The values and philosophy of Mercy Services have implications on how personal information is collected, stored, used and disclosed. Mercy Services starts from a belief that each individual should control who has information about her/him and what is done with this information.

Mercy Services is required to comply with the Australian Privacy Principles in relation to personal information and sensitive information.

Personal information is any information that can be used to personally identify you. This may include your name, address, telephone number, email address and profession or occupation. If the information we collect personally identifies you, or you are reasonably identifiable from it, the information will be considered personal information.

Sensitive information has the highest level of protection and is defined as information or an opinion about an individual’s:

• racial or ethnic origin;
• political opinions;
• membership of a political association;
• religious beliefs or affiliations;
• philosophical beliefs;
• membership of a professional or trade association;
• membership of a trade union;
• sexual preferences or practices;
• criminal record; or
• health information

The Health Records Information Privacy Act (NSW) also applies a higher privacy standard to organisations, such as Mercy Services, that hold “health information”.

Health information includes information or an opinion about the physical or mental health or disability of an individual. Health information also includes personal information that is information or an opinion about:

• a health service provided, or to be provided, to an individual;
• an individual’s express wishes about the future provision of health services to him or her;
• other personal information collected in connection with the donation of human tissue; and
• genetic information that is or could be predictive of the health of an individual or their relatives or descendants.

As a health service provider, ‘health information’ includes all of the above plus any other personal information collected to provide, or in providing a health service.

This policy specifies how Mercy Services will meet its moral and legal obligations to ensure that each individual has as much control over their personal information as possible. The policy and its procedures apply to all staff and volunteers.

Mercy Services is committed to protecting the privacy of its clients, employees, volunteers, donors and supporters. Private/personal information includes the: name, address, relationship to Mercy Services, health information and photographic image of applicable persons (client/carer/donor/staff/volunteer/applicant for paid/voluntary work, donor/supporter).

Personal information collected and held by us

We will seek your consent to enable us to collect information about you. In seeking your consent we will try to explain:

• the purpose of collecting the information;
• who will have access to what parts of the information;
• what we will use the information for;
• who the health information will be passed on to;
• whether providing the information is voluntary or required by law; and
• the consequences of giving or refusing consent.

We may collect the following types of personal information on clients, staff, volunteers and donors/supporters:

• name;
• mailing or street address;
• email address;
• telephone number;
• facsimile number;
• age or birth date;
• photography or video recording of you;
• profession, occupation or job title;
• contact details of your next of kin/emergency contacts;
• personal goals/care preferences, risks involved in activities and venues you may use;
• details of the products and services you have purchased from us or which you have enquired about, together with any additional information necessary to deliver those products and services and to respond to your enquiries;
• bank account and payment details;
• any additional information relating to you that you provide to us directly through our websites or indirectly through use of our websites or online presence, through our representatives or otherwise; and
• information you provide to us through our service centre, customer surveys or visits by our representatives from time to time.

We may also collect some information that is not personal information because it does not identify you or anyone else. For example, we may collect anonymous answers to surveys or aggregated information about how users use our website.

How we collect your personal information

We collect your personal information directly from you unless it is unreasonable or impracticable to do so. When collecting personal information from you, we may collect it in ways including:

• during conversations between you and our representatives;
• when you complete an application or assessment/service delivery form;
• letters or emails you have sent us; and/or
• through your access and use of our website.

You should always feel the setting where we are collecting the information from you provides enough privacy.
If you are unable to give consent we will seek consent from your Enduring Power of Attorney, Guardian or any other person who is authorised by law to act for or represent you.

We may also collect personal information from third parties including reports and information provided to us by other services that are or have assisted you, law enforcement agencies and other government entities.

Security of internet transmission

As our website is linked to the internet, and the internet is inherently insecure, we cannot provide any assurance regarding the security of transmission of information you communicate to us online. We also cannot guarantee that the information you supply will not be intercepted while being transmitted over the internet. Accordingly, any personal information or other information which you transmit to us online is transmitted at your own risk.

If we can’t collect your personal information

If you do not provide us with the personal information described above, some or all of the following may happen:

• we may be unable to tailor the content of our services to your preferences and your experience of our services may not be as enjoyable or useful;
• where fees are charged, if you withhold information about your income, fees may be charged at the highest rate;
• we may not be able to provide the requested products or services to you, either to the same standard or at all; and/or
• we may also decide not to provide a service or may change the type or location of the service if information regarding safety is not provided.

We can use identifying numbers and anonymity

Where a person’s information is being used for research or statistical purposes we may be able to protect your privacy by using a unique number or code to represent you rather than use your name. The use of an identifier (number or code) instead of a person’s name may still not be enough to prevent others identifying you. This is particularly the case with members of minorities and those with atypical characteristics. In these cases the information will not be used or will be further disguised.
Mercy Services is prohibited by law and will not adopt, use or disclose an identifier assigned by a government agency, except in prescribed circumstances e.g. Tax file number.

Anonymity

Wherever it is lawful and practicable, we will give people the opportunity to remain anonymous when entering into transactions with, or receiving services from Mercy Services.

The purposes for which we collect, hold, use and disclose your personal information

We collect, hold, use and disclose your personal information for the following purposes:

• to provide products and services to you and to send communications requested by you;
• to answer enquiries and provide information or advice about existing and new products or services;
• to assess the performance of the website and to improve the operation of the website;
• to conduct business processing functions including providing personal information to our contractors, service providers or other third parties;
• for the administrative, marketing (including direct marketing), planning, product or service development, corporate planning, contractors or service providers, quality control and research purposes;
• to enable government funders to monitor who is being assisted and how much assistance they are receiving with government funds;
• to provide your updated personal information to our contractors or service providers;
• to update our records and keep your contact details up to date;
• to process and respond to any complaint made by you; and
• to comply with any law, rule, regulation, lawful and binding determination, decision or direction of a regulator, or in co-operation with any governmental authority of any country (or political sub-division of a country).

Your personal information will not be shared, sold, rented or disclosed other than as described in this Privacy Policy.

Direct marketing materials

We may send you direct marketing communications and information about our products and services that we consider may be of interest to you. These communications may be sent in various forms, including mail, SMS, fax and email, in accordance with applicable marketing laws, such as the Spam Act 2003 (Cth). If you indicate a preference for a method of communication, we will endeavour to use that method whenever practical to do so. In addition, at any time you may opt-out of receiving marketing communications from us by contacting us (see the details below) or by using opt-out facilities provided in the marketing communications and we will then ensure that your name is removed from our mailing list.

We do not provide your personal information to other organisations for the purposes of direct marketing.

Storing your information securely is important to us

We will take reasonable security safeguards to protect the security of personal information we hold. 

Some reasonable safeguards include:

• personal information being stored in filing cabinets and storage areas that are locked when unattended;
• not displaying client names and details in public areas;
• positioning computer terminals and fax machines so that they cannot be seen or accessed by unauthorised people or members of the public;
• using passwords to restrict computer access, and requiring regular changes to passwords;
• establishing different access levels so that not all staff can view all information;
• secure waste disposal of expired records; and
• installing virus protections and firewalls.

Client records are only removed from Mercy Services premises:

• to be securely archived;
• as the result of a court order;
• for transfer to another organisation;
• to be given to the consumer, their family or guardian; and/or
• in a secure way for the purpose of delivering services (only relevant sections of the record, in a non-identifying envelope/cover and while under constant supervision).

We will retain information relating to the applicable person as follows:

• in the case of information collected while the person was an adult – for 7 years from the last occasion on which they were with a service;
• in the case of health information collected while the person was under the age of 18 years – the record will be kept until the person turns 25.

We will dispose of information securely. When we delete or dispose of a person’s information we will keep a record of:

• the name of the person;
• the period covered by the information: and/or
• the date on which it was deleted or disposed of.

When we transfer a person’s information to another organisation (and we do not continue to hold a copy of that information) we will keep a record of the name and address of the organisation to which we transferred the information.

Disclosing your information

All Mercy Services staff, volunteers, and/or students on placement who collect or have access to personal information should understand this Privacy Policy and have signed a confidentiality agreement.

In general, we will only use (within Mercy Services) and disclose (to people/organisations outside Mercy Services) a person’s information for the primary purpose for which the information was collected.

We may disclose your personal information to:

• our employees, contractors or service providers for the purposes of: operation of our business, fulfilling requests by you, and to otherwise provide products and services to you including, without limitation, couriers, contractors, and professional advisors such as accountants, solicitors, business advisors and consultants;
• suppliers and other third parties with whom we have commercial relationships, for business, marketing, and related purposes; and
• any organisation for any authorised purpose with your express consent.

There may be circumstances when Mercy Services has to disclose information without the person’s consent. These circumstances include:

1. you do not have decision making capacity (and your Enduring Guardian has authorised the disclosure);
2. the law requires us to consult with the Police Service or the child protection agencies regarding children perceived to be at risk of abuse or neglect;
3. the law requires us to act upon serious concerns for the health or safety of a client or another person;
4. the law requires us to report incidences of serious criminal offence; and/or
5. a court of law may subpoena a client/staff file and Mercy Services is required by law to provide the file.

In the event that any of the situations described above should occur, Mercy Services will make reasonable efforts to discuss the matter with the person at the earliest possible opportunity.

Transferring your information outside NSW

Mercy Services will only transfer health information out of NSW in the following circumstances:

• recipient subject to substantially similar privacy standards or laws - Mercy Services will satisfy itself that the recipient is subject to a law, binding scheme or contract that imposes substantially similar obligations to those imposed within NSW;
• consent - the person has consented to the transfer of their information;
• contractual obligation - the transfer is necessary for the performance of a contract between Mercy Services and the person;
• benefit to the person - the transfer is for the benefit of the person, and it is impracticable to obtain their consent, and, if it were practicable to obtain such consent, the person would be likely to give it;
• serious threat to health or welfare - the transfer is reasonably believed to be necessary to lessen or prevent a serious and imminent threat to the life, health or safety to any person, or a serious threat to public health or public safety; and
• lawful authorisation - the transfer is permitted or required by an Act (including an Act of the Commonwealth) or any other law.

You can access and correct your personal information

You may request access to any personal information we hold about you at any time by contacting us (see the details below).

Where a person seeks to access her/his information held by Mercy Services the person’s request should be on the appropriate form (Attachment 4). This form requires the person to specify the way they want to access her/his information.

There is no fee charged for requesting to access your information. If you want a copy of your information exceeding ten pages or if it requires detailed searching of our records, we may charge you an administration fee of $1 per page.

Mercy Services may refuse a person access to their health information if:

• providing access would pose a serious threat to the life or health of any person (for example where there is a risk that the information may cause the person significant distress, so as to result in them harming themselves or another);
• providing access would have an unreasonable impact on the privacy of other people (where a person’s record contains information about someone else, Mercy Services will prevent an unreasonable impact on that other person’s privacy by removing that other person’s identifying details before releasing the information);
• the information relates to legal proceedings (existing or anticipated) between Mercy Services and the person, and the information is subject to legal professional privilege;
• providing access would reveal Mercy Services intentions in relation to negotiations with the person in such a way as to expose Mercy Services to disadvantage (for example, regarding the settlement of a negligence claim);
• denying access is required or authorised under another law;
• providing access would be likely to prejudice an investigation of possible unlawful activity;
• Mercy Services has been asked by a law enforcement agency performing a lawful security function not to provide access, as it would likely cause damage to the security of Australia;
• the request for access is one that has been made unsuccessfully on at least one previous occasion and there are no reasonable grounds for making the request again; and/or
• the person has been provided with access to their information already and is making an unreasonable repeated request for access to the same information in the same manner.

If Mercy Services decides to refuse access, it will provide a written reason for the refusal. The reason must be one of the reasons listed above. Access may be refused to a part of the information, to which a request relates, but provided to the remainder of the information.

Where Mercy Services refuses to provide the person with access to their health information on the grounds that providing access would pose a serious threat to their life or health, the notice of refusal must:

1. advise the person that he or she may nominate a medical practitioner to be given access to the health information instead; and
2. advise the person that any nomination must be made within 21 days, after receipt of the notice of refusal.

Access must then be provided to the nominated medical practitioner within 21 days of receiving the person’s nomination.
Mercy Services may not be able to provide information in the way requested due to:

I. sections needing to be blocked out or omitted due to the reasons listed above;
II. the request placing unreasonable demands on Mercy Services resources;
III. the request being detrimental to the preservation of the information; and/or
IV. the release involving an infringement of copyright.

In these cases, Mercy Services will discuss with the person the other options.
Mercy Services will respond to a request for access within 21 days after receiving the request.

You can request changes/corrections to your information

If you believe that personal information we hold about you is incorrect, incomplete or inaccurate, then you may request us to amend it.
Where a person seeks to amend her/his information held by Mercy Services the person’s request must be on the appropriate form.

Mercy Services will respond to a request to amend a record within 21 days after receiving the request. In response to a request for amendment, Mercy Services may amend (by way of corrections, deletions or additions) the person’s information to ensure:

• the information is accurate; and
• the information is relevant, up to date, complete and not misleading, taking into account the purpose for which the information is collected and used.

For legal and medical reasons, Mercy Services will generally not permanently delete information from a person’s record.
Mercy Services may refuse to amend the person’s health information if it is satisfied that the health information is not incomplete, incorrect, irrelevant, out of date or misleading.

If Mercy Services is not prepared to make the amendment requested, it will give the person in writing:

1. the reason for the refusal;
2. the complaint mechanism; and
3. any other matter prescribed by the Australian Privacy Principles regulations .

If a request to amend information is refused the person can ask Mercy Services to add a notation to the health information specifying their claim that the information is inaccurate, out-of-date, incomplete, irrelevant or misleading. Mercy Services will then take reasonable steps to ensure the statement is apparent to those who access the information.

With the client’s consent Mercy Services will inform third parties about amended client information provided by, or relied upon by, that third party.

We encourage you, in the first instance, to raise your issue with your immediate Coordinator or Manager to try and resolve the issue. If you are still not satisfied with the response to your concern or complaint please contact our Complaints Officer, who is also our Chief Executive Officer.

Once received we will review your concern or complaint and commit to providing a response within 21 working days, the Complaints Officer will be independent of the original compliant and will have the authority to fully investigate and resolve the complaint. If your concern still remains unresolved to your satisfaction we will assist you in directing your issue to: NSW Information and Privacy Commission on 1300 363 992 http://www.ipc.nsw.gov.au/.

At any stage you can involve a support person or advocate. Agencies that may help in this area are:

The Disability Advocacy Service Phone (02) 4927 0111; or
The Aged Care Rights Service (TARS). Phone toll free: 1800 424 079.