creator of the cookie to identify when you visit different websites. If you do not wish information to be stored as a cookie, you can disable cookies in your web browser.


  5. ‌USE OF YOUR PERSONAL INFORMATION


    1. ‌PRIMARY PURPOSES

      We collect and use personal information for the following primary purposes:

      1. to provide goods, services or information to you including:

        1. to assess your eligibility for services;

        2. to plan and deliver services tailored to your needs;

        3. to coordinate with other service providers; and

        4. to monitor service quality and effectiveness;

      2. for record keeping and administrative purposes including:

        1. to comply with legal obligations;

        2. to manage contractual arrangements;

        3. to manage claims and billing; and

        4. to respond to government audits and investigations;

      3. to coordinate care including:

        1. to communicate with healthcare providers, carers, family members, and support networks;

        2. to obtain information necessary to provide appropriate services;

        3. to share information with other service providers for coordinated care; and

        4. to facilitate transitions between services;

      4. for safety and wellbeing, including:

        1. to identify and respond to safety risks;

        2. to respond to mental health or wellbeing concerns;

        3. to provide emergency assistance if required; and

        4. to investigate complaints or incidents;

      5. for government reporting, including:

        1. to provide required reports to NDIA, DVA, or other government agencies;

        2. to respond to freedom of information requests; and

        3. to comply with information-gathering obligations;

      6. for communication, including:

        1. to send you administrative messages, reminders, appointment notifications, updates, security alerts, and other information requested by you;

        2. to respond to your enquiries and requests; and

        3. to notify you of changes to our services or this Privacy Policy;

      7. relating to employment, including:

        1. to consider applications for employment;

        2. to conduct background checks and reference checks; and

        3. to manage personnel and payroll;

      8. for service improvement, including:

      9. to improve and optimise our service offering, customer experience, and website functionality;

        1. to conduct quality reviews and performance analysis;

        2. to develop new services; and

        3. to analyse feedback and complaints; and

        1. for research and evaluation (de-identified), including:

          1. to conduct service evaluation (with consent);

          2. to improve evidence-based practice; and

          3. to contribute to research approved by appropriate ethics committees.


    2. ‌SECONDARY PURPOSES

      1. We may also use your personal information for:

        1. secondary purposes closely related to the primary purpose, in circumstances where you would reasonably expect such use;

        2. such purposes where we reasonably believe that use of your personal information is necessary to lessen or prevent a serious threat to the life, health or safety of any individual, or to public health or safety, and it is unreasonable or impracticable to obtain your consent;

        3. any other purpose for which we receive consent from you; or

        4. any other purpose which is permitted or required under applicable privacy laws.

      2. If we intend to use or disclose personal information for a purpose that is not directly related to our primary purpose and that you would not reasonably expect, we will (where practicable):

        1. take reasonable steps to inform you of the new purpose before collection;

        2. obtain your consent before using or disclosing the information for that purpose; and

        3. if you do not consent, use or disclose the information only if permitted by law.

      3. The following secondary purposes are purposes we expect a likelihood of occurring:

        1. de-identified statistical or research purposes;

        2. service improvement and evaluation;

        3. disclosure to peak bodies, industry organisations, or government agencies for regulatory compliance;

        4. historical or archival purposes;

        5. legal proceedings or dispute resolution.


    3. ‌SENSITIVE INFORMATION RESTRICTED USES

      1. Sensitive information is used only for the primary purposes listed below in the clause 8.

      2. We do not use sensitive information for direct marketing or commercial purposes.

      3. We do not use sensitive information to make automated decisions that significantly affect you (such as eligibility decisions) without appropriate human review.


  6. ‌HOW WE DISCLOSE YOUR PERSONAL INFORMATION

    1. We may disclose your personal information to:

      1. Healthcare providers: Other health professionals, medical practitioners, nurses, allied health professionals, and treatment providers involved in providing services to you or to whom we refer you;

      2. Support coordinators: Participants' NDIS support coordinators, plan managers, or representatives;

      3. Government agencies: NDIA, DVA, state and territory health and disability agencies, My Aged Care, or other relevant government bodies;

      4. Professional advisers: Lawyers, accountants, auditors, and other professional advisers;

      5. Related entities: Related entities or associated organisations within our corporate group;

      6. Third-party service providers: Cloud service providers, IT professionals, marketing agencies, debt collection agencies, and other contractors who provide services on our behalf;

      7. Family and carers: Your family members, nominated emergency contacts, or carers (where you have consented and it is relevant to their care or support role);

      8. Other service providers: With your consent, other agencies providing complementary services (respite care, community support, etc.);

      9. Parties you have consented to: Any third parties to whom you have given specific consent for information to be disclosed.

    2. We may also disclose personal information to third party contractors as required for us to provide our goods and services to you, such as cloud-service providers, IT professionals, marketing agencies and debt collection agencies.

    3. We take care to work with such third parties who we believe maintain an acceptable standard of data security and require them not to use your personal information for any purpose except for those activities we have asked them to perform on our behalf. Before we disclose your personal information to any third-party service providers we:

      1. assess their privacy and security practices;

      2. require contractual commitments to handle information securely and confidentially;

      3. limit their access to information only for purposes we have specified;

      4. require them not to use our information for their own purposes; and

      5. ensure they comply with the Privacy Act and applicable privacy legislation.

    4. We may provide personal information to government agencies (NDIA, DVA, and other regulatory bodies) where:

      1. required by legislation;

      2. necessary for funding or service allocation purposes;

      3. required for program evaluation or performance monitoring; and

      4. in response to statutory inquiries or investigations.

    5. We may disclose personal information without your consent:

      1. as needed in an emergency or in investigation suspected criminal activity;

      2. we are required to disclose under a subpoena, court order or other mandatory reporting requirements;

      3. we reasonably believe that disclosure of your information is necessary to lessen or prevent a serious threat to the life, health or safety of any individual, or to public health or safety, and it is unreasonable or impracticable to obtain your consent;

      4. it is reasonably necessary for the establishment, exercise or defence of a legal claim; or

      5. it is otherwise authorised or required by law.

    6. We do not sell, lease, or trade personal information to third parties or provide personal information to marketing companies, data brokers, or advertising networks.

    7. Disclosures are made only where necessary for service delivery, legal compliance or with your express consent.


  7. ‌STORAGE, SECURITY AND DATA RETENTION


    1. ‌STORAGE

      1. All personal information we collect is stored on servers located in Australia.

      2. Where cloud service providers operate overseas disaster recovery sites, we have contractual safeguards to:

        1. protect information stored in overseas systems;

        2. ensure overseas storage complies with Australian privacy law;

        3. limit access to authorised personnel only; and

        4. maintain encryption and security standards.


    2. ‌SECURITY

      We implement comprehensive security measures to protect personal information from:

      1. unauthorised access;

      2. misuse or interference;

      3. loss or theft;

      4. unauthorised modification or disclosure; or

      5. ‌damage.


    3. DATA RETENTION

      We retain personal information only for as long as it is needed for the purposes for which it was collected or as required by law, as follows:

      1. health information:

        1. a minimum of 7 years from the date of the last service provision;

        2. longer periods for children (until age 25); and

        3. extended periods for matters with ongoing legal implications;

      2. NDIS-related information:

        1. as specified by NDIA and in accordance with NDIS legislation; or

        2. the minimum period determined by funding agreements;

      3. VHC program information:

        1. as specified by DVA and in accordance with Veterans legislation; or

        2. the minimum period as defined in VHC contracts and agreements;

      4. financial records:

        1. a minimum of 7 years; or

        2. longer for superannuation or tax-related matters;

      5. employment records:

        1. a minimum of 7 years after employment ceases; or

        2. longer where legal claims exist;

      6. complaint and incident records:

        1. a minimum of 7 years; or

        2. permanently for serious incidents;

      7. website and analytics data:

        1. typically 12-24 months unless longer retention is required;

      8. after the retention period expires, we will:

      9. securely destroy or permanently delete the information;

        1. de-identify the information where it will be retained for research or statistical purposes; and

        2. ‌maintain a record of destruction including what was destroyed and when.


    4. DESTRUCTION AND DE-IDENTIFICATION

      We implement secure destruction procedures for personal information that is no longer required including:

      1. for paper records:

        1. shredding or incineration;

        2. secure disposal contractors; and

        3. documented destruction records; and

      2. for electronic records:

        1. permanent deletion with forensic verification;

        2. secure disposal of hardware;

        3. data wiping to industry standards; and

        4. ‌destruction certification.


  8. SENSITIVE INFORMATION

    We recognise that health information, including disability information, mental health information, and information about medical conditions, is sensitive information under the Privacy Act and requires special protection.

      1. ‌COLLECTION OF SENSITIVE INFORMATION

        1. We may collect sensitive information about you during the course of providing you our goods and services. We will only collect this sensitive information where you consent to such collection and either directly provide us with this information or it is provided by a referring health care provider.

        2. We collect sensitive information either directly from you or from authorised referral sources (such as health professionals, NDIS coordinators, or DVA-approved assessors) with your consent;

        3. We will not collect sensitive information from third parties without obtaining your consent first, except where required by law;

        4. We maintain records of all consents to collect, use, and disclose sensitive information;

        5. You may withdraw your consent to collection of sensitive information at any time by notifying us in writing;

        6. If we receive sensitive information that we did not solicit, we will assess whether we could have lawfully collected it. If not, we will securely destroy it without unreasonable delay, unless retention is necessary for health and safety reasons.


      2. ‌TYPES OF SENSITIVE INFORMATION WE COLLECT

        The sensitive information we collect may include the following:

        1. health information including diagnoses, medical history, treatment records, hospitalisation details, disability assessments, mental health information, medication histories, and health reports;

        2. referring health care provider and associated referral documents;

        3. your NDIS or DVA participant details, plan goals and management of funding for goods and services;

        4. private health fund and private health insurance cover details;

        5. genetic information or biometric information (if applicable to your care needs);

        6. information about alleged, suspected, or actual criminal activity (if relevant to your safety or service provision);

        7. information relating to your sexual orientation, gender identity, or other sensitive personal characteristics (if relevant to ensuring culturally appropriate service delivery);

        8. Medicare number, healthcare identifiers or concession card or other entitlement details; and

        9. ‌any other sensitive information provided by you or a third party to us via our website or platforms, or otherwise provided by you or a third party to us.


      3. HOW WE USE YOUR SENSITIVE INFORMATION

        Your sensitive information will only be used for our primary purposes listed in this privacy policy or for the purpose of:

        1. providing you with our goods and services;

        2. complying with our legal obligations, resolving disputes or enforcing our agreements with you;

        3. sending you messages, reminders, notices, updates, security alerts, and other information requested by you; or

        4. any other purpose which is permitted or required under applicable privacy laws.


      4. ‌HOW WE DISCLOSE YOUR SENSITIVE INFORMATION

        1. Your sensitive information will only be disclosed for or to:

          1. other healthcare providers involved in your care (with your consent);

          2. NDIA or DVA for assessment or reporting purposes;

          3. professional advisers (lawyers, accountants, auditors) on a need-to-know basis;

          4. our related entities or associated organisations;

          5. third-party service providers contractually bound to maintain confidentiality;

          6. where required or authorised by law; and

          7. where you have specifically consented.

        2. We do not disclose sensitive information to marketing third parties or for commercial purposes.

        3. If disclosure is necessary for health and safety reasons (e.g., to prevent serious harm), we may disclose without your consent but will document and notify you where reasonable.

        4. All staff handling sensitive information must acknowledge their obligations under this Privacy Policy and the Privacy Act.


  9. ‌DATA QUALITY AND ACCURACY

    1. We take reasonable steps to ensure that personal information we hold is:

      1. accurate, complete, and current;

      2. relevant to our functions and activities;

      3. not misleading;

      4. up-to-date where necessary for our purposes.

    2. We regularly review and update personal information in our possession.

    3. We take reasonable steps to correct information that we become aware is inaccurate.

    4. Where we receive updated information from you, other service providers, or government agencies, we will promptly update our records.

    5. You are responsible for ensuring that information you provide to us is accurate and complete.

    6. If you believe we hold inaccurate, incomplete, or misleading information about you, you should notify us immediately and we will investigate your concerns and take corrective action where appropriate.


  10. ‌INDIVIDUAL RIGHTS AND ACCESS TO PERSONAL INFORMATION‌


    1. RIGHT TO ACCESS

      1. You have the right to request access to personal information we hold about you.

      2. To request access, please contact us using the details provided in the Contact Us section, including:

        1. your name and contact details;

        2. a description of the information you are seeking; and

        3. the purpose for which you are requesting access.

      3. We may require you to:

        1. complete an access request form;

        2. verify your identity before providing access; and/or

        3. pay a reasonable administrative fee.

      4. We will respond to your access request within a reasonable timeframe (generally 30 days, or as required by law).

      5. We will provide information in the form you request (electronic or hard copy) where practicable.

      6. We will provide reasons in writing if we refuse access, including information about our complaint process.


    2. ‌LIMITATIONS ON ACCESS

      1. We may refuse access where:

        1. providing access would pose a serious threat to the life, health, or safety of any individual;

        2. providing access would have an unreasonable impact on the privacy of other individuals;

        3. the request is frivolous or vexatious;

        4. the information is subject to legal professional privilege;

        5. disclosure would breach a court order or injunction;

        6. the information relates to ongoing legal proceedings and would not be accessible through normal legal discovery; or

        7. disclosure would reveal investigative techniques or methods.

      2. We will provide written reasons and complaint information if access is refused.


    3. ‌RIGHT TO CORRECTION

      1. You have the right to request that we correct personal information that is inaccurate, incomplete, or misleading.

      2. To request correction, please contact us with:

        1. your name and contact details;

        2. description of the information you believe is inaccurate;

        3. the correction or updated information; and

        4. reasons why you believe the information requires correction.

      3. We will take reasonable steps to correct information within a reasonable timeframe (generally 30 days).

      4. We will notify you when information has been corrected.

      5. If we do not make the requested correction, we will provide written reasons.


    4. ‌RIGHT TO REQUEST ALTERNATIVE FORM OF ACCESS

      1. You may request information be provided in alternative formats (large print, audio, electronic, etc.).

      2. We will accommodate reasonable requests where practicable.

      3. ‌We may charge a reasonable fee for providing information in alternative formats.


    5. REPRESENTATIVES

      1. You may authorise a representative (family member, carer, advocate, lawyer) to request access to your information.

      2. We may require written evidence of the representative's authority.

      3. We will verify the representative's authority before providing information.


  11. ‌DE-IDENTIFIED INFORMATION

    1. Where we de-identify information (by removing personal identifiers so that the person cannot be re-identified), we may:

      1. process and analyse the information for statistical purposes;

      2. use the information for research, service evaluation, and service improvement;

      3. share the information with third parties for these purposes;

      4. retain the information indefinitely; and

      5. create aggregate reports and insights.

    2. We will not seek to re-identify de-identified information without explicit consent.

    3. We may release de-identified written documentation, case studies, or statistical reports, including:

      1. with your consent where appropriate;

      2. in fully de-identified form where you cannot be identified;

      3. in aggregate form where individual identities are not apparent.

    4. Any de-identified information will be kept separate from identified personal information to prevent re-identification.


  12. ‌ELIGIBLE DATA BREACHES AND NOTIFICATION


    1. ‌DEFINITION OF AN ELIGIBLE DATA BREACH

      An eligible data breach occurs when there is an unauthorised disclosure or loss of personal information where it is likely that serious harm could result to any individual.


    2. ‌OUR DATA BREACH RESPONSE

      1. We will implement procedures to:

        1. detect data breaches as soon as possible;

        2. assess whether a breach is an eligible data breach;

        3. notify affected individuals and the Privacy Commissioner immediately (without unreasonable delay); and

        4. take immediate steps to contain and remediate the breach;

      2. Our Eligible Data Breach Management Plan sets out our procedures in detail.


    3. ‌WHAT WE WILL DO IF A DATA BREACH OCCURS

      Where an eligible data breach occurs, we will:

      1. immediately secure all systems and prevent further unauthorised access;

      2. conduct a forensic investigation to determine:

        1. what information was accessed or lost;

        2. how the breach occurred;

        3. who may have been affected; and

        4. the likelihood of serious harm;

      3. notify affected individuals promptly:

        1. by letter, email, or phone;

        2. in clear language explaining what happened;

        3. the information that was affected;

        4. steps they should take; and

        5. our contact information;

      4. notify the Privacy Commissioner:

        1. within 30 days of discovering the breach (if it is an eligible data breach); and

        2. provide details of the breach and steps taken; and

      5. conduct remediation including:

        1. resetting passwords and access credentials;

        2. offering identity monitoring services if appropriate;

        3. reviewing and strengthening security measures; and

        4. implementing improvements to prevent recurrence.


    4. ‌BREACH NOTIFICATION CONTENT

      1. All breach notifications will include:

        1. a description of what happened;

        2. the date of the breach;

        3. the information affected;

        4. the steps the individual should take;

        5. our contact information; and

        6. information about complaints.

      2. We will not delay notification to verify or investigate matters unless it is essential to do so.


    5. ‌RECORD OF BREACHES

      1. We maintain a register of all data breaches (eligible and non-eligible).

      2. The register documents include:

        1. date of breach;

        2. description of breach;

        3. information affected;

        4. number of individuals affected;

        5. response steps taken; and

        6. the outcome.


  13. ‌MARKETING

    We may send you marketing communications and promotional materials to inform you about our services, events, and special offers.


      1. ‌COMPLIANCE WITH THE SPAM ACT

        1. We comply with the Spam Act 2003 (Cth) in all marketing communications.

        2. We will only send marketing communications via email, SMS, social media, phone, or mail where:

          1. you have explicitly opted-in to receiving marketing communications;

          2. you have given us consent when you initially signed up;

          3. you did not opt-out when given the option; and

          4. it is a subsequent communication to an existing customer.

        3. We will not send marketing to individuals who have opted out.

        4. All email marketing messages will include clear information about how to unsubscribe.


      2. ‌OPTING OUT OF MARKETING:

        1. You can opt out of receiving marketing communications at any time:

          1. by clicking the unsubscribe link in email messages;

          2. by replying to SMS messages with "STOP";

          3. by adjusting settings on our social media pages; or

          4. by contacting us directly (see Contact Us section).

        2. We will process unsubscribe requests as soon as possible, though there may be a brief delay as we update our systems.

        3. Opting out of marketing does not affect our ability to send you administrative or transactional messages.


      3. ‌MARKETING TO VULNERABLE PEOPLE.

        1. We take care not to engage in marketing or promotions that target vulnerable people or that could be misleading.

        2. We do not engage in aggressive or deceptive marketing practices.

        3. Any marketing materials will clearly identify them as such and include our contact information.


  14. ‌LINKS


    1. ‌EXTERNAL LINKS

      1. Our website may contain links to external websites and social media platforms.

      2. We are not responsible for the privacy practices of linked websites.

      3. When you follow external links, you leave our website and enter another organisation's privacy environment.

      4. We recommend you review the privacy policies of external websites before providing information.

      5. Links do not constitute endorsement of those websites or their privacy practices.


    2. ‌SOCIAL MEDIA

      1. We maintain profiles on social media platforms (Facebook, LinkedIn, etc.).

      2. When you interact with us through social media:

        1. the social media provider's privacy policy applies in addition to this policy; and

        2. the social media provider collects information about your interactions. We have limited control over what information the provider collects and retains.

      3. We will not collect personal information from social media profiles except where you have made that information publicly available and you interact with our profile.

      4. ‌We recommend adjusting your social media privacy settings to control what information is visible.


  15. COMPLAINTS


    1. ‌MAKING A COMPLAINT.

      1. If you have a concern about how we handle your personal information or believe we have breached the Privacy Act or an Australian Privacy Principle, you may lodge a complaint.

      2. To lodge a complaint, please contact us using the details in the Contact Us section, including:

        1. your name and contact details;

        2. a description of the complaint;

        3. the date the issue arose;

        4. steps you have taken to resolve the issue; and

        5. relevant supporting documents.

      3. We will acknowledge receipt of your complaint within 2 business days.

    2. ‌OUR COMPLAINT PROCESS

      1. We will investigate your complaint promptly and in a fair and impartial manner.

      2. We will provide you with a response within 30 days of receiving your complaint.

      3. If we cannot resolve the complaint within 30 days, we will notify you and provide a timeframe for resolution.

      4. We will keep you informed of the progress.

      5. Our response will include:

        1. our findings;

        2. actions we are taking;

        3. reasons for our response; and

        4. your rights to escalate the complaint.

      6. We will not take adverse action or discriminate against you for lodging a complaint.


    3. ‌ESCALATION TO PRIVACY COMMISSIONER.

      1. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC) via the following details:

        Office of the Australian Information Commissioner Phone: 1300 363 992

        Email: enquiries@oaic.gov.au Website: www.oaic.gov.au

        Mail: GPO Box 5218, Sydney NSW 2001

      2. The OAIC will assess your complaint and may investigate our privacy practices.

      3. The OAIC can compel us to take remedial action if they find we have breached privacy law.


    4. ‌COMPLAINT RECORD

      1. We maintain a record of all privacy complaints, including:

        1. date received;

        2. nature of complaint;

        3. investigation findings;

        4. response provided; and

        5. time taken to resolve.

      2. We use complaints to identify systemic privacy issues and improve our practices.


  16. ‌CHILDREN’S PRIVACY AND YOUNG PEOPLE‌


    1. INFORMATION ABOUT CHILDREN

      1. We may collect personal information about children (under 18 years) where we provide services to them.

      2. Before collecting sensitive information about a child, we obtain consent from:

        1. The parent or legal guardian; and

        2. The child (if they have demonstrated capacity).

      3. We take age-appropriate steps to explain our privacy practices to children.

      4. We do not engage in direct marketing to children.

    2. ‌CAPACITY AND CONSENT.

      1. We assess whether a child has capacity to understand privacy and consent to collection.

      2. Where a child has capacity, we may accept their consent in addition to parental consent.

      3. Where a child lacks capacity, we rely on parental or guardian consent.


  17. ‌CONTACT US

For further information about our privacy policy or practices, or to access or correct your personal information, or make a complaint, please contact us using the details set out below:

Name: CAREVICINITY

Email: hello@carevicinity.com.au

Our privacy policy was last updated on 5 December 2025