1. Introduction
Stroke Foundation respects the privacy rights of all individuals and is committed to ensuring that we comply at all times with our obligations under the Privacy Act 1988 (Cth), as amended by the Privacy and Other Legislation Amendment Act 2024 (Cth), the Privacy Amendment (Notifiable Breaches) Act 2017 (Cth), the Privacy Amendment (Enhancing Privacy Protection) Act 2012 (Cth), and the Australian Privacy Principles.
We may amend this Privacy Policy at any time and for any reason. A section of the latest version of this policy will be available at www.strokefoundation.org.au.
The purpose of this policy is to provide guidance to Stroke Foundation Workforce Members about protecting the privacy of Personally Identifiable Information (PII) which Stroke Foundation collects, holds and administers. It sets out the standards and procedures relating to the collection, holding, use and disclosure by Stroke Foundation of PII. This policy also informs the public about how Stroke Foundation collects, holds and administers their PII to protect their privacy.
Stroke Foundation’s Board is responsible for the approval and periodic review of this Policy. Management is responsible for its implementation, monitoring compliance with applicable privacy legislation, and ensuring the Policy remains current and effective.
2. Australian Privacy Principles (APP)
Stroke Foundation adheres to the principles set out in the APP in the way it collects, manages and uses PII.
3. Open & Transparent Management of Information
Stroke Foundation’s Privacy Policy is publicly available on its website.
Stroke Foundation will take reasonable steps (in accordance with applicable law, in particular Chapter 5: APP 5 - Notification of the collection of PII - OAIC) to inform the individual of the type of PII held and how it collects, holds, uses and discloses that PII.
4. Collection of Information
Stroke Foundation collects PII that it requires to carry out its work. Wherever practicable, PII is collected directly from the individual. Information may also be collected if publicly available but only where that collecting and holding information is necessary to carry out Stroke Foundation’s Mission.
Stroke Foundation has implemented procedures and systems to obtain and record Consent.
Sensitive Information
Stroke Foundation collects Sensitive Information where Express Consent has been provided, and it is relevant to Stroke Foundation’s Mission.
Unsolicited PII
Where Stroke Foundation receives PII that has not been requested, it will assess whether the information is reasonably necessary for its functions or activities. If it is determined that the information is not required, Stroke Foundation will take reasonable steps to destroy or permanently de‑identify the information, where lawful and practicable to do so.
Images
Individuals may be filmed or photographed when attending Stroke Foundation events. Stroke Foundation will seek Express Consent through completion of signed forms for the use of any images obtained.
At large scale events where it is not feasible to obtain written consent from every attendee, Stroke Foundation will display notices around the venue to inform attendees that filming and/or photography is taking place. Where signage and notices have provided clear notification of filming or photography, images may be used for Stroke Foundation's broader communications consistent with the purpose disclosed at the event.
Photographs are stored in the Digital Asset Management database and retained for as long as they remain relevant to Stroke Foundation's Mission, with periodic review to remove material that is no longer required.
Stroke Experience Guidelines
Stroke Foundation has developed specific guidelines to make ethically sound decisions in relation to the collection of Stroke Experiences that abides by relevant legislation, such as the Privacy Act 1988 (Cth), as amended by the Privacy and Other Legislation Amendment Act 2024 (Cth), the Privacy Amendment (Notifiable Breaches) Act 2017 (Cth), the Privacy Amendment (Enhancing Privacy Protection) Act 2012 (Cth), and the Australian Privacy Principles and is consistent with Stroke Foundation’s Values and policies.
Consent for the use of a person’s Stroke Experience must be recorded using the Privacy Consent Form in Stroke Foundation’s Digital Asset Management database found in the intranet. There is an online Privacy Consent Form and a PDF Privacy Consent Form. The PDF version is available for people who are unable to access an online version.
If physical forms are used, these must be scanned and stored in the Digital Asset Management database. The physical forms can then be destroyed securely.
Anonymity and Use of Pseudonyms
Where practicable, individuals may choose to interact with Stroke Foundation anonymously or by using a pseudonym. However, in some circumstances it may not be possible to do so, particularly where identification is required to provide services, manage accounts, or comply with legal or regulatory obligations.
Consequences of Not Providing Personal Information
Individuals are not required to provide personal or sensitive information requested by Stroke Foundation. However, failure to provide required information may limit Stroke Foundation’s ability to deliver services, respond to enquiries, or fulfil operational and regulatory obligations.
Opt-out or withdrawal of Consent
An individual can opt-out of communications or withdraw their Consent to Stroke Foundation handling their PII by contacting Stroke Foundation on 03 9670 1000 or clicking “Unsubscribe” on any relevant email communication, or by emailing digital@strokefoundation.org.au.
Use of Third-party providers to collect information
Third-party providers may be utilised to collect and report information on behalf of Stroke Foundation. Consent will be asked from stakeholders on this methodology prior to collection of information. Individuals can opt-out by contacting Stroke Foundation on 03 9670 1000 or by email: digital@strokefoundation.org.au.
5. Collecting your PII via Stroke Foundation websites
Stroke Foundation uses technology such as ‘Cookies’ to gather PII. We do this for two reasons, to ensure our online resources are easier to use and so that we can understand the needs of our users better. Cookies allow us to recognise your device and whether you have visited our site before.
The information we gather also allows us to better track traffic and engagement. We use the Google Analytics service to gather this information. This provides an insight into our websites in areas such as demographics, interests, impressions, remarketing, and reporting. With this research and insight, we can continuously improve our services. We may also use third party cookies (such as Facebook pixels) and links in our emails to track open and click-through rates - this helps us learn and ensures we improve the quality of services, programs and resources. We use the Google Analytics service to gather this information.
By using our websites and viewing our emails, you are consenting to this information being gathered by Google Analytics. It is important to note that this information does not identify individual users. If you do not wish to receive cookies, you can go to the settings section of your browser and set this to not receive cookies, noting that in doing so website functionality may be reduced. You can also opt out from Facebook advertising by going to “Why am I seeing this?” on a specific Stroke Foundation Facebook ad, selecting “Options” and then selecting “Hide all ads from this advertiser.”
Where individuals voluntarily submit information through public channels (such as online forums, forms, or other digital platforms), that information may be publicly accessible and capable of being reused or republished by Stroke Foundation for purposes consistent with its Mission. Requests for removal of such content will be considered and actioned where reasonably practicable.
6. Data Security & Handling
Stroke Foundation complies with the Privacy Amendment (Notifiable Data Breaches) Act 2017 and undertakes all reasonable steps (including technical and organisational measures) to protect PII from loss and unauthorised misuse, access, interference, modification or disclosure, including storing PII data within Australia.
Stroke Foundation takes all reasonable steps to securely destroy or permanently de-identify PII for which there is no ongoing business, regulatory, contractual or legal requirement, in accordance with our Information and Systems Security Policy.
Stroke Foundation retains data consistent with Stroke Foundation’s business, legal and regulatory purposes.
Data accuracy and quality
Stroke Foundation will take reasonable steps to ensure that personal information it collects, holds, uses or discloses is accurate, complete, up to date and relevant, having regard to the purpose for which the information is being used.
Security of account information
Where PII is accessed through online systems, Stroke Foundation will implement appropriate controls, including password protection and secure access mechanisms. Individuals are responsible for maintaining the confidentiality of their account credentials, and Stroke Foundation will not request passwords via email, phone or other unsolicited communication.
Data provided to Stroke Foundation
Data provided to Stroke Foundation is retained in accordance with relevant legislation, which includes:
- APP11.2, which requires data to be destroyed or de-identified after it is no longer needed for the purpose for which it was provided. an individual can ask for the removal of their PII from Stroke Foundation’s customer relationship management database (Salesforce) record by contacting Stroke Foundation on 03 9670 1000 or by email: digital@strokefoundation.org.au. Where possible the information will be removed, however if the record is required to be maintained under legislation, the data will be de-identified and removed when no longer required to be maintained.
- The Income Tax Assessment Act (1936) requires financial records to be maintained for five years after an income tax assessment was lodged.
Stroke Foundation data provided to a third party
When Stroke Foundation data has been provided to a third party:
- The primary purpose of providing that information dictates the third party’s obligations in relation to the data. Therefore, APP11.2 is the applicable standard – data must be destroyed or deidentified by the third party after it is no longer needed for the purpose for which it was provided. This includes deletion from backup sites.
- Appropriate handling of shared data is included in all contracts with third party providers.
- From time to time Stroke Foundation may seek confirmation (from suppliers in receipt of Stroke Foundation PII) of destruction of any Stroke Foundation supplied PII.
Data Breach Notification
In the event of a suspected or confirmed data breach involving PII, Stroke Foundation will take reasonable steps to contain and assess the breach, notify affected individuals where required, investigate the cause, and implement measures to mitigate risk and prevent recurrence, in accordance with applicable legislation and internal procedures.
Stroke Foundation maintains Data Retention and Data Breach Management Procedures in support of this Policy.
7. Use & Disclosure
Use
Stroke Foundation will use the PII it collects to:
- Contact its donors, consumers and Stakeholders;
- Comply with legislative and regulatory requirements;
- Identify donors, consumers and Stakeholders when they request information, change their details or have queries;
- Empower the stroke and wider community through sharing stories, lived experiences and images;
- Ensure the continuous improvement of Stroke Foundation’s business, workforce and services;
- Customise advertising and marketing content where this is consistent with consent provided.
Stroke Foundation will use the PII it collects for the original purpose for which it was disclosed, a directly related purpose with Consent or as required or permitted by law.
Disclosure
The organisation may disclose PII it holds where there is a legal obligation to do so, including a lawful duty of care.
Under the APP guidelines, there are ‘special’ situations which allow the use or disclosure of PII, for example, where Stroke Foundation reasonably believes
- The use or disclosure is necessary to lessen or prevent a serious threat to life, health or safety of an individual or to public health or safety, or
- An individual may have engaged in unlawful behavior or serious misconduct that relates to Stroke Foundation’s activities.
In such circumstances, Stroke Foundation is obligated to disclose the PII and take appropriate action.
Disclosure to Third Parties
Stroke Foundation may disclose PII to the following Third Parties where there is a business need to do so:
- To related entities;
- To Contractors, Consultants and other service providers appointed by us; including but not limited to website and data hosting providers, technology service providers and advertising and promotional agencies;
- To our professional advisers, including but not limited to accountants, insurers, lawyers and auditors;
- To an attorney, financial advisor, accountant or medical practitioner who certifies in writing on letterhead that he/she acts for an individual and makes a specific request for specific information, with evidence of the appointing instrument provided;
- Otherwise with Consent or as required or permitted by law.
Where PII is disclosed to third party providers located overseas, those providers may not be subject to privacy obligations equivalent to those under Australian law. By engaging with Stroke Foundation, individuals acknowledge and agree that such disclosures may occur where necessary to support organisational activities.
In all other cases, prior to disclosing PII to Third Parties, Stroke Foundation will agree upon confidentiality terms binding such Third Parties to the same or greater level as provided for in this Policy.
8. Access & Correction
Stroke Foundation will take all reasonable steps to ensure the PII it collects is accurate, complete, up to date and relevant, having regard to the use or disclosure of the PII it holds.
Subject to the APP guidelines, individuals may gain access to their PII held by Stroke Foundation if it is reasonable and practical to do so by contacting Stroke Foundation on 03 9670 1000, or clicking “Unsubscribe” on any relevant email communication, or by emailing digital@strokefoundation.org.au.
Stroke Foundation will respond to an access request within a reasonable period, 14 days for simple requests and not exceeding 30 calendar days for all requests. Should an access request be refused, Stroke Foundation will provide the requestor with a written notice, including information on how to dispute a refusal.
An individual can request to correct PII held by Stroke Foundation. Stroke Foundation will respond to the request within a reasonable period.
Identity verification
Before granting access to PII or processing correction requests, Stroke Foundation may require individuals to verify their identity to ensure that personal information is protected from unauthorised access or disclosure.
Refusal of Access
Stroke Foundation may refuse access to PII, where permitted under applicable law, including where providing access would unreasonably impact the privacy of others, the request is frivolous or vexatious, or access is otherwise restricted by legislation. Where access is refused, Stroke Foundation will provide written reasons for the decision.
Relevant Workforce Members will be trained in organisational procedure on how to respond to requests for access to PII.
9. Feedback
Stroke Foundation welcomes feedback on this Policy which may be provided through Stroke Foundation’s Contact Us page.
Privacy Complaints Handling
Stroke Foundation will take all privacy complaints seriously and will respond within a reasonable timeframe, generally within a specified service standard. If an individual is dissatisfied with the outcome, they may escalate their complaint to the OAIC or other relevant regulator.
10. Appendix I: Stroke Experience Consent Guidelines
Stroke Experiences are the lived experiences, images and digital recordings of the people in our stroke community. Sharing the experiences of people in our stroke community is an important part of what we do.
Stroke Foundation understands that mismanaging communications can harm both the people we strive to support, as well as our organisation. We also recognise the opportunity for sharing experiences to empower Contributors, as well as those who hear it.
Guiding principle |
Description |
| Consent |
Stroke Foundation seeks to establish Express Consent wherever possible for the collection and use of Stroke Experiences. The terms of Consent provide a definitive timeframe for which Consent is given. We understand that circumstances change, and information should not be used indefinitely. Renewing Consent aims to ensure the currency and accuracy of experiences and/or photographs. It provides an opportunity for our Contributors to share new experiences. Stroke Foundation’s Digital Asset Management database process requires that Consent is recorded for Stroke Experiences. |
| Communication |
Stroke Foundation’s engagement with Contributors will include, where relevant, discussion of the opportunities and risks associated with sharing Stroke Experiences and examples of how that content might be used or published. Stroke Foundation is proactive in communicating with Contributors about the publication of their Stroke Experiences, even with established Consent. This means that Stroke Foundation will take all reasonable steps to engage with Contributors prior to publication and provide them with access to all published material. Stroke Foundation welcomes engagement with Contributors at all stages in the process. A central contact is available via digital@strokefoundation.org.au. |
11. Definitions
Term |
Description |
| Australian Privacy Principles (APP) |
The Australian Privacy Principles (APP) established by the Privacy Amendment (Enhancing Privacy Protection) Act 2012 (Cth) as it applies to Organisations and Government agencies. |
| Consent |
Consent is either:
All Consent must be informed. The four key elements of Consent are:
|
| Contributor |
A person who actively shares their Stroke Experience with Stroke Foundation. A Contributor could also be someone who hasn't had a stroke but linked to the community or our cause in some way. |
| Cookies (Internet) |
Data from a website that is stored within a web browser that the website can retrieve later. |
| Express Consent |
Express Consent is given explicitly, either orally or in writing. |
| Implied Consent |
Implied Consent arises where Consent may reasonably be inferred in the circumstances from the conduct of the individual and Stroke Foundation. |
| Mission |
The core purpose and associated activities of Stroke Foundation |
| Personally Identifiable Information (PII) |
PII includes a broad range of information and/or opinions that could identify an individual. Examples of PII include but are not limited to: Identity Information
Workforce Member record information
Contact and Relationship Management information
Stroke Experience and Fundraising Web Contents Technical/digital information:
|
| Sensitive Information |
Sensitive Information is PII that includes information or an opinion about an individual’s:
It may also include some elements of biometric information. Generally, sensitive information has a higher level of privacy protection than other PII. |
| Stroke Experience |
PII that captures a person’s experience in the stroke community, images/photographs and/or video/audio recordings. |
| Stakeholders |
A person, position, group or organisation that has an interest or concern in Stroke Foundation and can affect or be affected by Stroke Foundation’s actions and objectives. |