PRIVACY STATEMENT

Privacy Policy

St Catherine's Hostel Wangaratta Inc ABN 94 626 363 306 of 59-69 Ryley Street, Wangaratta, VIC 3677 is a non-profit private residential aged care provider that was established in 1967 providing accommodation for the elderly of Wangaratta and surrounding areas. St Catherine’s vision is to enrich life throughout the journey of ageing. St Catherine’s mission is through innovate leadership we provide high quality care and services while supporting people in their choice of health, wellbeing and lifestyle. St Catherine's values are:
​

• Respect: We will uphold the worth and dignity of all people regardless of their beliefs or their circumstances.
• Honesty: We will be truthful with all of our dealings with you and each other.
• Integrity: We will be uncompromising and predictably consistent in our commitment to honour our moral, ethical, values and principles.
• Empathy: We will recognise, understand and care how others are feeling, irrespective of our own ideas and experiences.
• ​Accountability: We will acknowledge and take responsibility for our actions, and our decisions.

St Catherine’s acknowledges and recognises that the protection of individuals’ privacy is important and required under the Privacy Act 1988 (Cth) and the Health Records Act 2001 (Vic). We St Catherine’s are committed to the legal, ethical and moral obligations to protect the privacy of individuals who come into contact with St Catherine’s.

St Catherine’s aims to act consistently and comply with its statutory obligations at all times. St Catherine’s promotes a culture which demonstrates a regard for the dignity of others by the manner in which information is collected, secured, used, released and disposed.

St Catherine’s reserves the right (at its discretion) to modify, amend or to replace this policy from time to time. St Catherine’s will make the privacy policy (including as amended, modified, or replaced) to its website from time to time.
​
This policy will be made available to any person requesting a copy.

1. Scope

St Catherine’s requires that all staff (including directors, employees, volunteers and students on work placement) comply with this policy in respect of any personal information collected and handled by or on behalf of St Catherine’s.
​
St Catherine’s also uses its best endeavours to ensure that its contractors and suppliers comply with obligations consistent with this policy in respect of any personal information disclosed or made available to them, and that they only handle personal information for the purpose of providing St Catherine’s with the goods and/or services required.

2. Anonymity and Pseudonymity

2.1 Under the Privacy Act where it is lawful and reasonable to do so, you have the right to deal with us on an anonymous or pseudonymous basis. This means that you do not need to provide St Catherine’s with personal information if and when that information is requested. To the maximum extent required by law and subject to the following, St Catherine’s will enable individuals the option of not identifying themselves, or of using a pseudonym in their dealing with the organisation.

However, if you choose to interact with St Catherine’s in an anonymous or pseudonymous fashion, or you do not provide St Catherine’s with personal information when requested, then St Catherine’s may be unable to provide you with the services that you request.

Further, St Catherine’s reserves the right to request your identity from you in certain circumstances, and to verify your identity if St Catherine’s considers that it is appropriate or reasonable for it to do so.

For example, when you request that St Catherine’s provides certain services to you, St Catherine’s may need to identify you in order to liaise with other service providers and with Government agencies. 
​
Additionally, when you request access to or correction of personal information held about you (in accordance with your statutory rights), or when you wish to make a complaint regarding the manner in which your personal information has been handled, St Catherine’s reserves the right to request your identity and contact details to facilitate St Catherine’s satisfying your request or to investigate and to respond to your complaint.

3. Collection of Personal Information

For the purpose of this policy, personal information is information or opinion which identifies an individual or which could reasonably identify the individual, regardless of whether the information or opinion is in a material form or not.

The following types of information are the types of information generally collected from individuals:
​

• identity information (such as your name, date and place of birth and your age);
• contact information (such as your address, your telephone number and your email address);
• copies of your identification documents (such as your driver’s licence); and
• information regarding your next of kin and Power of Attorney information.

From time to time, St Catherine’s may also collect sensitive information about an individual, including information about an individual’s health (including information regarding pre-existing medical conditions, treatments for those conditions, information regarding a person’s disability or mental health condition), gender, sexual orientation and ethnic origin. 

St Catherine’s may also collect personal information through the use of closed-circuit television cameras that are set up and maintained to monitor certain areas on the premises occupied by St Catherine’s.

St Catherine’s collects and holds sensitive information about staff, including date of birth, next of kin, banking details, payroll information (superannuation, tax file number), employment history, performance information and contact details. This information is required for human resource management, payroll and in the event of an emergency.

If you access or log-in to St Catherine’s through a third party social media service the information St Catherine’s collects may also include your user ID and/or user name associated with that social media service, any information or content you have permitted the third party social media service to share with St Catherine’s, such as your profile picture, email address, followers or friends lists, and any information you have disclosed in connection with that social media service. St Catherine’s does not collect your passwords. When you access St Catherine’s through third party social media services you are authorising St Catherine’s to collect, store use and disclose such information and content in accordance with this Privacy Policy.

When you access and interact with St Catherine’s website, it may collect certain information about those visits. For example, in order to permit your connection to St Catherine’s, its servers receive and record information about your computer, device, and browser, including potentially your IP address, browser type, and other software or hardware information. If you access St Catherine’s from a mobile or other device, we may collect a unique device identifier assigned to that device, geolocation data, or other transactional information from that device.

Cookies and other tracking technologies (such as browser cookies and local storage, pixel beacons, and Adobe Flash technology including cookies) are comprised of small bits of data or code that often include a de-identified or anonymous unique identifier. Websites, apps and other services send this data to your browser when you first request a web page and then store the data on your computer so that such websites, apps and other services can access information when you make subsequent requests for pages from that service. These technologies may also be used to collect and store information such as pages you have visited, content you have viewed, search queries you have run in relation to your usage of St Catherine’s.

Most browsers are initially set to accept cookies, but you can change your settings to notify you when a cookie is being set or updated, or to block cookies altogether. Please consult the "Help" section of your browser for more information. Users can manage the use of Flash technologies, with the Flash management tools available at Adobe’s website. Please note that by blocking any or all cookies you may not have access to certain features, content or personalisation available through St Catherine’s.

​

4. How St Catherine's collects personal information

St Catherine’s collects personal information only using lawful and fair means and St Catherine’s endeavours to collect information about an individual directly from the individual. However, there may be times where St Catherine’s collects information via indirect means, for example:
​

• when information about an individual is collected from the individual’s next of kin or from an attorney appointed by the individual;
• when information about an individual is collected from an external health service provider, general practitioner or specialist medical practitioner;
• when information about an individual is collected from a Government agency; or
• when St Catherine’s is provided with personal information about an individual as part of a complaint made by another individual.

In addition to the foregoing methods of collection, St Catherine’s may collect personal information about you from a variety of sources, using a variety of means, including:
​

• a form (either physical or online) that is completed and submitted to St Catherine’s;
• a telephone, email or in-person inquiry or discussion about St Catherine’s or the services provided;
• a referral to St Catherine’s from another organisation, a medical practitioner or a Government agency;
• mail correspondence, emails and other electronic means (including by accessing St Catherine’s website, the use of the “contact us” form on the website and the use of any social media channels controlled by St Catherine’s);
• through publicly available sources of information;
• from job applicants and employees;
• direct contact in the course of St Catherine’s providing its services; 
• from current and prospective suppliers of goods and/or services to St Catherine’s; and
• through the use of closed circuit television cameras at locations and within the premises controlled by St Catherine’s.

5. Receipt of unsolicited personal information

Generally, St Catherine’s only collects personal information when it is specifically requested or when active steps are taken to collect that information. 
However, from time to time, personal information may be volunteered to St Catherine’s without the information being requested or steps being taken to collect the information. For example, St Catherine’s may receive personal information about an individual when misdirected mail is received or a job applicant applies for a job with St Catherine’s on his/her own initiative and not in response to an advertised vacancy.

Additionally, St Catherine’s may receive unsolicited personal information when St Catherine’s requests an individual to provide certain information and the individual provides more information than requested.

Where unsolicited personal information is received, in accordance with applicable statutory obligations, St Catherine’s will determine whether such information could lawfully have been collected had it been requested or had St Catherine’s actively taken steps to collect the information.
​
If St Catherine’s determines that such unsolicited information could not lawfully had been collected in such a scenario, unless St Catherine’s is required or authorised by law to retain the information, then St Catherine’s will take reasonable steps to destroy or to de-identify that unsolicited information.

6. The purposes for which St Catherine’s collects personal information

Under the Privacy Act, St Catherine’s must only use and disclose personal information for the primary purpose(s) for which the information was collected, any secondary purpose that is related to the primary purpose for which you would reasonably expect St Catherine’s to use or disclose that collected information and as otherwise permitted or required by law.

St Catherine’s takes reasonable steps to make individuals aware of the purpose(s) for which the information collected may be used or disclosed by notifying individuals about all relevant matters at or before the time of collection (including by reference to this privacy policy).

St Catherine’s may use and/or disclose personal information collected about an individual for one or more of the following purposes:
​

• to facilitate St Catherine’s provision of goods and/or services to the individual and/or to a third party which may directly or indirectly benefit the individual;
• to assess the level of care and service appropriate to the needs of the individual;
• to make decisions about the level of funding residents will be entitled to receive;
• processing transactions and administering accounts (including by processing of invoices, bills, statements of account and related financial matters necessary to enable St Catherine’s to provide goods and/or services under relevant contractual arrangements);
• addressing queries and resolving complaints;
• to send information updates, marketing materials and newsletters to individuals who have consented to receive such information and provided that they have not opted out of receiving such information;
• for quality assurance purposes, including to improve the quality of the products and services provided;
• to carry on business as a provider of non-profit private low level aged care residential and related services;
• to comply with obligations owed to Government departments and agencies in relation to reporting relevant information in accordance with funding agreements and other arrangements in place;
• to maintain a safe working environment for staff, contractors and residents;
• to directly market St Catherine’s, its products and services to the wider public.

Additionally, St Catherine’s may use and disclose personal information for the purpose of dealing effectively and efficiently with a request or complaint made to St Catherine’s.
​
St Catherine’s may use and disclose personal information for the purpose of complying with contractual and statutory obligations imposed on St Catherine’s and for the purpose of enforcing the rights that St Catherine’s may have under contract or under law.
St Catherine’s may use and disclose personal information (including sensitive information) to generate aggregated statistical data for the purpose of reporting to Government agencies and to plan for and to implement improvements to the services provided. St Catherine’s takes reasonable steps to ensure that the information used and disclosed for this purpose is de-identified and aggregated, so that the statistical data and reports cannot be used to identify any particular individual.

St Catherine’s will not use and/or disclose personal information collected from an individual for an unrelated secondary purpose unless the individual’s consent is obtained or unless the Privacy Act provides an applicable exception to St Catherine’s (including that it is impracticable to obtain the consent to the use or disclosure and St Catherine’s believes that the collection, use or disclosure of the information is necessary to lessen a serious threat to the life, health or safety of any individual).

7. Disclosure of personal information
​

St Catherine’s may disclose personal information it collects from individuals to third parties but only on an as-needs basis and in order to fulfil one or more of the purposes for which the information was collected, any secondary purpose related to the primary purpose of collection or otherwise as required or authorised by law.

St Catherine’s may disclose personal information to the following parties (without limitation):

• the agents, contractors, suppliers and service providers in order to enable them to provide goods or to perform services for St Catherine’s or on its behalf, or to assist St Catherine’s to provide its goods and services to its clients and stakeholders;
• to consulting health professionals, including medical practitioners, physiotherapists, pharmacists, pathologists, speech therapists, dieticians, social workers, psychologists, occupational therapists and specialist nurses;
• to other service providers, including to volunteers and to community visitors;
• to Courts or to the Commonwealth Government or its agencies, in accordance with and subject to the requirements of the Aged Care Act and other laws, where such disclosure is necessary to enable St Catherine’s obligations under relevant law, or for the purposes of obtaining or reporting on funding, management, planning, monitoring, improvement or evaluation of the services provided by St Catherine’s; and
• ​St Catherine’s professional advisers, insurers and auditors.

​St Catherine’s may also disclose personal information to a person who is responsible for an individual where St Catherine’s has the consent of the individual concerned or the individual is incapable of giving or communicating consent.

Where the individual is incapable of giving or communicating consent, St Catherine’s will only disclose personal information in circumstances where St Catherine’s is satisfied that either the disclosure is necessary to provide appropriate care or treatment or is made for compassionate reasons or is necessary for the purposes of undertaking a quality review of the services provided (and St Catherine’s will limit the disclosure to the extent reasonable and necessary for this purpose).

Such disclosure will only be made where the disclosure is not contrary to any wish previously expressed by the individual of which St Catherine’s is aware, or of which St Catherine’s could reasonably be expected to be aware and the disclosure is limited to the extent reasonable and necessary.
​
For the purposes of this Policy, a “person responsible” is a parent, child or sibling of an individual, a spouse, a relative, a member of the individual’s household, a guardian, an attorney appointed under an enduring power of attorney, a person who has an intimate personal relationship with the individual, or a person nominated by the individual to be contacted in the case of emergency, provided that they are at least 18 years of age.

8. Cross-border Disclosure

Except as set out in this privacy policy, St Catherine’s will only transfer or disclose personal information to a recipient out of Australia if the recipient is subject to substantially similar laws i.e. protected by equivalent privacy standards;

Exceptions:

     a. Individual has consented
     b. The disclosure of information is required or authorised by or under Australian law or a court / tribunal order
     c. The transfer is for the benefit of the individual, it is impractical to obtain the individual’s consent, and if it were feasible, the individual would be likely to consent
     d. Disclosure is necessary to lessen or prevent a serious threat to life, health or safety of any individual, or public health and safety

Reasonable steps have been taken to ensure the information transferred will not be held, used or disclosed by the recipient in a manner inconsistent with the Australian Privacy Principles or the Health Privacy Principles.

However, St Catherine’s may store, process or back-up personal information St Catherine’s has collected on servers (including servers offered through third party service providers under contract to St Catherine’s) that are located in a jurisdiction other than Australia.
Where St Catherine’s enters into a contract with a host provider for the hosting of information for and on behalf of St Catherine’s, all reasonable endeavours are used to ensure that the contract reserves for St Catherine’s the right to control access to the personal information hosted and to avoid the need for the host provider to access the information it hosts for St Catherine’s.

St Catherine’s may enter into contracts for the provision of hosting services with host providers located in Europe, the United States of America and/or other countries, as St Catherine’s determines from time to time in its discretion.
From time to time, St Catherine’s may also disclose personal information about an individual to an overseas contact for the individual’s next of kin or other emergency contact.

​If you communicate with St Catherine’s via email or through a social network service such as Facebook or Twitter, the email or the message may be routed through servers that are located outside Australia and, in relation to a message sent through Facebook or Twitter, the social network provider and its partners could collect, hold and process your personal information in a jurisdiction outside Australia.

9. Adoption, Use or Disclosure of Government Related Identifiers

St Catherine’s undertakes to provide to its residents and staff a personal identification symbol that is independent of identification issued by other agencies. Where, in the course of discharging its obligations, St Catherine’s collects other agency identifications such identification will not be disclosed without the direct approval of the individual.

10. Security of Personal Information

St Catherine’s uses its reasonable endeavours to ensure that all personal information and records are protected from misuse, interference and loss, and from unauthorised access, modification or disclosure, including by permitting access to either electronic or hard copy information only to authorised personnel. All information will be maintained in a secure environment. Electronic and hard copies maintained about personal information will be kept separate to the main register. St Catherine’s maintains a firewall on its local area computer network to ensure unauthorised external access does not occur.

St Catherine’s only holds personal information collected from or about an individual for as long as it is reasonably necessary to fulfil the purpose(s) for which the information was collected or as required by law. When the information is no longer required to be held by St Catherine’s, then reasonable steps will be taken to destroy or to permanently de-identify the information.

St Catherine’s also takes reasonable steps to ensure that a third party to which information is disclosed takes steps to protect the information so disclosed and to destroy or to de-identify the information when it is no longer required.
​
When St Catherine’s takes steps to destroy or to de-identify the personal information that is no longer required for the purpose(s) for which the information was collected, then reasonable steps will be taken to ensure that the information is destroyed or de-identified securely.

11. ​Quality of Personal Information

St Catherine’s takes reasonable steps to ensure that the personal information collected, used and disclosed is accurate, complete and up-to-date. The steps include ensuring that information is recorded in a consistent format and that staff are trained to add updated or new personal information to existing records promptly, and that records are regularly audited to check for inconsistencies.

However, the accuracy, completeness and currency of the information held by St Catherine’s largely depends on the accuracy of the information supplied or collected. If at any time you discover that any information held about you is inaccurate, incomplete, outdated, irrelevant or misleading, please contact St Catherine’s to request correction of the information. 

A correction request will be handled in accordance with the requirements of the Privacy Act, as set out in this privacy policy. However, St Catherine’s reserves the right to verify the identity of the person making a correction request before processing the request.

12. Access to and Correction of Personal Information

St Catherine’s will, subject to the appropriate procedures being complied with, provide access to an individual’s information within a reasonable period of time following receipt of the request to that individual except where such access poses a serious threat to the life or health or safety of the individual public health or public safety, is frivolous or vexatious, relates to existing or anticipated legal proceedings or to the current negotiations between the individual and St Catherine’s, is unlawful, would impede or prejudice any investigation of unlawful activity or required or authorised by or under an Australian law or a court/tribunal order. In such a situation St Catherine’s will explain to the person the reason for denying such access and provide details in relation to the relevant complaint process, should you not agree with the reasons we give for refusing access or correction.

Please note that while St Catherine’s will not charge a fee for making an access request, St Catherine’s is entitled under the Privacy Act to charge a reasonable fee to cover the costs incurred in providing access to the personal information.

If an individual is able to establish that the personal information held by St Catherine’s is not accurate, complete and up-to-date, irrelevant or misleading reasonable steps will be taken to correct the information

If St Catherine’s has disclosed inaccurate, incomplete, out of date, irrelevant or misleading information to another person / organisation St Catherine’s will take reasonable steps to ensure that the person / organisation is aware of the correction to the information.

Given that St Catherine’s holds personal and sensitive information collected from many individuals, and St Catherine’s does not wish to interfere with the privacy of other individuals, St Catherine’s reserves the right to request from you information in order to verify your identity and your connection to the individual about whom you request information (if you are not the individual about whom the information has been collected), in order to ensure that St Catherine’s does not inadvertently disclose personal information about an individual to you when you are not entitled to access or receive such information.
​
Further, St Catherine’s (to the maximum extent permitted by law) reserves the right to redact information made available in response to an access request, in order to protect the privacy of other individuals.

13. Complaint Procedure

To make a complaint about how St Catherine’s handled your personal information, then the complaint should be made in writing to us and addressed to the attention of our privacy officer (details of whom are set out below).

St Catherine’s will promptly acknowledge receipt and will endeavour to deal with the complaint and provide a response to you within a reasonable time period following receipt (generally within 30 days of receipt of the complaint). 

Where the complaint requires a more detailed investigation, the complaint may take longer to resolve. If this is the case, then St Catherine’s will endeavour to provide you with progress reports.

St Catherine’s reserves the right to verify the identity of the person making the complaint and to seek (where appropriate or reasonable) further information from the complainant about the circumstances of the complaint.

Where St Catherine’s is required by law, St Catherine’s will provide its determination on the complaint to the complainant in writing.
In accordance with the Privacy Act, St Catherine’s reserves the right to refuse to investigate or to otherwise deal with a complaint where permitted under law, where such circumstances apply. For example (without limitation), St Catherine’s may refuse to investigate or to otherwise deal with a complaint if St Catherine’s considers the complaint to be vexatious or frivolous.

Please address complaints to the Privacy Officer on (03) 5721 2243 or in writing to: the Privacy Officer, St Catherine’s, 59-69 Ryley Street, Wangaratta, Vic, 3677

If you are not satisfied by our response, you may escalate the complaint to the Office of the Australian Information Commissioner.

14. Further Information

If you would like further information about how St Catherine’s manages personal information or have any questions relating to the “St Catherine’s Privacy Policy”, please contact our Chief Executive Officer on (03) 5721 2243 or in writing to: Chief Executive Officer, St Catherine’s, 59-69 Ryley Street, Wangaratta, Vic, 3677 or by using the form on the contact us page of this website.

Your continued use of this website indicates that you accept this Privacy Policy and consent to the collection and use by St Catherine’s Hostel of any personal information you provide while using this website.