Privacy Policy - Wesley Research Institute

1. PRIVACY COMMITMENT

In this privacy policy (Privacy Policy), “we” and “us” refers to Wesley Research Institute and “you” refers to any person about whom we collect personal information.

Wesley Research Institute takes your privacy seriously and is committed to protecting the privacy and personal information of all of its donors, supporters, patients, researchers, volunteers and staff.

This Privacy Policy represents how Wesley Research Institute manages your personal information in accordance with the Privacy Act 1988 (Cth) (Privacy Act). Our Privacy Policy seeks to safeguard the privacy of your personal information in accordance with the Australian Privacy Principles (APPs) contained within the Privacy Act. This Privacy Policy sets out the kind of information we hold and how we collect, hold, use and disclose that information (including personal and sensitive information, which includes health information).

This Privacy Policy may be amended or revised at any time. The revised Privacy Policy will take effect when it is uploaded on our website. This Privacy Policy represents the latest version of the Privacy Policy.

More information about the privacy provisions can be obtained by calling the Office of the Australian Information Commissioner (OAIC) on or 1300 363 992 or by visiting www.oaic.gov.au.

2. KINDS OF PERSONAL INFORMATION COLLECTED

As the research partner for UnitingCare Queensland, Wesley Research Institute will conduct fundraising activities for medical research in Brisbane and beyond. Accordingly, Wesley Research Institute may collect both personal and sensitive information from you.

Personal information is any information about you that identifies you or by which your identity may be reasonably determined. The kinds of personal information that may be collected from you includes, but is not limited to your full name, address, phone number, email address, date of birth and payment details. If you are making a donation or requesting products or services from us or we are purchasing goods or services from you, then any relevant payment or billing information (including bank account details, credit card details, billing address and invoice details) may be collected. We may also collect information about family members and/or associates, information about personal and social circumstances, financial information, education information, employment information, details relating to donations made to us, and other information necessary for the purposes of carrying out our functions.

By collecting this personal information, we are able to contact you, when necessary, identify and protect your information from unauthorised use and provide the best possible service.

Sensitive information is a subset of personal information and includes information or an opinion about an individual’s race, religion, political or trade association, criminal record or health information about an individual.

Health information is one kind of sensitive information and includes information or an opinion:

(a) about an individual’s health or disability at any time (that is, past, present or future);

(b) about an individual’s expressed wishes regarding future health services;

(d) collected while providing a health service; and

(e) collected in connection with the donation or intended donation of body parts and substances.

This means that personal details related to an individual’s attendance with a health services provider (e.g., name, address, Medicare number, billing information), medical information, notes made by healthcare personnel, identifiable biological specimens or samples, or genetic information all constitute “health information”.

3. UNSOLICITED INFORMATION

‘Unsolicited’ information refers to information which is received but which Wesley Research Institute has taken no active steps to collect.

If Wesley Research Institute receives unsolicited personal information, we will make an assessment as to whether we could have collected the personal information from you ourselves. If we could not, we will destroy or de-identify it as soon as practicable, unless it is contained in a Commonwealth record or it is unlawful or unreasonable to do so.

4. HOW PERSONAL INFORMATION IS COLLECTED

Wesley Research Institute collects personal information from a number of sources including the individuals to whom the information relates, family members and associates, other fundraising organisations, community service organisations, schools, employers, and other individuals and/or entities who may have information relevant to Wesley Research Institute activities.

Where possible, Wesley Research Institute will always collect personal information directly from you. Where we are unable to obtain personal information directly from you, we will obtain your consent before information is obtained from a third party.

Collection of your personal information may occur in a number of ways, including:

(a) admission or client forms;

(b) website interactions;

(d) mobile phone applications;

(e) telephone conversations;

(f) in person;

(g) when a complaint is lodged with Wesley Research Institute;

(h) for the purposes of considering the suitability of job applicants and hiring staff members;

(i) if you make a donation; and

(j) if you join our mailing list.

Wesley Research Institute must:

(a) only collect health information necessary for its functions or activities;

(b) collect health information directly from an individual;

(c) take reasonable steps, at the time of collecting health information or as soon as practicable afterwards, to make an individual aware of why the information is being collected, who it may be disclosed to, how it can be accessed etc; and

(d) only collect health information with the express or implied consent of the individual concerned, unless collection is required by law, or it is necessary to prevent a serious threat to life or health of any person.

Wesley Research Institute may also collect information about how visitors use its website to help personalise products and/or services to you and provide a better user experience when browsing the Wesley Research Institute website. This may happen when you click on a link on the Wesley Research Institute website or visit the site through advertising that may have been paid for. The information collected in this way is general information collected by cookies. This information may identify site visits but does not identify or give Wesley Research Institute any identifying information about the visitor as an individual.

The use of cookies on our websites allows us to track usage patterns and to compile data in an aggregated and “non-user” specific form enabling us to improve our website for future visitors. If you do not want information collected through the use of cookies, there is a simple procedure in most browsers that allows you to deny or accept the cookie feature.

The information obtained by us through the use of cookies and similar technologies may be used for marketing purposes in accordance with this Privacy Policy.

Supporters of Wesley Research Institute

When you make a donation, register for an event or make inquiries about our activities, we may collect your personal information including your research areas of interest and event attendance, your donation history and payment information including your credit card details.

We collect this information to process your payments, send you receipts as well as surveys, newsletters and information about research, education and fundraising events and activities. We may use your information to contact you to seek financial support for medical research conducted at Wesley Research Institute. Typically, Wesley Research Institute sends two to three appeal letters a year as well as several issues of our newsletter. You may choose what you receive at any time. If you do not wish us to use your personal information for any of the above purposes, please contact us using the details below (Access to and Correction of Information – section 15).

Research participants

If you participate in the research and clinical trial activities and programs that Wesley Research Institute conducts, we collect personal information to record your involvement and to process the results of research and clinical trials and to contact you regarding participation in future studies. The information we collect from you will generally be sensitive information because it will be your health information and could be other sensitive information such as information about your racial or ethnic origin.

We may collect your personal information including:

(a) your medical history including, where relevant, a family medical history;

(b) your Medicare number and information about your private health insurance;

(d) the name of any care provider, health service provider or medical specialist to whom we refer you back to or has referred you to us, copies of any referrals and reports; and

(e) test results and samples.

Information may also be collected about individuals who are not research participants when Wesley Research Institute makes a record about a research participant. For example, when collecting emergency contact details or a family medical history.

From time to time we may collate and analyse statistical data from information we have previously collected. In these cases, the data will be de-identified and aggregated before it is disclosed to third parties.

As a medical research organisation, Wesley Research Institute also operates biobanks which store biological samples and associated health data for use in research. Third party research organisations may provide Wesley Research Institute with samples and data from participants in their research studies, for inclusion in a biobank. We may use these samples and data to generate genetic or genomic information. Biobanks are a valuable resource to support research to develop new treatments, drugs and therapies and to understand health and disease conditions more broadly. We work with reputable contractors and third party service providers to operate our biobanks. Our biobanks are designed and managed to protect the privacy of individuals and to comply with the highest standard of legal requirements and clinical ethics. In most cases, the biological samples and associated data are de-identified and it is not possible to identify individuals to whom the sample and associated data relates. Where this is the case, the samples and data will not be personal information which is subject to privacy laws. Where Wesley Research Institute does hold personal information in a biobank, it will be handled in accordance with this Privacy Policy.

All research and clinical trials undertaken at Wesley Research Institute are approved by an external Human Research Ethics Committee. Research participants enrolled in trials or research will be given further information detailing how their personal information (including health information) will be handled by Wesley Research Institute.

GPs, referring doctors and other healthcare professionals

Wesley Research Institute may collect personal information about individual health practitioners who interact with Wesley Research Institute such as referring doctors or other health professionals involved in the care of our research participants. This is typically information such as your name, contact details, professional details and information regarding interactions or transactions with Wesley Research Institute. This information is collected for the purpose of administration, management and operation of Wesley Research Institute.

Applicants for positions with Wesley Research Institute

We may collect personal information when we are canvassing recruitment of staff and PhD students. Generally speaking, we will collect personal information that you supply to us as part of this process for the purpose of assessing applications and proposals. Wesley Research Institute will collect personal information about you such as your educational/academic history and work history. We will collect personal information about you from third parties, such as your referees, as part of our assessment of your suitability for a position.

This Privacy Policy does not apply to employee records held by Wesley Research Institute relating to an employee or former employee of Wesley Research Institute.

Other individuals

Wesley Research Institute may collect personal information about individuals who we deal with on a commercial basis such as suppliers, contractors and individuals in organisations to which we provide goods and services or from which we acquire goods and services. We may collect personal information about you including your name, position, contact details, licence or registration numbers, ABN, bank details and other information relevant to the capacity in which you are dealing with Wesley Research Institute.

5. HOW PERSONAL INFORMATION IS HELD

Personal information is ‘held’ by Wesley Research Institute where it has possession or control of a record that contains personal information.

Wesley Research Institute may store your personal information in hard copy or electronic format, physically on our premises, or internal servers and with third party data service providers in Australia, the United States and Singapore. Where personal information is disclosed to an overseas recipient, Wesley Research Institute will take all responsible steps before its disclosure to ensure that the recipient does not breach the APPs in relation to that information. Wesley Research Institute agrees to only disclose personal information for the primary purpose for which it was collected, unless an exception applies.

Wesley Research Institute has policies and procedures in place to protect personal and sensitive information from misuse, interference and loss, unauthorised access, modification or disclosure. These policies and procedures are discussed further in section 15 of this Privacy Policy.

6. PURPOSE OF COLLECTING AND USING PERSONAL INFORMATION

Wesley Research Institute collects and holds personal information about you in order to provide our services to you.

We collect your personal information for purposes including:

(a) undertaking medical research, including research relevant to providing advanced care for patients, improvements in diagnostic techniques novel treatment options and faster recovery pathways;

(b) assessing suitability for participation in a clinical trial;

(c) conduction clinical trials to investigate new treatments, therapies, drugs and diagnostic tools for use in clinical practices;

(d) contacting you in relation to participation in clinical trials;

(e) for donors and supporters to foster relationships for philanthropy purposes;

(f) for the purpose of fundraising, including the processing of donations and grants;

(g) for the purpose of administration and management of donations or our goods and services, including charging, billing, credit card authorisation and verification and collecting debts to the extent that such information is not directly provided to our third party hosted payment system for processing;

(h) in connection with marketing, events, conferences and promotional activities by us (including by direct mail, telemarketing, email, SMS and MMS messages);

(i) contacting and communicating with you;

(j) to perform our administrative functions;

(k) in respect of collection of staff information, for the purposes of maintaining a human resources files;

(l) to satisfy Wesley Research Institute’s legal obligations and to allow Wesley Research Institute to discharge its duty of care; and

(m) resolving complaints or enquiries.

7. DIRECT MARKETING

Who are Supporters and what are Direct Marketing Communications?

For the purpose of this section, a “Supporter” is an individual or organisation who has donated or participated in fundraising and other activities in support of Wesley Research Institute, and “Direct Marketing Communication” is any communications about products, services, events, fundraising or any other activity (including third party products, services, events and fundraising) which may be of interest to you.

Consent by Supporters

Where you are a Supporter:

(a) you expressly consent to us using your personal information; including any email address you give to us, to send you Direct Marketing Communications;

(b) you expressly consent to us disclosing your personal information to Uniting Care or other partners who may also use your personal information for sending you Direct Marketing Communications. We will take reasonable steps to ensure that your information is used by other partners in accordance with the terms of the Privacy Act;

(c) you expressly consent to us disclosing your personal information to other likeminded organisations (including other charities, and third party service providers who facilitate the sharing of information between such types of charitable or likeminded organisations) who may also use your personal information for sending you Direct Marketing Communications. We will take reasonable steps to ensure that your information is used by such organisations in accordance with the terms of the Privacy Act; and

(d) if at any time you do not wish us to disclose your personal information to others under paragraphs (b) or (c) or you do not wish to receive any further Direct Marketing Communications from us, then you can simply request to opt out of receiving further Direct Marketing Communications from us and/or ask that we not to disclose your information to other organisations for that purpose. In the case of paragraph (c) we will give you an opportunity to opt out not less than 30 days before we disclose your personal information to such organisations. You may do this by contacting us by email at: enquiries@wesleyresearch.org.au, by calling us on (07) 3721 1500 or by writing to us at Wesley Research Institute PO Box 499 Toowong QLD 4066.

8. USE AND DISCLOSURE OF PERSONAL INFORMATION

We may disclose your personal information to a person or party outside Wesley Research Institute:

(a) for the primary purpose for which it was collected;

(b) for directly related secondary purposes that would have been within your reasonable expectations at the time;

(d) if required by law;

(e) if you consent to the disclosure; or

(f) otherwise as permitted by the Privacy Act.

Where possible, we will require you to specifically consent to any use of disclosure of your personal information. Your consent will usually be required in writing. However, where necessary, we may accept your verbal consent to disclose particular information in providing our services to you.

Personal information which Wesley Research Institute collects may, from time to time, be stored and processed in and transferred between the countries abroad in which Wesley Research Institute has service providers or suppliers. This disclosure enables the use of your information in accordance with this Privacy Policy. Your information may be held by us in our servers (which are located in Australia) or by our service providers or suppliers (whose servers may be located in countries abroad). By using our services, you are taken to have agreed and consented to such cross-border transfers of your personal information contemplated by the Privacy Policy. Wesley Research Institute may also use various software and tools for storing and sharing your information to other third party service providers, contractors or agents.

9. NOTICE OF COLLECTION OF PERSONAL INFORMATION

Wesley Research Institute will take reasonable steps before, or at the time it collects personal information to notify you of the collection of personal information, including the purposes of collection.

If it is not practicable to provide a collection notice before, or at the time personal information is collected, Wesley Research Institute will take steps as soon as practicable after collection to provide notice, and to ensure that you are aware, as soon as practicable, after the collection.

10. CONSEQUENCE IF PERSONAL INFORMATION NOT COLLECTED

Wesley Research Institute requires personal and sensitive information (including health information) to consider an individual’s eligibility and suitability for participation in a clinical trial. Wesley Research Institute may not be able to recruit an individual for participation in a clinical trial in the absence of such information.

11. ANONYMITY AND PSEUDONYMITY

Unless required or authorised by or under an Australian law or a court or tribunal order, you may deal anonymously or by pseudonym with Wesley Research Institute. If Wesley Research Institute is required by a law or order to deal with an identified individual, Wesley Research Institute can require you to identify yourself.

12. COLLECTING INFORMATION FROM THIRD PARTIES

On occasion, Wesley Research Institute may collect information from a third party. For example, Wesley Research Institute may collect information from the following:

(a) organisations that Wesley Research Institute is partnering with for joint fundraising efforts;

(b) agencies that Wesley Research Institute use to provide products or services and / or to promote a product/service; and

13. ACCURACY OF PERSONAL INFORMATION

Wesley Research Institute will take reasonable steps to ensure that all personal information it holds to accurate, up-to-date, complete, relevant and not misleading. You may ask Wesley Research Institute to correct any personal information that Wesley Research Institute holds. Wesley Research Institute will then consider whether or not to change or update the information. If Wesley Research Institute does not change or amend the information as requested, then written reasons for the refusal will be provided.

All requests for amendments or corrections must be sent to enquiries@wesleyresearch.org.au.

14. SECURITY OF PERSONAL INFORMATION

Personal information is stored on secure servers which are administered and protected by Wesley Research Institute.

Wesley Research Institute will take all reasonable steps to protect personal information it holds for misuse, interference and loss, as well as unauthorised access, modification or disclosure. The steps and strategies implemented by Wesley Research Institute to ensure the security of personal information include:

(a) Educating our staff and clients about their obligations in relation to your personal information;

(b) Requiring staff to use passwords when accessing our systems;

(d) Ensuring all Wesley Research Institute employees, date processes and external parties adhere to strict confidentiality policies and practices;

(e) Providing secure storage for physical records; and

(f) Destruction and de-identification.

Where Wesley Research Institute no longer needs personal information for any purpose for which the personal information may be used or disclosed under the APPs, Wesley Research Institute will take all reasonable steps to securely destroy the information or ensure that it is de-identified, except where:

(a) The personal information is part of a Commonwealth record; or

(b) Wesley Research Institute is required by law or a court/tribunal order to retain the personal information.

15. ACCESS TO AND CORRECTION OF INFORMATION

All persons have a right to access their personal information held by Wesley Research Institute, and to advise Wesley Research Institute of any inaccuracy. Accessing your personal information is free.

You may access and/or request that your personal information be edited or corrected by contacting the Privacy Officer at Wesley Research Institute:

(a) By phone: (07) 3721 1500

(b) Email: enquiries@wesleyresearch.org.au

Wesley Research Institute

PO Box 499

Toowong QLD 4066

You may be asked to submit your request in writing and for information that identifies you to satisfy Wesley Research Institute that a request for personal information is made by your personally. If so, include:

(a) your name and contact details;

(b) the personal information you want to access;

(c) how you’d like access to the personal information (such as receiving a copy by email or post, or if you just want to look at the information); and

(d) if you authorise a person or organisation to access the personal information on your behalf.

There are certain circumstances where Wesley Research Institute can deny access to personal information – for example where giving access would have adverse and unreasonable implications on the privacy of others, where granting access is unlawful or where denying access is required by law.

If Wesley Research Institute refuses your access or correction request, Wesley Research Institute will provide written reasons for the refusal, including information to complain about the refusal.

Wesley Research Institute reserves the right to change its guidelines for providing access.

16. THIRD PARTY WEBSITES

When you leave our website, you will be going to websites that are beyond our control. Our Privacy Policy does not apply to third party websites, and we encourage you to review the privacy policies which apply to third party websites.

17. FEEDBACK

Wesley Research Institute appreciates the feedback of all its donors, supporters, patients, researchers, employees, and site visitors. If you would like to provide feedback, please contact us at enquires@wesleyresearch.org.au.

18. COMPLAINTS

If you are unsatisfied with the manner in which we have dealt with your personal information, you may make a complaint by emailing us at enquiries@wesleyresearch.org.au.

When you make a complaint, you should:

(a) identify yourself;

(b) provide a contact address and a contact phone number;

(c) provide a brief description of the matter and why you think Wesley Research Institute has mishandled your personal information; and

(d) let us know what you would like us to do to resolve the matter.

We will, within fourteen days, respond to you and attempt to resolve with you your issues as they relate to your personal information.

If you are still unsatisfied, you may wish to direct your complaint to the OAIC. The OAIC accepts written complaints via its privacy complaint form or via email. Please refer to the OACI’s website for further information concerning how to lodge a privacy complaint:

https://www.oaic.gov.au/privacy/privacy-complaints/lodge-a-privacy-complaint-with-us/.

You may also send your complaint to the OAIC by:

(a) Emailing your complaint to enquiries@oaic.gov.au

(b) Sending a letter by post to:

Director of Privacy Case Management

GPO Box 5218

Sydney NSW 2001

19. THE SPAM ACT 2003

The Spam Act prohibits the sending of unsolicited emails, SMS and MMS messages for commercial purposes from or within Australia or to people in Australia and bans the supply and use of software designed to harvest email addresses. While charities do have some exemptions from this Act, the Wesley Research Institute will be guided by the best practice guidelines developed on responsible electronic messaging practices by the Association for Data-driven Marketing & Advertising in conjunction with industry and consumer representatives and administered by the Australian Communications and Media Authority.