Lutheran Homes Group ABN 58 113 769 710 (‘we’, ‘our’, ‘us’ or ‘LHG’) requires certain personal information about our care recipients, their representatives or others who interact with us to provide our care services. We are committed to protecting the privacy of those with which we interact. As an aged care provider, we are bound by the Privacy Act 1988 (Cth) (Privacy Act) and the Aged Care Act 2024 (Cth) (Aged Care Act) to protect your rights to personal privacy and to have your personal information protected.
This Privacy Policy (Policy) may apply to you if you are:
- a care recipient (or prospective care recipient);
- an authorised representative or supporter of a care recipient (or prospective care recipient);
- a job applicant with us;
- an employee/volunteer of LHG;
- a contractor (including an employee thereof) who contracts with us for services; or
- any other individual who interacts with us.
This Policy explains:
- what personal information we collect about you and how;
- how we use or disclose your personal information with others;
- how we securely store and protect your personal information; and
- your rights to access our records of your personal information and contact us.
By voluntarily supplying us with your personal information, you are agreeing to be bound by this Policy. While we may update our Policy from time to time, the most recent version of this Policy will always be available on our website. If we change the Policy in any material way, we will post a notice on our website along with the updated Policy. We may also contact you via your contact information on file, for example by email, notification or some other equivalent measure.
If you have any queries, concerns or complaints about how we handle your personal information, please speak with a member of staff or contact our Privacy Officer:
Privacy Officer Contact: Penelope Moore
Email: pmoore@lutheranhomes.com.au
Postal Address:
Attn: Privacy Officer
2nd Floor
100 Pirie Street
Adelaide SA 5000
What types of information do we collect and why?
In the course of providing our services, we collect and store personal and other information about our care recipients and other individuals and how they interact with us. We collect personal information through a number of mechanisms, as set out below. This Policy applies where we both collect and store personal information in a record.
Collection from you: where possible, we will collect the information we require directly from you. We collect and store information that you provide directly to us (either in person, by email, by phone, or by any other direct means). This includes:
- Contact information: such as your name, address, email address, telephone number;
- Personal information: such as date of birth, gender, and driver’s licence details;
- Financial and payment information: such as your payment information (credit card, bank account, etc);
- Aged care funding information: if you are an aged care recipient, this includes aged care access approvals, funding classification, services received, and other sensitive information which we are required by law to collect (see below);
- Sensitive Information: we collect, and in some instances are required under the Aged Care Act to collect, certain information considered “sensitive information” under the Privacy Act. We will only collect this information about you if necessary for one of our activities, including if you are an aged care recipient. We will only collect this information directly from you or where we have consent to collect the information from a third party. We only collect and use this information to provide tailored care and meet our legal requirements. We collect:
- Racial and ethnic origin: including whether you are an Aboriginal or Torres Strait Islander; and
- Health or genetic information: about you and your medical care history (including family history), vaccination status (where you choose to share this with us), conditions, needs and expressed future wishes regarding care; and
- Religious/philosophical beliefs or affiliations: (where you choose to share this with us)
- Employee/volunteer information: If you are an LHG employee, volunteer or job applicant, we may collect (in addition to the types of information listed above) information related to your (potential) employment or similar relationship with us. This includes performance information, emergency contact details, health information, training, qualifications, taxation/financial affairs and membership of trade or professional associations (unions) as permitted or required by law.
Device: if you use our services or interact with us through a mobile device, we receive technical information about your device, numbers that identify the device and your location information. This information may be associated with you.
Communications: when you communicate with us, we collect information such as your contact details (such as email address or phone number). We also engage third-party services that provide us with information about how you interact with some communications we distribute. You can elect to not receive communications from us by contacting our Privacy Officer.
Automatic: we use cookies (small text files stored on your devices that provide us with information such as your internet protocol (IP) address, server information, internet service provider, and information on how you interact with our website) and other services that allow us to understand how you use our online media.
If you opt-out of third-party tracking technologies or elect to prevent the use of cookies, this may result in the loss of website functionality, restrict your use of the website or delay or affect the way in which the website operates.
Surveillance systems: in order for us to provide you with appropriate security at our sites, camera surveillance systems (such as CCTV) may be used in public areas at our sites and their surrounds. These systems may collect and store personal information about you. The use of surveillance systems at our sites is always conducted in accordance with our surveillance policies.
Our vehicles also store location data which may be linked to individuals (including employees) who use our vehicles for transportation purposes. You will always be informed that a vehicle is recording location data.
Through other sources: where necessary, we may also collect your information from publicly available records (including social media platforms) or other sources permitted under law to share information about you. This can include information from relatives or other authorised representatives, job referees, health service providers or information. We may do this where it is unreasonable or impractical to collect this information from you. Any information we collect from social media, or other online platforms is collected in accordance with that platform’s terms and conditions.
Providing someone else’s information: If you provide us with personal information about someone else (such as where you are the authorised representative for someone who either receives or is seeking to receive care), you must ensure that you are authorised to disclose their personal information to us and that we may collect, store, use and disclose such information for the purposes described in this Policy. Where we request you to do so, you must assist us with any requests by the individual to access or update the personal information you have collected from them and provided to us. If you are someone who does not have a relationship with us but believe that someone has provided your personal information to us, you will need to contact that person for any questions you have about your personal information (including where you want to access, correct, amend, or request that we delete your personal information).
You have the option of not identifying yourself or interacting with us using a pseudonym. You can also choose not to provide your personal information. However, this may mean that we are unable to provide you with our services. If you are a care recipient (or prospective care recipient), we will not be able to provide you with our care services if you choose not to provide us with certain personal information.
If we receive unsolicited personal information, we will determine whether we could have lawfully collected that personal information. If we determine that we could not have lawfully collected the information, we will destroy or de-identify the information as soon as possible.
How do we use your information?
We will only use your personal information for managing and conducting our business of providing aged care services and accommodation, retirement living, home and community support services, or for purposes connected with providing those services (this is our primary purpose), where you make a specific request or with your consent (as permitted by the law).
How we use the information we collect depends, in part, on which services you receive from us and any preferences you have communicated to us. If you would like to restrict how your personal information is handled beyond what is outlined in this Policy, please speak with a member of staff or contact our Privacy Officer.
We may send you marketing communications (such as newsletters) in line with your previously expressed marketing preferences or as otherwise permitted under the Privacy Act and other relevant laws. If you do not wish to receive such communications, please contact us via the contact details at the beginning of this Policy or follow the opt-out instructions contained in each marketing communication.
Disclosure of personal information to third parties
We may disclose your information to third parties who assist us in providing, managing and administering our services. We may also disclose your personal information where such disclosure is required or permitted by law or where you have provided us with consent to such disclosure.
We may disclose your personal information to third parties that:
- Deliver or assist us in providing certain services, including the Department of Health, Disability, and Ageing.
- Process information as necessary for providing aged care services or ensuring we comply with the Aged Care Act, including the Department of Health, Disability, and Ageing;
- Help us fulfil any requests we make on your behalf which require the disclosure of your personal information; or
- Send marketing information to you on our behalf (unless you have opted out of receiving marketing communications);
- Require your personal information for a purpose connected with the delivery of our services or to which you separately consent.
We do not disclose or store personal information overseas.
In certain circumstances we may be required or permitted to disclose your personal information without your consent in order to fulfil our reporting obligations under the Aged Care Act (such as reporting incidents to regulators), or to comply with any court orders, subpoenas or other legal process including investigations, if such disclosure is required by law.
We may also disclose your personal information as permitted by the Privacy Act in a permitted health or general situation.
Applicants and employees/volunteers
If you are a job applicant with LHG, we may use/disclose your personal information in the course of confirming your references or verifying the accuracy of the information you have provided.
If you are an LHG employee or volunteer, we will use your personal information in connection with your employment/volunteer relationship with us. This may include disclosing your personal information to third parties that assist us with human resources services and payroll administration or compliance.
How do we store and secure the information we collect?
We store your personal information as both physical files in a secured area and on electronic database systems. These systems are securely monitored and maintained by us, including by restriction of access to unauthorised individuals.
Security and management of personal information
We will take reasonable steps to protect the personal information we hold from misuse, loss, unauthorised and accidental access, modification, disclosure, destruction, or other action which prevents or otherwise hinders our access to your personal information on a temporary or permanent basis. We do this by:
- Requiring any third party providers to have acceptable security measures to keep personal information secure;
- Limiting access to the information we collect about you;
- Imposing confidentiality requirements on our employees; and
- Only providing access to personal information once proper identification has been given.
While we take all steps reasonable in the circumstances to protect your information, in the unlikely event of a reportable data breach, we will notify you and any relevant authorities in accordance with our obligations under the Privacy Act and other laws as necessary.
We will only keep your personal information for as long as we require it for the purpose for which it was collected. We are required by the Aged Care Act to retain certain personal information about care recipients or others for up to 7 years. We may also be required to retain some or all of your personal information for specified periods of time by other legislation, for example under certain laws relating to companies and financial reporting legislation.
If we no longer require your personal information, and are not legally required to retain it, we will take reasonable steps to destroy or de-identify the personal information.
How can you access and control your information?
Accessing the information we hold about you
You have rights to access certain information that we hold about you. This includes, in addition to documents containing personal information, a variety of records relating to the provision of aged care services under the Aged Care Act.
If you are an authorised representative or a supporter of a care recipient, you may also be able to make requests on their behalf to access information with their consent.
To make a request to access this information, please contact us in writing at the address at the front of this Policy.
We will require you to verify your identity and specify what information you wish to access. If eligible, we will endeavour to grant you access to the information within 30 days. The time it takes us to process your request will ultimately depend on the size and complexity of the request.
If we accept your request for access, we may charge a fee to cover our costs of processing the application, including retrieving, reviewing and copying any material requested. We will not charge you for the request itself.
Updating your personal information
We endeavour to ensure that the personal information we hold about you is accurate, complete and up-to-date. Please contact us at the details above if you believe that the information we hold about you requires correction or is out of date. We endeavour to process any request within 30 days and will provide written reasons if your request is rejected, as well as providing details for making a complaint about the refusal if necessary.
Complaints
If you are concerned that we have not complied with your legal rights or the applicable privacy laws, please contact a member of staff or our Privacy Officer (contact details above) in the first instance. If you are an authorised representative or supporter under the Aged Care Act, you may complain on behalf of the person who nominated you.
Please provide us with a thorough description of your concerns and a response will be provided within a reasonable period. All complaints to the Privacy Officer must be in writing.
When processing a complaint, we will require you to provide us with information to confirm your identity before processing a request related to information we may hold about you.
We expect our procedures will deal fairly and promptly with your complaint. However, if you remain dissatisfied, you can also contact the Office of the Australian Information Commissioner as follows:
Director of Compliance Office of the Australian Information Commissioner
GPO Box 5218
Sydney NSW 2001
For more information on privacy, see the Australian Information Commissioner’s website.