Privacy Policy
1 – Purpose of Privacy Policy
Gallipoli Medical Research ACN 077 750 693 is a not-for-profit health promotion charity and approved research institute. Gallipoli Medical Research operates as a single company but may have related entities. In this Policy, the principal company and its related entities are collectively referred to as GMR (or we).
The purpose of this Privacy Policy is to clearly communicate to you how GMR handles your Personal Information. It will give you a better and more complete understanding of the type of Personal Information that GMR holds about you and the way GMR handles that information.
GMR is bound by the Privacy Act 1988 (Privacy Act), which includes the Australian Privacy Principles (APPs). The APPs establish how GMR may collect, use, disclose and store Personal Information and how individuals may access and correct Personal Information that GMR holds about them.
This Policy is not exhaustive and where the Policy does not cover a particular set of circumstances, GMR will act in accordance with the Privacy Act, the APPs and any specific guidelines that may apply to GMR within the context of medical research.
GMR encourages you to check its website regularly for any updates to this Privacy Policy.
2 – Terms used
In this Privacy Policy the following terms are used:
Personal Information: information or an opinion about an identified individual, or an individual who is reasonably identifiable:
- whether the information or opinion is true or not
- whether the information or opinion is recorded in a material form or not.
Personal information also includes Sensitive Information and Health Information. Information that is ‘sensitive information’ attracts a higher privacy standard under the Privacy Act and is subject to additional mechanisms for your protection.
Health Information is a particular subset of Personal Information and means:
- information or an opinion about:
- the health, injury or a disability (at any time) of an individual
- an individual’s expressed wishes about the future provision of health services to him or her
- a health service provided or to be provided to an individual
- other personal information collected to provide a health service to an individual
- other personal information collected in connection with the donation, or intended donation, by an individual or his or her body parts, organs or body substances
- genetic information about an individual in a form that is or could be predictive or the health of the individual or a genetic relative of the individual.
Primary purpose means the specific function or activity for which the information is collected. Any use or disclosure of the Personal Information for another purpose is known as the Secondary Purpose.
Sensitive Information means information such as your race, religion, political opinions or sexual preferences, information used for biometric verification or identification, and biometric templates.
3 – Who does this Policy apply to?
This Privacy Policy applies to GMR’s collection, use and disclosure of Personal Information from anyone from whom GMR collects Personal Information. This could be clinical trial participants, nominated support persons, contractors, suppliers, service providers engaged by us and other individuals engaged by or providing services to GMR.
In relation to employees of GMR, this Privacy Policy will not apply to acts or practices by GMR that directly relate to:
- a current or former employment relationship between GMR and you
- an employee record held by GMR and relating to you.
4 – What information is collected
GMR collects Personal Information, including Health Information, which is reasonably necessary to provide its services, as well as for administrative and internal business functions. Examples of the types of Personal Information collected include:
- biographical information (e.g. names, titles, relationships and birth dates)
- contact information (addresses, email addresses and telephone numbers)
- Medicare number
- copies of referrals and or reports from treating practitioners
- physical appearance information
- ethnic background
- information about current physical and mental health, and current lifestyle
- physical/mental/social/reproduction/drug/travel/family history
- treatment history
- family history of diseases
- information from physical health and virus screens
- genetic information from DNA and RNA.
5 – How information is collected
GMR will usually collect your Personal Information, which may include Health Information, directly from you and with your express or implied consent.
Sometimes, GMR may need to collect information about you from a third party such as:
- a relative
- Commonwealth and state agencies (e.g. medical records and results)
- registries (e.g. death and cancer registries)
- other fundraising organisations
- community service organisations
- schools and universities
- employers
- another health service provider.
Collection from third parties will only occur where you have consented to the collection of your information in this way or where it is not reasonable or practical for us to collect this information directly from you, such as where your health may be at risk and we need your Personal Information to provide you with emergency medical treatment.
Collection of your Personal Information may occur in many ways, including:
- clinical images
- admission forms
- client forms
- emails
- telephone conversations
- in person
- mobile phone applications
- when a complaint is lodged with GMR.
In some circumstances, Personal Information may be collected in the form of clinical images taken for the purpose of medical research. GMR will, in such cases, manage your Personal Information contained in these clinical images in accordance with the APPs and this Privacy Policy.
GMR will take reasonable steps before, or at the time it collects Personal Information, to notify you of the collection of Personal Information, including the purpose of collection.
If it is not practicable to provide a collection notice before, or at the time when Personal Information is collected, GMR will take steps as soon as practicable after collection to provide notice and ensure that you are aware after the collection.
6 – Storage
GMR may store the Personal Information we collect from you in various forms. GMR will comply with the APPs, and this Privacy Policy, in respect of your Personal Information in whatever form that information is stored by us.
Storage of Personal Information may be in physical (paper) form and may also be through an electronic system via various data management software or systems in accordance with usual business practices and depending on the Primary Purpose of your engagement with GMR.
Personal Information may, from time to time, be stored in, processed in and transferred between countries abroad in which GMR has service providers. Information may be held by GMR in Australian servers or by service providers located abroad. In using the services of GMR you are taken to have agreed to and consented to such border-cross transfers of Personal Information.
7 – Use and disclosure of information collected
GMR collects and holds Personal Information, which may include Health Information, for the purpose of providing our services which includes the following:
- undertaking medical research projects, including research relevant to providing advanced care for patients, improvements in diagnostic techniques, novel treatment options and faster recovery pathways
- assessing suitability for participation in clinical trials
- conducting clinical trials to investigate new therapies, drugs and diagnostic tools for use in clinical practices
- contacting you in relation to participating in clinical trials
- publication of research (as non-identifiable data)
- development of tissue and/or data banks
- for fundraising in relation to:
- marketing to and informing supporters and donors about GMR fundraising initiatives
- fostering relationships with current and potential donors for philanthropy purposes
- organising fundraising events
- contacting and communicating with you
- to perform our administrative functions
- to satisfy GMR’s legal obligations and to allow GMR to discharge its duty or care
- to resolve complaints or enquiries.
Where Personal Information is collected, GMR will only use that information for the Primary Purpose for which that information has been given. This information may be disclosed to third parties:
- for the Primary Purpose for which it was collected
- for a Secondary Purpose where permitted by the APPs
- if required by law
- if you consent to the disclosure
- if otherwise as permitted by the Privacy Act, the APPs or any specific guidelines that apply to GMR in the context of medical research.
GMR will not sell or exchange Personal Information for commercial gain.
Personal Information collected for the purpose of medical research can only be used and disclosed by GMR without consent in accordance with the guidelines issued under section 95 (medical research) and section 95A (Health Information) of the Privacy Act. In these circumstances GMR must satisfy itself that the use and disclosure of Personal Information has been approved by the GMR Research Ethics Committee in accordance with the relevant section 95 and section 95A guidelines, where the guidelines are applicable.
GMR will require you to specifically consent to any disclosure of your Personal Information, where possible. If possible, this consent will be sought in writing. There may be occasions where GMR accepts verbal consent.
Examples of where GMR may also use your information for other purposes are including you on a marketing mailing list, fundraising or research list, statistical analysis, to promote GMR goods and services and to improve and personalise our service offerings. Please note, by signing up to receive our biannual magazine you are agreeing to receive linked fundraising campaign material.
8 – Anonymity
You are able to deal with GMR anonymously or under a pseudonym, unless required or authorised by an Australian law or court or tribunal order to the contrary. If GMR is required by such a law or order to deal with an identified individual, then GMR can require you to identify yourself.
9 – Access to and correction of information
You have a right to have access to the Personal Information that we hold about you. This may require a request in writing with sufficient information to identify you to satisfy GMR that the request for Personal Information has been made by you personally.
GMR will take reasonable steps to ensure all Personal Information held is accurate, up to date, complete, relevant and not misleading. Individuals may ask GMR to amend or correct any Personal Information held, which GMR will then consider. Should a change not be agreed, then GMR will provide written reasons for doing so.
Requests for amendments or corrections should be sent to enquiries@gallipoliresearch.org.au to the attention of the GMR Privacy Officer.
10 – Data security
GMR will take reasonable steps to protect your information from misuse, interference, loss, unauthorised access, modification or disclosure. We use technologies and processes such as access control procedures, network firewalls, encryption and physical security to protect your privacy.
GMR will destroy or permanently de-identify any of your Personal Information that is in its possession or control, if it is no longer needed for the purpose for which it was collected, provided GMR is not required under an Australian law or court/tribunal or otherwise to retain the information.
In the event of a data breach GMR will comply with the mandatory data breach notification scheme for all eligible breaches pursuant to the Privacy Act.
11 – Website
Sometimes, we may collect your Personal Information if you choose to provide this to us via an online form or by email, for example, if you:
- complete a donation online
- submit a general enquiry;
- register to receive newsletters
- register for an event or request information
- send us a written complaint or enquiry.
When you use our website, we record and log for statistical purposes the following information about your visit:
- your computer (IP)_ address
- your top-level domain name (for example, .com,.gov, .org, .au etc);
- the date and time of your visit
- the pages and documents you access during your visit
- the browser you are using.
This information is used to evaluate the effectiveness of the website.
Further, GMR may use this information to target you on social media for advertising through the use of social media pixels.
We are, however, obliged to allow law enforcement agencies and other government agencies with relevant legal authority to inspect our web server logs, if an investigation being conducted warrants such inspection.
A “cookie” is a small bit of data our server sends to your browser that allows our server to identify and interact more effectively with your computer. Cookies do not identify individual users, but they do identify your ISP and your browser type.
GMR may use cookies. This means that upon closing your browser, the cookie assigned to your computer or device may remain active to enhance your use of the website when you return to the website.
Personal information such as your email address is not collected unless you provide it to us. We do not disclose domain names or aggregate information to third parties other than agents who assist us with this website and who are under obligations of confidentiality. You can configure your browser to accept or reject all cookies and to notify you when a cookie is used. We suggest that you refer to your browser instructions or help screens to learn more about these functions. However, please note that if you configure your browser so as not to receive any cookies, a certain level of functionality of the GMR website and other websites may be lost.